openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Existing API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Existing
paths:
  /api/v2/actions/connections/{connection_id}:
    delete:
      description: Delete an existing Action Connection
      operationId: DeleteActionConnection
      parameters:
      - $ref: '#/components/parameters/ConnectionId'
      responses:
        '204':
          description: The resource was deleted successfully.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too Many Request
      summary: Datadog Delete an Existing Action Connection
      tags:
      - Existing
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - connection_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get an existing Action Connection
      operationId: GetActionConnection
      parameters:
      - $ref: '#/components/parameters/ConnectionId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetActionConnectionResponse'
          description: Successfully get Action Connection
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too Many Request
      summary: Datadog Get an Existing Action Connection
      tags:
      - Existing
      x-menu-order: 1
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Update an existing Action Connection
      operationId: UpdateActionConnection
      parameters:
      - $ref: '#/components/parameters/ConnectionId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateActionConnectionRequest'
        description: Update an existing Action Connection request body
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateActionConnectionResponse'
          description: Successfully updated Action Connection
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too Many Request
      summary: Datadog Update an Existing Action Connection
      tags:
      - Existing
      x-menu-order: 3
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}:
    x-merge-override:
      delete: true
    delete:
      description: Deletes an existing incident from the users organization.
      operationId: DeleteIncident
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Delete an Existing Incident
      tags:
      - Existing
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - incident_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Updates an incident. Provide only the attributes that should be updated as this request is a partial update.
      operationId: UpdateIncident
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentIncludeQueryParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentUpdateRequest'
        description: Incident Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Existing Incident
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/relationships/integrations/{integration_metadata_id}:
    patch:
      description: Update an existing incident integration metadata.
      operationId: UpdateIncidentIntegration
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentIntegrationMetadataIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentIntegrationMetadataPatchRequest'
        description: Incident integration metadata payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentIntegrationMetadataResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Existing Incident Integration Metadata
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 12
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/roles/{role_id}/clone:
    x-merge-override:
      post: true
    post:
      description: Clone an existing role
      operationId: CloneRole
      parameters:
      - $ref: '#/components/parameters/RoleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleCloneRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Conflict
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_manage
      summary: Datadog Create a New Role by Cloning an Existing Role
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 12
      x-permission:
        operator: OR
        permissions:
        - user_access_manage
      x-undo:
        operationId: DeleteRole
        parameters:
        - name: role_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules/{rule_id}:
    put:
      description: Updates an existing rule.
      operationId: UpdateScorecardRule
      parameters:
      - $ref: '#/components/parameters/RuleId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRuleRequest'
        description: Rule attributes.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRuleResponse'
          description: Rule updated successfully
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Update an Existing Rule
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}:
    delete:
      description: Delete an existing rule. Default rules cannot be deleted.
      operationId: DeleteSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Delete an Existing Rule
      tags:
      - Existing
      x-menu-order: 7
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: 'Update an existing rule. When updating `cases`, `queries` or `options`, the whole field

        must be included. For example, when modifying a query all queries must be included.

        Default rules can only be updated to be enabled, to change notifications, or to update

        the tags (default tags cannot be removed).'
      operationId: UpdateSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleUpdatePayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Update an Existing Rule
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}/convert:
    get:
      description: 'Convert an existing rule from JSON to Terraform for datadog provider

        resource datadog_security_monitoring_rule.'
      operationId: ConvertExistingSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleConvertResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_read
      summary: Datadog Convert an Existing Rule from Json to Terraform
      tags:
      - Existing
      x-menu-order: 11
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_read
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}/test:
    post:
      description: Test an existing rule.
      operationId: TestExistingSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test an Existing Rule
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/services/{service_id}:
    delete:
      deprecated: true
      description: Deletes an existing incident service.
      operationId: DeleteIncidentService
      parameters:
      - $ref: '#/components/parameters/IncidentServiceIDPathParameter'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Delete an Existing Incident Service
      tags:
      - Existing
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      deprecated: true
      description: Updates an existing incident service. Only provide the attributes which should be updated as this request is a partial update.
      operationId: UpdateIncidentService
      parameters:
      - $ref: '#/components/parameters/IncidentServiceIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentServiceUpdateRequest'
        description: Incident Service Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentServiceResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Existing Incident Service
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/siem-historical-detections/jobs/{job_id}:
    delete:
      description: Delete an existing job.
      operationId: DeleteHistoricalJob
      parameters:
      - $ref: '#/components/parameters/HistoricalJobID'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Delete an Existing Job
      tags:
      - Existing
      x-menu-order: 23
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/teams/{team_id}:
    delete:
      deprecated: true
      description: Deletes an existing incident team.
      operationId: DeleteIncidentTeam
      parameters:
      - $ref: '#/components/parameters/IncidentTeamIDPathParameter'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Delete an Existing Incident Team
      tags:
      - Existing
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      deprecated: true
      description: Updates an existing incident team. Only provide the attributes which should be updated as this request is a partial update.
      operationId: UpdateIncidentTeam
      parameters:
      - $ref: '#/components/parameters/IncidentTeamIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentTeamUpdateRequest'
        description: Incident Team Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTeamResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Existing Incident Team
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/workflows/{workflow_id}:
    delete:
      description: Delete a workflow by ID. This API requires an application key scoped with the `workflows_write` permission.
      operationId: DeleteWorkflow
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      responses:
        '204':
          description: Successfully deleted a workflow.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too many requests
      summary: Datadog Delete an Existing Workflow
      tags:
      - Existing
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - workflows_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get a workflow by ID.  This API requires an application key scoped with the `workflows_read` permission.
      operationId: GetWorkflow
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWorkflowResponse'
          description: Successfully got a workflow.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too many requests
      summary: Datadog Get an Existing Workflow
      tags:
      - Existing
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - workflows_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Update a workflow by ID. This API requires an application key scoped with the `workflows_write` permission.
