openapi: 3.0.0 info: contact: email: support@datadoghq.com name: Datadog Support url: https://www.datadoghq.com/support/ description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically. title: Datadog Account Custom API version: '1.0' servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for Datadog customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - datadoghq.eu - ddog-gov.com subdomain: default: api description: The subdomain where the API is deployed. - url: '{protocol}://{name}' variables: name: default: api.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: api description: The subdomain where the API is deployed. security: - apiKeyAuth: [] appKeyAuth: [] tags: - name: Custom paths: /api/v2/cloud_security_management/custom_frameworks: post: description: Create a custom framework. operationId: CreateCustomFramework requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateCustomFrameworkRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CreateCustomFrameworkResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' '500': $ref: '#/components/responses/BadRequestResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Datadog Create a Custom Framework tags: - Custom x-codegen-request-body-name: body x-given: custom_framework: parameters: - name: body value: "{\n \"data\": {\n \"type\":\"custom_framework\",\n \"attributes\":{\n \"name\":\"name\",\n \"handle\":\"create-framework-new\",\n \"version\":\"10\",\n \"icon_url\":\"test-url\",\n \"requirements\":[{\n \"name\":\"requirement\",\n \"controls\":[{\n \"name\":\"control\",\n \"rules_id\":\n [\"def-000-be9\"]\n }]\n }]\n }\n }\n}" step: there is a valid "custom_framework" in the system x-menu-order: 4 x-permission: operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write x-undo: operationId: DeleteCustomFramework parameters: - name: handle source: data.attributes.handle - name: version source: data.attributes.version type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cloud_security_management/custom_frameworks/{handle}/{version}: delete: description: Delete a custom framework. operationId: DeleteCustomFramework parameters: - $ref: '#/components/parameters/CustomFrameworkHandle' - $ref: '#/components/parameters/CustomFrameworkVersion' responses: '200': content: application/json: schema: $ref: '#/components/schemas/DeleteCustomFrameworkResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' '500': $ref: '#/components/responses/BadRequestResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Datadog Delete a Custom Framework tags: - Custom x-codegen-request-body-name: body x-menu-order: 4 x-permission: operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK get: description: Get a custom framework. operationId: GetCustomFramework parameters: - $ref: '#/components/parameters/CustomFrameworkHandle' - $ref: '#/components/parameters/CustomFrameworkVersion' responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetCustomFrameworkResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' '500': $ref: '#/components/responses/BadRequestResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Datadog Get a Custom Framework tags: - Custom x-codegen-request-body-name: body x-menu-order: 4 x-permission: operator: OR permissions: - security_monitoring_rules_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK put: description: Update a custom framework. operationId: UpdateCustomFramework parameters: - $ref: '#/components/parameters/CustomFrameworkHandle' - $ref: '#/components/parameters/CustomFrameworkVersion' requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateCustomFrameworkRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/UpdateCustomFrameworkResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' '500': $ref: '#/components/responses/BadRequestResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Datadog Update a Custom Framework tags: - Custom x-codegen-request-body-name: body x-menu-order: 4 x-permission: operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/custom_costs: get: description: List the Custom Costs files. operationId: ListCustomCostsFiles responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomCostsFileListResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Datadog List Custom Costs Files tags: - Custom x-menu-order: 10 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK put: description: Upload a Custom Costs file. operationId: UploadCustomCostsFile requestBody: content: application/json: schema: $ref: '#/components/schemas/CustomCostsFileUploadRequest' required: true responses: '202': content: application/json: schema: $ref: '#/components/schemas/CustomCostsFileUploadResponse' description: Accepted '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Datadog Upload Custom Costs File tags: - Custom x-menu-order: 11 x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/custom_costs/{file_id}: delete: description: Delete the specified Custom Costs file. operationId: DeleteCustomCostsFile parameters: - $ref: '#/components/parameters/FileID' responses: '204': description: No Content '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Datadog Delete Custom Costs File tags: - Custom x-menu-order: 13 x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK get: description: Fetch the specified Custom Costs file. operationId: GetCustomCostsFile parameters: - $ref: '#/components/parameters/FileID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomCostsFileGetResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Datadog Get Custom Costs File tags: - Custom x-menu-order: 12 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/custom-destinations: get: description: Get the list of configured custom destinations in your organization with their definitions. operationId: ListLogsCustomDestinations responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationsResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Custom Destinations tags: - Custom x-menu-order: 1 x-permission: operator: OR permissions: - logs_read_data - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK post: description: Create a custom destination in your organization. operationId: CreateLogsCustomDestination requestBody: content: application/json: schema: $ref: '#/components/schemas/CustomDestinationCreateRequest' description: The definition of the new custom destination. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Custom Destination tags: - Custom x-codegen-request-body-name: body x-given: custom_destination: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"query\": \"source:nginx\",\n \"enabled\": false,\n \"forwarder_destination\": {\n \"type\": \"http\",\n \"endpoint\": \"https://example.com\",\n \"auth\": {\n \"type\": \"basic\",\n \"username\": \"my-username\",\n \"password\": \"my-password\"\n }\n },\n \"forward_tags_restriction_list_type\": \"BLOCK_LIST\",\n \"forward_tags_restriction_list\": [\"host\"],\n \"forward_tags\": false\n },\n \"type\": \"custom_destination\"\n }\n}" step: there is a valid "custom_destination" in the system x-menu-order: 2 x-permission: operator: OR permissions: - logs_write_forwarding_rules x-undo: operationId: DeleteLogsCustomDestination parameters: - name: custom_destination_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/custom-destinations/{custom_destination_id}: delete: description: Delete a specific custom destination in your organization. operationId: DeleteLogsCustomDestination parameters: - $ref: '#/components/parameters/CustomDestinationId' responses: '204': description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Delete a Custom Destination tags: - Custom x-menu-order: 5 x-permission: operator: OR permissions: - logs_write_forwarding_rules x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK get: description: Get a specific custom destination in your organization. operationId: GetLogsCustomDestination parameters: - $ref: '#/components/parameters/CustomDestinationId' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Custom Destination tags: - Custom x-menu-order: 3 x-permission: operator: OR permissions: - logs_read_data - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK patch: description: Update the given fields of a specific custom destination in your organization. operationId: UpdateLogsCustomDestination parameters: - $ref: '#/components/parameters/CustomDestinationId' requestBody: content: application/json: schema: $ref: '#/components/schemas/CustomDestinationUpdateRequest' description: New definition of the custom destination's fields. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Update a Custom Destination tags: - Custom x-codegen-request-body-name: body x-menu-order: 4 x-permission: operator: OR permissions: - logs_write_forwarding_rules x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/asm/waf/custom_rules: get: description: Retrieve a list of WAF custom rule. operationId: ListApplicationSecurityWAFCustomRules responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleListResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog List All Waf Custom Rules tags: - Custom x-menu-order: 13 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK post: description: Create a new WAF custom rule with the given parameters. operationId: CreateApplicationSecurityWafCustomRule requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateRequest' description: The definition of the new WAF Custom Rule. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConcurrentModificationResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Waf Custom Rule tags: - Custom x-codegen-request-body-name: body x-given: custom_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"custom_rule\",\n \"attributes\": {\n \"blocking\": false,\n \"conditions\": [\n {\n \"operator\": \"match_regex\",\n \"parameters\": {\n \"inputs\": [\n {\n \"address\": \"server.request.query\",\n \"key_path\": [\n \"id\"\n ]\n }\n ],\n \"regex\": \"badactor\"\n }\n }\n ],\n \"enabled\": true,\n \"name\": \"test\",\n \"path_glob\": \"/test\",\n \"scope\": [\n {\n \"env\": \"test\",\n \"service\": \"test\"\n }\n ],\n \"tags\": {\n \"category\": \"attack_attempt\",\n \"type\": \"test\"\n }\n }\n }\n}" step: there is a valid "custom_rule" in the system x-menu-order: 12 x-undo: operationId: DeleteApplicationSecurityWafCustomRule parameters: - name: custom_rule_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}: delete: description: Delete a specific WAF custom rule. operationId: DeleteApplicationSecurityWafCustomRule parameters: - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam' responses: '204': description: No Content '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConcurrentModificationResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Delete a Waf Custom Rule tags: - Custom x-menu-order: 16 x-terraform-resource: appsec_waf_custom_rule x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK get: description: Retrieve a WAF custom rule by ID. operationId: GetApplicationSecurityWafCustomRule parameters: - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Waf Custom Rule tags: - Custom x-menu-order: 10 x-terraform-resource: appsec_waf_custom_rule x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK put: description: 'Update a specific WAF custom Rule. Returns the Custom Rule object when the request is successful.' operationId: UpdateApplicationSecurityWafCustomRule parameters: - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam' requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateRequest' description: New definition of the WAF Custom Rule. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConcurrentModificationResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Update a Waf Custom Rule tags: - Custom x-codegen-request-body-name: body x-menu-order: 15 x-terraform-resource: appsec_waf_custom_rule x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: CustomCostsFileMetadataWithContentHighLevel: description: JSON API format of for a Custom Costs file with content. properties: attributes: $ref: '#/components/schemas/CustomCostsFileMetadataWithContent' id: description: ID of the Custom Costs metadata. type: string example: abc-123-def type: description: Type of the Custom Costs file metadata. type: string example: metric alert type: object CustomDestinationForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: '#/components/schemas/CustomDestinationHttpDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationForwardDestinationHttpType' required: - type - endpoint - auth type: object ApplicationSecurityWafCustomRuleAction: description: The definition of `ApplicationSecurityWafCustomRuleAction` object. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionAction' parameters: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters' type: object CustomCostsFileGetResponse: description: Response for Get Custom Costs files. properties: data: $ref: '#/components/schemas/CustomCostsFileMetadataWithContentHighLevel' meta: $ref: '#/components/schemas/CustomCostGetResponseMeta' type: object CustomCostsFileUploadResponse: description: Response for Uploaded Custom Costs files. properties: data: $ref: '#/components/schemas/CustomCostsFileMetadataHighLevel' meta: $ref: '#/components/schemas/CustomCostUploadResponseMeta' type: object ApplicationSecurityWafCustomRuleTagsCategory: description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`. enum: - attack_attempt - business_logic - security_response example: business_logic type: string x-enum-varnames: - ATTACK_ATTEMPT - BUSINESS_LOGIC - SECURITY_RESPONSE UpdateCustomFrameworkResponse: description: Response object to update a custom framework. properties: data: $ref: '#/components/schemas/FrameworkHandleAndVersionResponseData' required: - data type: object CustomDestinationForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: access_token: description: Access token of the Splunk HTTP Event Collector. This field is not returned by the API. example: splunk_access_token type: string writeOnly: true endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunkType' required: - type - endpoint - access_token type: object CustomDestinationResponseHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string type: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeaderType' required: - type - header_name type: object ApplicationSecurityWafCustomRuleResponse: description: Response object that includes a single WAF custom rule. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData' type: object CustomDestinationElasticsearchDestinationAuth: description: Basic access authentication. properties: password: description: The password of the authentication. This field is not returned by the API. example: datadog-custom-destination-password type: string writeOnly: true username: description: The username of the authentication. This field is not returned by the API. example: datadog-custom-destination-username type: string writeOnly: true required: - username - password type: object ApplicationSecurityWafCustomRuleConditionParameters: description: The scope of the WAF custom rule. properties: data: description: Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter. example: blocked_users type: string inputs: description: List of inputs on which at least one should match with the given operator. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput' type: array list: description: 'List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and !exact_match operator.' items: type: string type: array options: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions' regex: description: Regex to use with the condition. Only used with match_regex and !match_regex operator. example: path.* type: string value: description: Store the captured value in the specified tag name. Only used with the capture_data operator. example: custom_tag type: string required: - inputs type: object GetCustomFrameworkResponse: description: Response object to get a custom framework. properties: data: $ref: '#/components/schemas/FullCustomFrameworkData' required: - data type: object FullCustomFrameworkData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: '#/components/schemas/FullCustomFrameworkDataAttributes' id: description: The ID of the custom framework. example: handle-version type: string type: $ref: '#/components/schemas/CustomFrameworkType' required: - id - type - attributes type: object ApplicationSecurityWafCustomRuleUpdateAttributes: description: Update a WAF custom rule. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction' blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger.' items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition' type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean name: description: The Name of the WAF custom rule. example: Block request from bad useragent type: string path_glob: description: The path glob for the WAF custom rule. example: /api/search/* type: string scope: description: The scope of the WAF custom rule. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope' type: array tags: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags' required: - enabled - blocking - name - tags - conditions type: object CustomDestinationAttributeTagsRestrictionListType: default: ALLOW_LIST description: 'How `forward_tags_restriction_list` parameter should be interpreted. If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded. `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list.' enum: - ALLOW_LIST - BLOCK_LIST example: ALLOW_LIST type: string x-enum-varnames: - ALLOW_LIST - BLOCK_LIST CustomDestinationForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP ApplicationSecurityWafCustomRuleCondition: description: One condition of the WAF Custom Rule. properties: operator: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator' parameters: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters' required: - operator - parameters type: object CustomCostsFileMetadataHighLevel: description: JSON API format for a Custom Costs file. properties: attributes: $ref: '#/components/schemas/CustomCostsFileMetadata' id: description: ID of the Custom Costs metadata. type: string example: abc-123-def type: description: Type of the Custom Costs file metadata. type: string example: metric alert type: object ApplicationSecurityWafCustomRuleConditionOperator: description: Operator to use for the WAF Condition. enum: - match_regex - '!match_regex' - phrase_match - '!phrase_match' - is_xss - is_sqli - exact_match - '!exact_match' - ip_match - '!ip_match' - capture_data example: match_regex type: string x-enum-varnames: - MATCH_REGEX - NOT_MATCH_REGEX - PHRASE_MATCH - NOT_PHRASE_MATCH - IS_XSS - IS_SQLI - EXACT_MATCH - NOT_EXACT_MATCH - IP_MATCH - NOT_IP_MATCH - CAPTURE_DATA CreateCustomFrameworkRequest: description: Request object to create a custom framework. properties: data: $ref: '#/components/schemas/CustomFrameworkData' required: - data type: object ApplicationSecurityWafCustomRuleListResponse: description: Response object that includes a list of WAF custom rules. properties: data: description: The WAF custom rule data. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData' type: array type: object ApplicationSecurityWafCustomRuleConditionInputAddress: description: Input from the request on which the condition should apply. enum: - server.db.statement - server.io.fs.file - server.io.net.url - server.sys.shell.cmd - server.request.method - server.request.uri.raw - server.request.path_params - server.request.query - server.request.headers.no_cookies - server.request.cookies - server.request.trailers - server.request.body - server.response.status - server.response.headers.no_cookies - server.response.trailers - grpc.server.request.metadata - grpc.server.request.message - grpc.server.method - graphql.server.all_resolvers - usr.id - http.client_ip example: server.db.statement type: string x-enum-varnames: - SERVER_DB_STATEMENT - SERVER_IO_FS_FILE - SERVER_IO_NET_URL - SERVER_SYS_SHELL_CMD - SERVER_REQUEST_METHOD - SERVER_REQUEST_URI_RAW - SERVER_REQUEST_PATH_PARAMS - SERVER_REQUEST_QUERY - SERVER_REQUEST_HEADERS_NO_COOKIES - SERVER_REQUEST_COOKIES - SERVER_REQUEST_TRAILERS - SERVER_REQUEST_BODY - SERVER_RESPONSE_STATUS - SERVER_RESPONSE_HEADERS_NO_COOKIES - SERVER_RESPONSE_TRAILERS - GRPC_SERVER_REQUEST_METADATA - GRPC_SERVER_REQUEST_MESSAGE - GRPC_SERVER_METHOD - GRAPHQL_SERVER_ALL_RESOLVERS - USR_ID - HTTP_CLIENT_IP CustomCostsFileMetadataWithContent: description: Schema of a cost file's metadata. properties: billed_cost: description: Total cost in the cost file. example: 100.5 format: double type: number billing_currency: description: Currency used in the Custom Costs file. example: USD type: string charge_period: $ref: '#/components/schemas/CustomCostsFileUsageChargePeriod' content: description: Detail of the line items from the Custom Costs file. items: $ref: '#/components/schemas/CustomCostsFileLineItem' type: array name: description: Name of the Custom Costs file. example: my_file.json type: string provider_names: description: Providers contained in the Custom Costs file. items: description: Name of a provider. example: my_provider type: string type: array status: description: Status of the Custom Costs file. example: active type: string uploaded_at: description: Timestamp in millisecond of the upload time of the Custom Costs file. example: 1704067200000 format: double type: number uploaded_by: $ref: '#/components/schemas/CustomCostsUser' type: object CustomCostsFileUploadRequest: description: Request for uploading a Custom Costs file. items: $ref: '#/components/schemas/CustomCostsFileLineItem' type: array CustomCostListResponseMeta: description: Meta for the response from the List Custom Costs endpoints. properties: total_filtered_count: description: Number of Custom Costs files returned by the List Custom Costs endpoint format: int64 type: integer example: 42 version: description: Version of Custom Costs file type: string example: example_value type: object ApplicationSecurityWafCustomRuleUpdateData: description: Object for a single WAF Custom Rule. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateAttributes' type: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType' required: - attributes - type type: object CustomCostsUser: description: Metadata of the user that has uploaded the Custom Costs file. properties: email: description: The name of the Custom Costs file. example: email.test@datadohq.com type: string icon: description: The name of the Custom Costs file. example: icon.png type: string name: description: Name of the user. example: Test User type: string type: object CustomDestinationUpdateRequest: description: The custom destination. properties: data: $ref: '#/components/schemas/CustomDestinationUpdateRequestDefinition' type: object CustomDestinationResponseHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasic' - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeader' CustomDestinationHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER CustomCostGetResponseMeta: description: Meta for the response from the Get Custom Costs endpoints. properties: version: description: Version of Custom Costs file type: string example: example_value type: object CustomCostsFileUsageChargePeriod: description: Usage charge period of a Custom Costs file. properties: end: description: End of the usage of the Custom Costs file. example: 1706745600000 format: double type: number start: description: Start of the usage of the Custom Costs file. example: 1704067200000 format: double type: number type: object ApplicationSecurityWafCustomRuleActionAction: default: block_request description: Override the default action to take when the WAF custom rule would block. enum: - redirect_request - block_request example: block_request type: string x-enum-varnames: - REDIRECT_REQUEST - BLOCK_REQUEST CreateCustomFrameworkResponse: description: Response object to create a custom framework. properties: data: $ref: '#/components/schemas/FrameworkHandleAndVersionResponseData' required: - data type: object CustomDestinationResponseHttpDestinationAuthBasic: description: Basic access authentication. properties: type: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasicType' required: - type type: object CustomDestinationCreateRequestAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.' example: - datacenter - host items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType' forwarder_destination: $ref: '#/components/schemas/CustomDestinationForwardDestination' name: description: The custom destination name. example: Nginx logs type: string query: default: '' description: The custom destination query and filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string required: - name - forwarder_destination type: object CustomDestinationCreateRequestDefinition: description: The definition of a custom destination. properties: attributes: $ref: '#/components/schemas/CustomDestinationCreateRequestAttributes' type: $ref: '#/components/schemas/CustomDestinationType' required: - type - attributes type: object CustomDestinationForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH ApplicationSecurityWafCustomRuleData: description: Object for a single WAF custom rule. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAttributes' id: description: The ID of the custom rule. example: 2857c47d-1e3a-4300-8b2f-dc24089c084b readOnly: true type: string type: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType' type: object ApplicationSecurityWafCustomRuleCreateRequest: description: Request object that includes the custom rule to create. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateData' required: - data type: object FullCustomFrameworkDataAttributes: description: Full Framework Data Attributes. properties: handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL example: https://example.com/icon.png type: string name: description: Framework Name example: security-framework type: string requirements: description: Framework Requirements items: $ref: '#/components/schemas/CustomFrameworkRequirement' type: array version: description: Framework Version example: '2' type: string required: - handle - version - name - requirements type: object ApplicationSecurityWafCustomRuleCreateAttributes: description: Create a new WAF custom rule. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction' blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger' items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition' type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean name: description: The Name of the WAF custom rule. example: Block request from a bad useragent type: string path_glob: description: The path glob for the WAF custom rule. example: /api/search/* type: string scope: description: The scope of the WAF custom rule. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope' type: array tags: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags' required: - enabled - blocking - name - tags - conditions type: object CustomCostUploadResponseMeta: description: Meta for the response from the Upload Custom Costs endpoints. properties: version: description: Version of Custom Costs file type: string example: example_value type: object CustomDestinationUpdateRequestAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be restricted from being forwarded. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.' example: - datacenter - host items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType' forwarder_destination: $ref: '#/components/schemas/CustomDestinationForwardDestination' name: description: The custom destination name. example: Nginx logs type: string query: default: '' description: The custom destination query and filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string type: object CustomDestinationHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string header_value: description: The header value of the authentication. This field is not returned by the API. example: CUSTOM-HEADER-AUTHENTICATION-VALUE type: string writeOnly: true type: $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeaderType' required: - type - header_name - header_value type: object CustomFrameworkWithoutRequirements: description: Framework without requirements. properties: description: description: Framework Description example: this is a security description type: string handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL example: https://example.com/icon.png type: string name: description: Framework Name example: security-framework type: string version: description: Framework Version example: '2' type: string required: - handle - version - name type: object CustomDestinationUpdateRequestDefinition: description: The definition of a custom destination. properties: attributes: $ref: '#/components/schemas/CustomDestinationUpdateRequestAttributes' id: description: The custom destination ID. example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 type: string type: $ref: '#/components/schemas/CustomDestinationType' required: - type - id type: object CustomDestinationResponse: description: The custom destination. properties: data: $ref: '#/components/schemas/CustomDestinationResponseDefinition' type: object DeleteCustomFrameworkResponse: description: Response object to delete a custom framework. properties: data: $ref: '#/components/schemas/CustomFrameworkMetadata' required: - data type: object CustomDestinationResponseHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER ApplicationSecurityWafCustomRuleConditionOptions: description: Options for the operator of this condition. properties: case_sensitive: default: false description: Evaluate the value as case sensitive. type: boolean example: true min_length: default: 0 description: Only evaluate this condition if the value has a minimum amount of characters. format: int64 type: integer example: 42 type: object CustomFrameworkControl: description: Framework Control. properties: name: description: Control Name. example: A1.2 type: string rules_id: description: Rule IDs. example: - '["def-000-abc"]' items: type: string type: array required: - name - rules_id type: object ApplicationSecurityWafCustomRuleMetadata: description: Metadata associated with the WAF Custom Rule. properties: added_at: description: The date and time the WAF custom rule was created. example: '2021-01-01T00:00:00Z' format: date-time type: string added_by: description: The handle of the user