      operationId: UpdateWorkflow
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWorkflowRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateWorkflowResponse'
          description: Successfully updated a workflow.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too many requests
      summary: Datadog Update an Existing Workflow
      tags:
      - Existing
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - workflows_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Annotation:
      description: A list of annotations used in the workflow. These are like sticky notes for your workflow!
      properties:
        display:
          $ref: '#/components/schemas/AnnotationDisplay'
        id:
          description: The `Annotation` `id`.
          example: ''
          type: string
        markdownTextAnnotation:
          $ref: '#/components/schemas/AnnotationMarkdownTextAnnotation'
      required:
      - id
      - display
      - markdownTextAnnotation
      type: object
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SoftwareCatalogTriggerWrapper:
      description: Schema for a Software Catalog-based trigger.
      properties:
        softwareCatalogTrigger:
          description: Trigger a workflow from Software Catalog.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - softwareCatalogTrigger
      type: object
    SecurityMonitoringRuleTypeRead:
      description: The rule type.
      enum:
      - log_detection
      - infrastructure_configuration
      - workload_security
      - cloud_configuration
      - application_security
      type: string
      x-enum-varnames:
      - LOG_DETECTION
      - INFRASTRUCTURE_CONFIGURATION
      - WORKLOAD_SECURITY
      - CLOUD_CONFIGURATION
      - APPLICATION_SECURITY
    UpdateRuleRequestData:
      description: Data for the request to update a scorecard rule.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    UsersType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    WorkflowDataUpdate:
      description: Data related to the workflow being updated.
      properties:
        attributes:
          $ref: '#/components/schemas/WorkflowDataUpdateAttributes'
        id:
          description: The workflow identifier
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/WorkflowDataRelationships'
        type:
          $ref: '#/components/schemas/WorkflowDataType'
      required:
      - type
      - attributes
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    StartStepNames:
      description: A list of steps that run first after a trigger fires.
      example:
      - ''
      items:
        description: The `StartStepNames` `items`.
        type: string
      type: array
    APITrigger:
      description: Trigger a workflow from an API request. The workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentAttachmentAttributes:
      description: The attributes object for an attachment.
      oneOf:
      - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes'
      - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes'
    UpdateWorkflowRequest:
      description: A request object for updating an existing workflow.
      example:
        data:
          attributes:
            description: A sample workflow.
            name: Example Workflow
            published: true
            spec:
              annotations:
              - display:
                  bounds:
                    height: 150
                    width: 300
                    x: -375
                    y: -0.5
                id: 99999999-9999-9999-9999-999999999999
                markdownTextAnnotation:
                  text: Example annotation.
              connectionEnvs:
              - connections:
                - connectionId: 11111111-1111-1111-1111-111111111111
                  label: INTEGRATION_DATADOG
                env: default
              handle: my-handle
              inputSchema:
                parameters:
                - defaultValue: default
                  name: input
                  type: STRING
              outputSchema:
                parameters:
                - name: output
                  type: ARRAY_OBJECT
                  value: '{{ Steps.Step1 }}'
              steps:
              - actionId: com.datadoghq.dd.monitor.listMonitors
                connectionLabel: INTEGRATION_DATADOG
                name: Step1
                outboundEdges:
                - branchName: main
                  nextStepName: Step2
                parameters:
                - name: tags
                  value: service:monitoring
              - actionId: com.datadoghq.core.noop
                name: Step2
              triggers:
              - monitorTrigger:
                  rateLimit:
                    count: 1
                    interval: 3600s
                startStepNames:
                - Step1
              - githubWebhookTrigger: {}
                startStepNames:
                - Step1
            tags:
            - team:infra
            - service:monitoring
            - foo:bar
          id: 22222222-2222-2222-2222-222222222222
          type: workflows
      properties:
        data:
          $ref: '#/components/schemas/WorkflowDataUpdate'
      required:
      - data
      type: object
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    IncidentIntegrationRelationships:
      description: The incident's integration relationships from a response.
      properties:
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    UpdateActionConnectionRequest:
      description: Request used to update an action connection.
      properties:
        data:
          $ref: '#/components/schemas/ActionConnectionDataUpdate'
      required:
      - data
      type: object
    OutputSchemaParametersType:
      description: The definition of `OutputSchemaParametersType` object.
      enum:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
      example: STRING
      type: string
      x-enum-varnames:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
    RelationshipToIncidentPostmortemData:
      description: The postmortem relationship data.
      example:
        id: 00000000-0000-abcd-2000-000000000000
        type: incident_postmortems
      properties:
        id:
          description: A unique identifier that represents the postmortem.
          example: 00000000-0000-abcd-1000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentPostmortemType'
      required:
      - id
      - type
      type: object
    RelationshipToIncidentUserDefinedFields:
      description: Relationship to incident user defined fields.
      properties:
        data:
          description: An array of user defined fields.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFieldData'
          type: array
      required:
      - data
      type: object
    GithubWebhookTrigger:
      description: Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a `webhookSecret`. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentResponseRelationships:
      description: The incident's relationships from a response.
      properties:
        attachments:
          $ref: '#/components/schemas/RelationshipToIncidentAttachment'
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        impacts:
          $ref: '#/components/schemas/RelationshipToIncidentImpacts'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        responders:
          $ref: '#/components/schemas/RelationshipToIncidentResponders'
        user_defined_fields:
          $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields'
      type: object
    UserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        created_at:
          description: Creation time of the user.
          format: date-time
          type: string
          example: example_value
        disabled:
          description: Whether the user is disabled.
          type: boolean
          example: true
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        mfa_enabled:
          description: If user has MFA enabled.
          readOnly: true
          type: boolean
          example: true
        modified_at:
          description: Time that the user was last modified.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        service_account:
          description: Whether the user is a service account.
          type: boolean
          example: true
        status:
          description: Status of the user.
          type: string
          example: OK
        title:
          description: Title of the user.
          nullable: true
          type: string
          example: Example Monitor
        verified:
          description: Whether the user is verified.
          type: boolean
          example: true
      type: object
    IncidentPostmortemType:
      default: incident_postmortems
      description: Incident postmortem resource type.
      enum:
      - incident_postmortems
      example: incident_postmortems
      type: string
      x-enum-varnames:
      - INCIDENT_POSTMORTEMS
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    SecurityMonitoringRuleTypeTest:
      description: The rule type.
      enum:
      - log_detection
      type: string
      x-enum-varnames:
      - LOG_DETECTION
    IncidentType:
      default: incidents
      description: Incident resource type.
      enum:
      - incidents
      example: incidents
      type: string
      x-enum-varnames:
      - INCIDENTS
    IncidentIntegrationMetadataType:
      default: incident_integrations
      description: Integration metadata resource type.
      enum:
      - incident_integrations
      example: incident_integrations
      type: string
      x-enum-varnames:
      - INCIDENT_INTEGRATIONS
    IncidentTeamUpdateAttributes:
      description: The incident team's attributes for an update request.
      properties:
        name:
          description: Name of the incident team.
          example: team name
          type: string
      required:
      - name
      type: object
    SecurityMonitoringRuleTestResponse:
      description: Result of the test of the rule queries.
      properties:
        results:
          description: 'Assert results are returned in the same order as the rule query payloads.

            For each payload, it returns True if the result matched the expected result,

            False otherwise.'
          items:
            type: boolean
          type: array
      type: object
    SecurityMonitoringRuleResponse:
      description: Create a new rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
    IncidentAttachmentRelationships:
      description: The incident attachment's relationships.
      properties:
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    StepDisplayBounds:
      description: The definition of `StepDisplayBounds` object.
      properties:
        x:
          description: The `bounds` `x`.
          format: double
          type: number
          example: 95.5
        y:
          description: The `bounds` `y`.
          format: double
          type: number
          example: 95.5
      type: object
    RelationshipToRuleDataObject:
      description: Rule relationship data.
      properties:
        id:
          description: The unique ID for a scorecard.
          example: q8MQxk8TCqrHnWkp
          type: string
        type:
          $ref: '#/components/schemas/ScorecardType'
      type: object
    ActionConnectionAttributesUpdate:
      description: The definition of `ActionConnectionAttributesUpdate` object.
      properties:
        integration:
          $ref: '#/components/schemas/ActionConnectionIntegrationUpdate'
        name:
          description: Name of the connection
          example: My AWS Connection
          type: string
      type: object
    SecurityMonitoringStandardRuleQuery:
      description: Query for matching rule.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metric:
          deprecated: true
          description: '(Deprecated) The target field to aggregate over when using the sum or max

            aggregations. `metrics` field should be used instead.'
          type: string
          example: example_value
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    ActionConnectionAttributes:
      description: The definition of `ActionConnectionAttributes` object.
      properties:
        integration:
          $ref: '#/components/schemas/ActionConnectionIntegration'
        name:
          description: Name of the connection
          example: My AWS Connection
          type: string
      required:
      - name
      - integration
      type: object
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    InputSchema:
      description: A list of input parameters for the workflow. These can be used as dynamic runtime values in your workflow.
      properties:
        parameters:
          description: The `InputSchema` `parameters`.
          items:
            $ref: '#/components/schemas/InputSchemaParameters'
          type: array
      type: object
    CaseTrigger:
      description: Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    AppTriggerWrapper:
      description: Schema for an App-based trigger.
      properties:
        appTrigger:
          description: Trigger a workflow from an App.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - appTrigger
      type: object
    IncidentAttachmentType:
      default: incident_attachments
      description: The incident attachment resource type.
      enum:
      - incident_attachments
      example: incident_attachments
      type: string
      x-enum-varnames:
      - INCIDENT_ATTACHMENTS
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    IncidentUserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        uuid:
          description: UUID of the user.
          type: string
          example: abc-123-def
      type: object
    IncidentTeamRelationships:
      description: The incident team's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    IncidentNotificationHandle:
      description: A notification handle that will be notified at incident creation.
      properties:
        display_name:
          description: The name of the notified handle.
          example: Jane Doe
          type: string
        handle:
          description: The handle used for the notification. This includes an email address, Slack channel, or workflow.
          example: '@test.user@test.com'
          type: string
      type: object
    IncidentIntegrationMetadataResponseData:
      description: Incident integration metadata from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes'
        id:
          description: The incident integration metadata's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentIntegrationRelationships'
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
    HTTPBody:
      description: The definition of `HTTPBody` object.
      properties:
        content:
          description: Serialized body content
          example: '{"some-json": "with-value"}'
          type: string
        content_type:
          description: Content type of the body
          example: application/json
          type: string
      type: object
    RoleAttributes:
      description: Attributes of the role.
      properties:
        created_at:
          description: Creation time of the role.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified_at:
          description: Time of last role modification.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: The name of the role. The name is neither unique nor a stable identifier of the role.
          type: string
          example: Example Monitor
        user_count:
          description: Number of users with that role.
          format: int64
          readOnly: true
          type: integer
          example: 42
      type: object
    RoleClone:
      description: Data for the clone role request.
      properties:
        attributes:
          $ref: '#/components/schemas/RoleCloneAttributes'
        type:
          $ref: '#/components/schemas/RolesType'
      required:
      - type
      - attributes
      type: object
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    JiraIntegrationMetadataIssuesItem:
      description: Item in the Jira integration metadata issue array.