who created the WAF custom rule. example: john.doe@datadoghq.com type: string added_by_name: description: The name of the user who created the WAF custom rule. example: John Doe type: string modified_at: description: The date and time the WAF custom rule was last updated. example: '2021-01-01T00:00:00Z' format: date-time type: string modified_by: description: The handle of the user who last updated the WAF custom rule. example: john.doe@datadoghq.com type: string modified_by_name: description: The name of the user who last updated the WAF custom rule. example: John Doe type: string readOnly: true type: object CustomCostsFileMetadata: description: Schema of a Custom Costs metadata. properties: billed_cost: description: Total cost in the cost file. example: 100.5 format: double type: number billing_currency: description: Currency used in the Custom Costs file. example: USD type: string charge_period: $ref: '#/components/schemas/CustomCostsFileUsageChargePeriod' name: description: Name of the Custom Costs file. example: my_file.json type: string provider_names: description: Providers contained in the Custom Costs file. items: description: Name of the provider. example: my_provider type: string type: array status: description: Status of the Custom Costs file. example: active type: string uploaded_at: description: Timestamp, in millisecond, of the upload time of the Custom Costs file. example: 1704067200000 format: double type: number uploaded_by: $ref: '#/components/schemas/CustomCostsUser' type: object APIErrorResponse: description: API error response. properties: errors: description: A list of errors. example: - Bad Request items: description: A list of items. example: Bad Request type: string type: array required: - errors type: object CustomFrameworkType: default: custom_framework description: The type of the resource. The value must be `custom_framework`. enum: - custom_framework example: custom_framework type: string x-enum-varnames: - CUSTOM_FRAMEWORK ApplicationSecurityWafCustomRuleTags: additionalProperties: type: string description: 'Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security activity field associated with the traces.' maxProperties: 32 properties: category: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory' type: description: The type of the WAF rule, associated with the category will form the security activity. example: users.login.success type: string required: - category - type type: object CustomFrameworkDataHandleAndVersion: description: Framework Handle and Version. properties: handle: description: Framework Handle example: sec2 type: string version: description: Framework Version example: '2' type: string type: object CustomDestinationHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC ApplicationSecurityWafCustomRuleConditionInput: description: Input from the request on which the condition should apply. properties: address: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress' key_path: description: Specific path for the input. items: type: string type: array required: - address type: object CustomDestinationResponseForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttp' - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunk' - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearch' ApplicationSecurityWafCustomRuleUpdateRequest: description: Request object that includes the Custom Rule to update. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateData' required: - data type: object CustomDestinationForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC ApplicationSecurityWafCustomRuleActionParameters: description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object. properties: location: description: The location to redirect to when the WAF custom rule triggers. example: /blocking type: string status_code: default: 403 description: The status code to return when the WAF custom rule triggers. example: 403 format: int64 type: integer type: object CustomDestinationForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: '#/components/schemas/CustomDestinationForwardDestinationHttp' - $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunk' - $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearch' ApplicationSecurityWafCustomRuleAttributes: description: A WAF custom rule. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction' blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger.' items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition' type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean metadata: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleMetadata' name: description: The Name of the WAF custom rule. example: Block request from bad useragent type: string path_glob: description: The path glob for the WAF custom rule. example: /api/search/* type: string scope: description: The scope of the WAF custom rule. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope' type: array tags: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags' required: - enabled - blocking - name - tags - conditions type: object ApplicationSecurityWafCustomRuleScope: description: The scope of the WAF custom rule. properties: env: description: The environment scope for the WAF custom rule. example: prod type: string service: description: The service scope for the WAF custom rule. example: billing-service type: string required: - service - env type: object CustomDestinationResponseHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC CustomCostsFileLineItem: description: Line item details from a Custom Costs file. properties: BilledCost: description: Total cost in the cost file. example: 100.5 format: double type: number BillingCurrency: description: Currency used in the Custom Costs file. example: USD type: string ChargeDescription: description: Description for the line item cost. example: Monthly usage charge for my service type: string ChargePeriodEnd: description: End date of the usage charge. example: '2023-02-28' pattern: ^\d{4}-\d{2}-\d{2}$ type: string ChargePeriodStart: description: Start date of the usage charge. example: '2023-02-01' pattern: ^\d{4}-\d{2}-\d{2}$ type: string ProviderName: description: Name of the provider for the line item. type: string example: abc-123-def Tags: additionalProperties: type: string description: Additional tags for the line item. type: object type: object CustomDestinationResponseElasticsearchDestinationAuth: additionalProperties: description: Basic access authentication. description: Basic access authentication. type: object CustomDestinationHttpDestinationAuthBasic: description: Basic access authentication. properties: password: description: The password of the authentication. This field is not returned by the API. example: datadog-custom-destination-password type: string writeOnly: true type: $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthBasicType' username: description: The username of the authentication. This field is not returned by the API. example: datadog-custom-destination-username type: string writeOnly: true required: - type - username - password type: object CustomDestinationResponseForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: '#/components/schemas/CustomDestinationResponseElasticsearchDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).' example: yyyy-MM-dd type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearchType' required: - type - endpoint - auth - index_name type: object CustomDestinationResponseForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH CustomFrameworkMetadata: description: Metadata for custom frameworks. properties: attributes: $ref: '#/components/schemas/CustomFrameworkWithoutRequirements' id: description: The ID of the custom framework. example: handle-version type: string type: $ref: '#/components/schemas/CustomFrameworkType' type: object FrameworkHandleAndVersionResponseData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: '#/components/schemas/CustomFrameworkDataHandleAndVersion' id: description: The ID of the custom framework. example: handle-version type: string type: $ref: '#/components/schemas/CustomFrameworkType' required: - id - type - attributes type: object CustomFrameworkDataAttributes: description: Framework Data Attributes. properties: description: description: Framework Description type: string example: example_value handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL type: string example: https://app.datadoghq.com name: description: Framework Name example: security-framework type: string requirements: description: Framework Requirements items: $ref: '#/components/schemas/CustomFrameworkRequirement' type: array version: description: Framework Version example: '2' type: string required: - handle - version - name - requirements type: object CustomDestinationResponseForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP CustomDestinationResponseAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.' example: - datacenter - host items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType' forwarder_destination: $ref: '#/components/schemas/CustomDestinationResponseForwardDestination' name: description: The custom destination name. example: Nginx logs type: string query: default: '' description: The custom destination query filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string type: object CustomDestinationResponseForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC CustomFrameworkData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: '#/components/schemas/CustomFrameworkDataAttributes' type: $ref: '#/components/schemas/CustomFrameworkType' required: - type - attributes type: object CustomCostsFileListResponse: description: Response for List Custom Costs files. properties: data: description: List of Custom Costs files. items: $ref: '#/components/schemas/CustomCostsFileMetadataHighLevel' type: array meta: $ref: '#/components/schemas/CustomCostListResponseMeta' type: object CustomDestinationResponseForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType' required: - type - endpoint type: object CustomDestinationHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthBasic' - $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeader' CustomDestinationResponseDefinition: description: The definition of a custom destination. properties: attributes: $ref: '#/components/schemas/CustomDestinationResponseAttributes' id: description: The custom destination ID. example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 readOnly: true type: string type: $ref: '#/components/schemas/CustomDestinationType' type: object CustomFrameworkRequirement: description: Framework Requirement. properties: controls: description: Requirement Controls. items: $ref: '#/components/schemas/CustomFrameworkControl' type: array name: description: Requirement Name. example: criteria type: string required: - name - controls type: object CustomDestinationResponseForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttpType' required: - type - endpoint - auth type: object CustomDestinationType: default: custom_destination description: The type of the resource. The value should always be `custom_destination`. enum: - custom_destination example: custom_destination type: string x-enum-varnames: - CUSTOM_DESTINATION CustomDestinationsResponse: description: The available custom destinations. properties: data: description: A list of custom destinations. items: $ref: '#/components/schemas/CustomDestinationResponseDefinition' type: array type: object UpdateCustomFrameworkRequest: description: Request object to update a custom framework. properties: data: $ref: '#/components/schemas/CustomFrameworkData' required: - data type: object CustomDestinationCreateRequest: description: The custom destination. properties: data: $ref: '#/components/schemas/CustomDestinationCreateRequestDefinition' type: object CustomDestinationForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: '#/components/schemas/CustomDestinationElasticsearchDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).' example: yyyy-MM-dd type: string type: $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearchType' required: - type - endpoint - auth - index_name type: object ApplicationSecurityWafCustomRuleType: default: custom_rule description: The type of the resource. The value should always be `custom_rule`. enum: - custom_rule example: custom_rule type: string x-enum-varnames: - CUSTOM_RULE ApplicationSecurityWafCustomRuleCreateData: description: Object for a single WAF custom rule. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateAttributes' type: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType' required: - attributes - type type: object responses: NotFoundResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found ForbiddenResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden ConflictResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Conflict ConcurrentModificationResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Concurrent Modification NotAuthorizedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Authorized TooManyRequestsResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests BadRequestResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request parameters: CustomDestinationId: description: The ID of the custom destination. in: path name: custom_destination_id required: true schema: type: string CustomFrameworkHandle: description: The framework handle in: path name: handle required: true schema: type: string CustomFrameworkVersion: description: The framework version in: path name: version required: true schema: type: string ApplicationSecurityWafCustomRuleIDParam: description: The ID of the custom rule. example: 3b5-v82-ns6 in: path name: custom_rule_id required: true schema: type: string FileID: description: File ID. in: path name: file_id required: true schema: type: string securitySchemes: AuthZ: description: This API uses OAuth 2 with the implicit grant flow. flows: authorizationCode: authorizationUrl: /oauth2/v1/authorize scopes: apm_api_catalog_read: View API catalog and API definitions. apm_api_catalog_write: Add, modify, and delete API catalog definitions. apm_read: Read and query APM and Trace Analytics. apm_service_catalog_read: View service catalog and service definitions. apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog. appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source. cases_read: View Cases. cases_write: Create and update cases. ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API. ci_visibility_read: View CI Visibility. cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs. cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs. code_analysis_read: View Code Analysis. continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO). create_webhooks: Create webhooks integrations. dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'. dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'. dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally. dashboards_read: View dashboards. dashboards_write: Create and change dashboards. data_scanner_read: View Data Scanner configurations. data_scanner_write: Edit Data Scanner configurations. embeddable_graphs_share: Generate public links to share embeddable graphs externally. events_read: Read Events data. hosts_read: List hosts and their attributes. incident_notification_settings_write: Configure Incidents Notification settings. incident_read: View incidents in Datadog. incident_settings_write: Configure Incident Settings. incident_write: Create, view, and manage incidents in Datadog. metrics_read: View custom metrics. monitor_config_policy_write: Edit and delete monitor configuration. monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes. monitors_read: View monitors. monitors_write: Edit, delete, and resolve individual monitors. org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization. security_comments_read: Read comments of vulnerabilities. security_monitoring_filters_read: Read Security Filters. security_monitoring_filters_write: Create, edit, and delete Security Filters. security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks. security_monitoring_notification_profiles_read: View Rule Security Notification rules. security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules. security_monitoring_rules_read: Read Detection Rules. security_monitoring_rules_write: Create and edit Detection Rules. security_monitoring_signals_read: View Security Signals. security_monitoring_suppressions_read: Read Rule Suppressions. security_monitoring_suppressions_write: Write Rule Suppressions. security_pipelines_read: View Security Pipelines. security_pipelines_write: Create, edit, and delete CSM Security Pipelines. slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs. slos_read: View SLOs and status corrections. slos_write: Create, edit, and delete SLOs. synthetics_global_variable_read: View, search, and use Synthetics global variables. synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics. synthetics_private_location_read: View, search, and use Synthetics private locations. synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines. synthetics_read: List and view configured Synthetic tests and test results. synthetics_write: Create, edit, and delete Synthetic tests. teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission. teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team. test_optimization_read: View Test Optimization. timeseries_query: Query Timeseries data. usage_read: View your organization's usage and usage attribution. user_access_invite: Invite other users to your organization. user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries. user_access_read: View users and their roles and settings. workflows_read: View workflows. workflows_run: Run workflows. workflows_write: Create, edit, and delete workflows. tokenUrl: /oauth2/v1/token type: oauth2 apiKeyAuth: description: Your Datadog API Key. in: header name: DD-API-KEY type: apiKey x-env-name: DD_API_KEY appKeyAuth: description: Your Datadog APP Key. in: header name: DD-APPLICATION-KEY type: apiKey x-env-name: DD_APP_KEY bearerAuth: scheme: bearer type: http x-env-name: DD_BEARER_TOKEN x-group-parameters: true x-merge-override: paths: false