      properties:
        account:
          description: URL of issue's Jira account.
          example: https://example.atlassian.net
          type: string
        issue_key:
          description: Jira issue's issue key.
          example: PROJ-123
          type: string
        issuetype_id:
          description: Jira issue's issue type.
          example: '1000'
          type: string
        project_key:
          description: Jira issue's project keys.
          example: PROJ
          type: string
        redirect_url:
          description: URL redirecting to the Jira issue.
          example: https://example.atlassian.net/browse/PROJ-123
          type: string
      required:
      - project_key
      - account
      type: object
    SlackIntegrationMetadata:
      description: Incident integration metadata for the Slack integration.
      properties:
        channels:
          description: Array of Slack channels in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/SlackIntegrationMetadataChannelItem'
          type: array
      required:
      - channels
      type: object
    SecurityMonitoringRuleQueryPayloadData:
      additionalProperties: {}
      description: Payload used to test the rule query.
      properties:
        ddsource:
          description: Source of the payload.
          example: nginx
          type: string
        ddtags:
          description: Tags associated with your data.
          example: env:staging,version:5.1
          type: string
        hostname:
          description: The name of the originating host of the log.
          example: i-012345678
          type: string
        message:
          description: The message of the payload.
          example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World
          type: string
        service:
          description: The name of the application or service generating the data.
          example: payment
          type: string
      type: object
    RelationshipToIncidentResponderData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentRespondersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentServiceUpdateData:
      description: Incident Service payload for update requests.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentServiceUpdateAttributes'
        id:
          description: The incident service's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentServiceRelationships'
        type:
          $ref: '#/components/schemas/IncidentServiceType'
      required:
      - type
      type: object
    WorkflowTriggerWrapper:
      description: Schema for a Workflow-based trigger.
      properties:
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
        workflowTrigger:
          description: Trigger a workflow from the Datadog UI. Only required if no other trigger exists.
          type: object
      required:
      - workflowTrigger
      type: object
    RelationshipToIncidentImpacts:
      description: Relationship to impacts.
      properties:
        data:
          description: An array of incident impacts.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentImpactData'
          type: array
      required:
      - data
      type: object
    IncidentUpdateData:
      description: Incident data for an update request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentUpdateAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-4567-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentUpdateRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
    User:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/UserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/UserResponseRelationships'
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
      x-merge-override:
        required: false
    IncidentIntegrationMetadataResponseIncludedItem:
      description: An object related to an incident integration metadata that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    GithubWebhookTriggerWrapper:
      description: Schema for a GitHub webhook-based trigger.
      properties:
        githubWebhookTrigger:
          $ref: '#/components/schemas/GithubWebhookTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - githubWebhookTrigger
      type: object
    Trigger:
      description: One of the triggers that can start the execution of a workflow.
      oneOf:
      - $ref: '#/components/schemas/APITriggerWrapper'
      - $ref: '#/components/schemas/AppTriggerWrapper'
      - $ref: '#/components/schemas/CaseTriggerWrapper'
      - $ref: '#/components/schemas/ChangeEventTriggerWrapper'
      - $ref: '#/components/schemas/DatabaseMonitoringTriggerWrapper'
      - $ref: '#/components/schemas/DashboardTriggerWrapper'
      - $ref: '#/components/schemas/GithubWebhookTriggerWrapper'
      - $ref: '#/components/schemas/IncidentTriggerWrapper'
      - $ref: '#/components/schemas/MonitorTriggerWrapper'
      - $ref: '#/components/schemas/NotebookTriggerWrapper'
      - $ref: '#/components/schemas/ScheduleTriggerWrapper'
      - $ref: '#/components/schemas/SecurityTriggerWrapper'
      - $ref: '#/components/schemas/SelfServiceTriggerWrapper'
      - $ref: '#/components/schemas/SlackTriggerWrapper'
      - $ref: '#/components/schemas/SoftwareCatalogTriggerWrapper'
      - $ref: '#/components/schemas/WorkflowTriggerWrapper'
    IncidentAttachmentPostmortemAttributes:
      description: The attributes object for a postmortem attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType'
      required:
      - attachment_type
      - attachment
      type: object
    RelationshipToUser:
      description: Relationship to user.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToUserData'
      required:
      - data
      type: object
    RelationshipToIncidentAttachment:
      description: A relationship reference for attachments.
      properties:
        data:
          description: An array of incident attachments.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentAttachmentData'
          type: array
      required:
      - data
      type: object
    UpdateWorkflowResponse:
      description: The response object after updating a workflow.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowDataUpdate'
      type: object
    RelationshipToIncidentIntegrationMetadataData:
      description: A relationship reference for an integration metadata object.
      example:
        id: 00000000-abcd-0002-0000-000000000000
        type: incident_integrations
      properties:
        id:
          description: A unique identifier that represents the integration metadata.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    StepDisplay:
      description: The definition of `StepDisplay` object.
      properties:
        bounds:
          $ref: '#/components/schemas/StepDisplayBounds'
      type: object
    IncidentFieldAttributesValueType:
      default: multiselect
      description: Type of the multiple value field definitions.
      enum:
      - multiselect
      - textarray
      - metrictag
      - autocomplete
      example: multiselect
      type: string
      x-enum-varnames:
      - MULTISELECT
      - TEXTARRAY
      - METRICTAG
      - AUTOCOMPLETE
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior
      type: string
      x-enum-varnames:
      - BLOCK_IP
      - BLOCK_USER
      - USER_BEHAVIOR
    IncidentServiceRelationships:
      description: The incident service's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    RelationshipToIncidentIntegrationMetadatas:
      description: A relationship reference for multiple integration metadata objects.
      example:
        data:
        - id: 00000000-abcd-0005-0000-000000000000
          type: incident_integrations
        - id: 00000000-abcd-0006-0000-000000000000
          type: incident_integrations
      properties:
        data:
          description: Integration metadata relationship array
          example:
          - id: 00000000-abcd-0003-0000-000000000000
            type: incident_integrations
          - id: 00000000-abcd-0004-0000-000000000000
            type: incident_integrations
          items:
            $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadataData'
          type: array
      required:
      - data
      type: object
    IncidentFieldAttributesSingleValueType:
      default: dropdown
      description: Type of the single value field definitions.
      enum:
      - dropdown
      - textbox
      example: dropdown
      type: string
      x-enum-varnames:
      - DROPDOWN
      - TEXTBOX
    SecurityMonitoringRuleHardcodedEvaluatorType:
      description: Hardcoded evaluator type.
      enum:
      - log4shell
      type: string
      x-enum-varnames:
      - LOG4SHELL
    IncidentServiceUpdateRequest:
      description: Update request with an incident service payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentServiceUpdateData'
      required:
      - data
      type: object
    RelationshipToPermissionData:
      description: Relationship to permission object.
      properties:
        id:
          description: ID of the permission.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/PermissionsType'
      type: object
      x-merge-override:
        required: false
    RelationshipToUserData:
      description: Relationship to user object.
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    IncidentTeamResponseAttributes:
      description: The incident team's attributes from a response.
      properties:
        created:
          description: Timestamp of when the incident team was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified:
          description: Timestamp of when the incident team was modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the incident team.
          example: team name
          type: string
      type: object
    UpdateRuleRequest:
      description: Request to update a scorecard rule.
      properties:
        data:
          $ref: '#/components/schemas/UpdateRuleRequestData'
      type: object
    IncidentIntegrationMetadataPatchData:
      description: Incident integration metadata data for a patch request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes'
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - type
      - attributes
      type: object
    IncidentAttachmentLinkAttachmentType:
      default: link
      description: The type of link attachment attributes.
      enum:
      - link
      example: link
      type: string
      x-enum-varnames:
      - LINK
    WorkflowDataUpdateAttributes:
      description: The definition of `WorkflowDataUpdateAttributes` object.
      properties:
        createdAt:
          description: When the workflow was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        description:
          description: Description of the workflow.
          type: string
          example: example_value
        name:
          description: Name of the workflow.
          type: string
          example: Example Monitor
        published:
          description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
          type: boolean
          example: true
        spec:
          $ref: '#/components/schemas/Spec'
        tags:
          description: Tags of the workflow.
          items:
            type: string
          type: array
        updatedAt:
          description: When the workflow was last updated.
          format: date-time
          readOnly: true
          type: string
          example: '2026-04-17T12:00:00Z'
        webhookSecret:
          description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
          type: string
          writeOnly: true
          example: example_value
      type: object
    HTTPIntegrationType:
      description: The definition of `HTTPIntegrationType` object.
      enum:
      - HTTP
      example: HTTP
      type: string
      x-enum-varnames:
      - HTTP
    HTTPTokenAuthUpdate:
      description: The definition of `HTTPTokenAuthUpdate` object.
      properties:
        body:
          $ref: '#/components/schemas/HTTPBody'
        headers:
          description: The `HTTPTokenAuthUpdate` `headers`.
          items:
            $ref: '#/components/schemas/HTTPHeaderUpdate'
          type: array
        tokens:
          description: The `HTTPTokenAuthUpdate` `tokens`.
          items:
            $ref: '#/components/schemas/HTTPTokenUpdate'
          type: array
        type:
          $ref: '#/components/schemas/HTTPTokenAuthType'
        url_parameters:
          description: The `HTTPTokenAuthUpdate` `url_parameters`.
          items:
            $ref: '#/components/schemas/UrlParamUpdate'
          type: array
      required:
      - type
      type: object
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    TriggerRateLimit:
      description: Defines a rate limit for a trigger.
      properties:
        count:
          description: The `TriggerRateLimit` `count`.
          format: int64
          type: integer
          example: 42
        interval:
          description: The `TriggerRateLimit` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
          type: string
          example: example_value
      type: object
    ConnectionEnvEnv:
      description: The definition of `ConnectionEnvEnv` object.
      enum:
      - default
      example: default
      type: string
      x-enum-varnames:
      - DEFAULT
    IncidentAttachmentLinkAttributes:
      description: The attributes object for a link attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType'
        modified:
          description: Timestamp when the incident attachment link was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - attachment_type
      - attachment
      type: object
    HTTPIntegration:
      description: The definition of `HTTPIntegration` object.
      properties:
        base_url:
          description: Base HTTP url for the integration
          example: http://datadoghq.com
          type: string
        credentials:
          $ref: '#/components/schemas/HTTPCredentials'
        type:
          $ref: '#/components/schemas/HTTPIntegrationType'
      required:
      - type
      - base_url
      - credentials
      type: object
    DatabaseMonitoringTriggerWrapper:
      description: Schema for a Database Monitoring-based trigger.
      properties:
        databaseMonitoringTrigger:
          description: Trigger a workflow from Database Monitoring.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - databaseMonitoringTrigger
      type: object
    RuleType:
      default: rule
      description: The JSON:API type for scorecard rules.
      enum:
      - rule
      example: rule
      type: string
      x-enum-varnames:
      - RULE
    JiraIntegrationMetadata:
      description: Incident integration metadata for the Jira integration.
      properties:
        issues:
          description: Array of Jira issues in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/JiraIntegrationMetadataIssuesItem'
          type: array
      required:
      - issues
      type: object
    AnnotationDisplay:
      description: The definition of `AnnotationDisplay` object.
      properties:
        bounds:
          $ref: '#/components/schemas/AnnotationDisplayBounds'
      type: object
    IncidentTeamIncludedItems:
      description: An object related to an incident team which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    ActionConnectionDataType:
      description: The definition of `ActionConnectionDataType` object.
      enum:
      - action_connection
      example: action_connection
      type: string
      x-enum-varnames:
      - ACTION_CONNECTION
    AWSCredentials:
      description: The definition of `AWSCredentials` object.
      oneOf:
      - $ref: '#/components/schemas/AWSAssumeRole'
    IncidentUserData:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentUserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    ScheduleTriggerWrapper:
      description: Schema for a Schedule-based trigger.
      properties:
        scheduleTrigger:
          $ref: '#/components/schemas/ScheduleTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - scheduleTrigger
      type: object
    IncidentResponseData:
      description: Incident data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentResponseAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentResponseRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    AWSAssumeRoleUpdate:
      description: The definition of `AWSAssumeRoleUpdate` object.
      properties:
        account_id:
          description: AWS account the connection is created for
          example: '111222333444'
          pattern: ^\d{12}$
          type: string
        generate_new_external_id:
          description: The `AWSAssumeRoleUpdate` `generate_new_external_id`.
          type: boolean
          example: true
        role:
          description: Role to assume
          example: my-role
          type: string
        type:
          $ref: '#/components/schemas/AWSAssumeRoleType'
      required:
      - type
      type: object
    AWSAssumeRoleType:
      description: The definition of `AWSAssumeRoleType` object.
      enum:
      - AWSAssumeRole
      example: AWSAssumeRole
      type: string
      x-enum-varnames:
      - AWSASSUMEROLE
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    AWSIntegration:
      description: The definition of `AWSIntegration` object.
      properties:
        credentials:
          $ref: '#/components/schemas/AWSCredentials'
        type:
          $ref: '#/components/schemas/AWSIntegrationType'
      required:
      - type
      - credentials
      type: object
    SecurityMonitoringRuleOptions:
      description: Options.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
        decreaseCriticalityBasedOnEnv:
          $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv'
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        hardcodedEvaluatorType:
          $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    SecurityMonitoringSignalRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    RelationshipToIncidentUserDefinedFieldData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentUserDefinedFieldType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentServiceType:
      default: services
      description: Incident service resource type.
      enum:
      - services
      example: services
      type: string
      x-enum-varnames:
      - SERVICES
    SecurityMonitoringSignalRuleQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      required:
      - ruleId
      type: object
    SecurityTriggerWrapper:
      description: Schema for a Security-based trigger.
      properties:
        securityTrigger:
          $ref: '#/components/schemas/SecurityTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - securityTrigger
      type: object
    IncidentUpdateRequest:
      description: Update request for an incident.
      properties:
        data:
          $ref: '#/components/schemas/IncidentUpdateData'
      required:
      - data
      type: object
    MSTeamsIntegrationMetadata:
      description: Incident integration metadata for the Microsoft Teams integration.
      properties:
        teams:
          description: Array of Microsoft Teams in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/MSTeamsIntegrationMetadataTeamsItem'
          type: array
      required:
      - teams
      type: object
    SecurityMonitoringRuleTestPayload:
      description: Test a rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleTestPayload'
    SecurityMonitoringRuleQueryPayload:
      description: Payload to test a rule query with the expected result.
      properties:
        expectedResult:
          description: Expected result of the test.
          example: true
          type: boolean
        index:
          description: Index of the query under test.
          example: 0
          format: int64
          minimum: 0
          type: integer
        payload:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryPayloadData'
      type: object
    SecurityMonitoringThirdPartyRuleCaseCreate:
      description: Case when a signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    IncidentUserDefinedFieldType:
      description: The incident user defined fields type.
      enum:
      - user_defined_field
      example: user_defined_field
      type: string
      x-enum-varnames:
      - USER_DEFINED_FIELD
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    RelationshipToRuleData:
      description: Relationship data for a rule.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToRuleDataObject'
      type: object
    WorkflowDataAttributes:
      description: The definition of `WorkflowDataAttributes` object.
      properties:
        createdAt:
          description: When the workflow was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        description:
          description: Description of the workflow.
          type: string
          example: example_value
        name:
          description: Name of the workflow.
          example: ''
          type: string
        published:
          description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
          type: boolean
          example: true
        spec:
          $ref: '#/components/schemas/Spec'
        tags:
          description: Tags of the workflow.
          items:
            type: string
          type: array
        updatedAt:
          description: When the workflow was last updated.
          format: date-time
          readOnly: true
          type: string
          example: '2026-04-17T12:00:00Z'
        webhookSecret:
          description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
          type: string
          writeOnly: true
          example: example_value
      required:
      - name
      - spec
      type: object
    IncidentTrigger:
      description: Trigger a workflow from an Incident. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    ConnectionGroup:
      description: The definition of `ConnectionGroup` object.
      properties:
        connectionGroupId:
          description: The `ConnectionGroup` `connectionGroupId`.
          example: ''
          type: string
        label:
          description: The `ConnectionGroup` `label`.
          example: ''
          type: string
        tags:
          description: The `ConnectionGroup` `tags`.
          example:
          - ''
          items:
            type: string
          type: array
      required:
      - connectionGroupId
      - label
      - tags
      type: object
    IncidentAttachmentLinkAttributesAttachmentObject:
      description: The link attachment.
      properties:
        documentUrl:
          description: The URL of this link attachment.
          example: https://www.example.com/webstore-failure-runbook
          type: string
        title:
          description: The title of this link attachment.
          example: Runbook for webstore service failures
          type: string
      required:
      - documentUrl
      - title
      type: object
    SecurityMonitoringRuleKeepAlive:
      description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within

        this keep alive window. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    ReadinessGateThresholdType:
      description: The definition of `ReadinessGateThresholdType` object.
      enum:
      - ANY
      - ALL
      example: ANY
      type: string
      x-enum-varnames:
      - ANY
      - ALL
    AnnotationMarkdownTextAnnotation:
      description: The definition of `AnnotationMarkdownTextAnnotation` object.
      properties:
        text:
          description: The `markdownTextAnnotation` `text`.
          type: string
          example: example_value
      type: object
    RoleResponse:
      description: Response containing information about a single role.
      properties:
        data:
          $ref: '#/components/schemas/Role'
      type: object
    ActionConnectionDataUpdate:
      description: Data related to the connection update.
      properties:
        attributes:
          $ref: '#/components/schemas/ActionConnectionAttributesUpdate'
        type:
          $ref: '#/components/schemas/ActionConnectionDataType'
      required:
      - type
      - attributes
      type: object
    IncidentFieldAttributesSingleValue:
      description: A field with a single value selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesSingleValueType'
        value:
          description: The single value selected for this field.
          example: SEV-1
          nullable: true
          type: string
      type: object
    RelationshipToOrganization:
      description: Relationship to an organization.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToOrganizationData'
      required:
      - data
      type: object
    SelfServiceTriggerWrapper:
      description: Schema for a Self Service-based trigger.
      properties:
        selfServiceTrigger:
          description: Trigger a workflow from Self Service.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - selfServiceTrigger
      type: object
    UpdateRuleResponse:
      description: The response from a rule update request.
      properties:
        data:
          $ref: '#/components/schemas/UpdateRuleResponseData'
      type: object
    OutputSchemaParameters:
      description: The definition of `OutputSchemaParameters` object.
      properties:
        defaultValue:
          description: The `OutputSchemaParameters` `defaultValue`.
          example: example_value
        description:
          description: The `OutputSchemaParameters` `description`.
          type: string
          example: example_value
        label:
          description: The `OutputSchemaParameters` `label`.
          type: string
          example: example_value
        name:
          description: The `OutputSchemaParameters` `name`.
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/OutputSchemaParametersType'
        value:
          description: The `OutputSchemaParameters` `value`.
          example: example_value
      required:
      - name
      - type
      type: object
    IncidentResponse:
      description: Response with an incident.
      properties:
        data:
          $ref: '#/components/schemas/IncidentResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentResponseIncludedItem'
          readOnly: true
          type: array
      required:
      - data
      type: object
    RelationshipToIncidentPostmortem:
      description: A relationship reference for postmortems.
      example:
        data:
          id: 00000000-0000-abcd-3000-000000000000
          type: incident_postmortems
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToIncidentPostmortemData'
      required:
      - data
      type: object
    OrganizationsType:
      default: orgs
      description: Organizations resource type.
      enum:
      - orgs
      example: orgs
      type: string
      x-enum-varnames:
      - ORGS
    SecurityMonitoringRuleSeverity:
      description: Severity of the Security Signal.
      enum:
      - info
      - low
      - medium
      - high
      - critical
      example: critical
      type: string
      x-enum-varnames:
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    CaseTriggerWrapper:
      description: Schema for a Case-based trigger.
      properties:
        caseTrigger:
          $ref: '#/components/schemas/CaseTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - caseTrigger
      type: object
    SecurityTrigger:
      description: Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentServiceUpdateAttributes:
      description: The incident service's attributes for an update request.
      properties:
        name:
          description: Name of the incident service.
          example: an example service name
          type: string
      required:
      - name
      type: object
    MonitorTrigger:
      description: Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    SecurityMonitoringSignalRuleResponseQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to correlate by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        defaultRuleId:
          description: Default Rule ID to match on signals.
          example: d3f-ru1-e1d
          type: string
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      type: object
    TokenType:
      description: The definition of `TokenType` object.
      enum:
      - SECRET
      example: SECRET
      type: string
      x-enum-varnames:
      - SECRET
    AWSCredentialsUpdate:
      description: The definition of `AWSCredentialsUpdate` object.
      oneOf:
      - $ref: '#/components/schemas/AWSAssumeRoleUpdate'
    WorkflowDataRelationships:
      description: The definition of `WorkflowDataRelationships` object.
      properties:
        creator:
          $ref: '#/components/schemas/WorkflowUserRelationship'
        owner:
          $ref: '#/components/schemas/WorkflowUserRelationship'
      readOnly: true
      type: object
    IncidentIntegrationMetadataMetadata:
      description: Incident integration metadata's metadata attribute.
      oneOf:
      - $ref: '#/components/schemas/SlackIntegrationMetadata'
      - $ref: '#/components/schemas/JiraIntegrationMetadata'
      - $ref: '#/components/schemas/MSTeamsIntegrationMetadata'
    ScorecardType:
      default: scorecard
      description: The JSON:API type for scorecard.
      enum:
      - scorecard
      example: scorecard
      type: string
      x-enum-varnames:
      - SCORECARD
    RelationshipToIncidentResponders:
      description: Relationship to incident responders.
      properties:
        data:
          description: An array of incident responders.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentResponderData'
          type: array
      required:
      - data
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    UserResponseRelationships:
      description: Relationships of the user object returned by the API.
      properties:
        org:
          $ref: '#/components/schemas/RelationshipToOrganization'
        other_orgs:
          $ref: '#/components/schemas/RelationshipToOrganizations'
        other_users:
          $ref: '#/components/schemas/RelationshipToUsers'
        roles:
          $ref: '#/components/schemas/RelationshipToRoles'
      type: object
      x-merge-override:
        properties: false
    HTTPHeaderUpdate:
      description: The definition of `HTTPHeaderUpdate` object.
      properties:
        deleted:
          description: Should the header be deleted.
          type: boolean
          example: true
        name:
          description: The `HTTPHeaderUpdate` `name`.
          example: MyHttpHeader
          pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$
          type: string
        value:
          description: The `HTTPHeaderUpdate` `value`.
          example: Updated Header Value
          type: string
      required:
      - name
      type: object
    IncidentFieldAttributesMultipleValue:
      description: A field with potentially multiple values selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesValueType'
        value:
          description: The multiple values selected for this field.
          example:
          - '1.0'
          - '1.1'
          items:
            description: A value which has been selected for the parent field.
            example: '1.1'
            type: string
          nullable: true
          type: array
      type: object
    MSTeamsIntegrationMetadataTeamsItem:
      description: Item in the Microsoft Teams integration metadata teams array.
      properties:
        ms_channel_id:
          description: Microsoft Teams channel ID.
          example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2
          type: string
        ms_channel_name:
          description: Microsoft Teams channel name.
          example: incident-0001-example
          type: string
        ms_tenant_id:
          description: Microsoft Teams tenant ID.
          example: 00000000-abcd-0005-0000-000000000000
          type: string
        redirect_url:
          description: URL redirecting to the Microsoft Teams channel.
          example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000
          type: string
      required:
      - ms_tenant_id
      - ms_channel_id
      - ms_channel_name
      - redirect_url
      type: object
    RetryStrategyLinear:
      description: The definition of `RetryStrategyLinear` object.
      properties:
        interval:
          description: The `RetryStrategyLinear` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
          example: ''
          type: string
        maxRetries:
          description: The `RetryStrategyLinear` `maxRetries`.
          example: 0
          format: double
          type: number
      required:
      - interval
      - maxRetries
      type: object
    WorkflowUserRelationshipType:
      description: The definition of `WorkflowUserRelationshipType` object.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    UpdateActionConnectionResponse:
      description: The response for an updated connection.
      properties:
        data:
          $ref: '#/components/schemas/ActionConnectionData'
      type: object
    CloudConfigurationRegoRule:
      description: Rule details.
      properties:
        policy:
          description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/'
          example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n"
          type: string
        resourceTypes:
          description: List of resource types that will be evaluated upon. Must have at least one element.
          example:
          - gcp_iam_service_account
          - gcp_iam_policy
          items:
            type: string
          type: array
      required:
      - policy
      - resourceTypes
      type: object
    IncidentTeamUpdateRequest:
      description: Update request with an incident team payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTeamUpdateData'
      required:
      - data
      type: object
    HTTPCredentials:
      description: The definition of `HTTPCredentials` object.
      oneOf:
      - $ref: '#/components/schemas/HTTPTokenAuth'
    HTTPHeader:
      description: The definition of `HTTPHeader` object.
      properties:
        name:
          description: The `HTTPHeader` `name`.
          example: MyHttpHeader
          pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$
          type: string
        value:
          description: The `HTTPHeader` `value`.
          example: Some header value
          type: string
      required:
      - name
      - value
      type: object
    CompletionCondition:
      description: The definition of `CompletionCondition` object.
      properties:
        operand1:
          description: The `CompletionCondition` `operand1`.
          example: example_value
        operand2:
          description: The `CompletionCondition` `operand2`.
          example: example_value
        operator:
          $ref: '#/components/schemas/CompletionConditionOperator'
      required:
      - operand1
      - operator
      type: object
    HTTPTokenAuth:
      description: The definition of `HTTPTokenAuth` object.
      properties:
        body:
          $ref: '#/components/schemas/HTTPBody'
        headers:
          description: The `HTTPTokenAuth` `headers`.
          items:
            $ref: '#/components/schemas/HTTPHeader'
          type: array
        tokens:
          description: The `HTTPTokenAuth` `tokens`.
          items:
            $ref: '#/components/schemas/HTTPToken'
          type: array
        type:
          $ref: '#/components/schemas/HTTPTokenAuthType'
        url_parameters:
          description: The `HTTPTokenAuth` `url_parameters`.
          items:
            $ref: '#/components/schemas/UrlParam'
          type: array
      required:
      - type
      type: object
    CompletionConditionOperator:
      description: The definition of `CompletionConditionOperator` object.
      enum:
      - OPERATOR_EQUAL
      - OPERATOR_NOT_EQUAL
      - OPERATOR_GREATER_THAN
      - OPERATOR_LESS_THAN
      - OPERATOR_GREATER_THAN_OR_EQUAL_TO
      - OPERATOR_LESS_THAN_OR_EQUAL_TO
      - OPERATOR_CONTAINS
      - OPERATOR_DOES_NOT_CONTAIN
      - OPERATOR_IS_NULL
      - OPERATOR_IS_NOT_NULL
      - OPERATOR_IS_EMPTY
      - OPERATOR_IS_NOT_EMPTY
      example: OPERATOR_EQUAL
      type: string
      x-enum-varnames:
      - OPERATOR_EQUAL
      - OPERATOR_NOT_EQUAL
      - OPERATOR_GREATER_THAN
      - OPERATOR_LESS_THAN
      - OPERATOR_GREATER_THAN_OR_EQUAL_TO
      - OPERATOR_LESS_THAN_OR_EQUAL_TO
      - OPERATOR_CONTAINS
      - OPERATOR_DOES_NOT_CONTAIN
      - OPERATOR_IS_NULL
      - OPERATOR_IS_NOT_NULL
      - OPERATOR_IS_EMPTY
      - OPERATOR_IS_NOT_EMPTY
    OutputSchema:
      description: A list of output parameters for the workflow.
      properties:
        parameters:
          description: The `OutputSchema` `parameters`.
          items:
            $ref: '#/components/schemas/OutputSchemaParameters'
          type: array
      type: object
    RoleResponseRelationships:
      description: Relationships of the role object returned by the API.
      properties:
        permissions:
          $ref: '#/components/schemas/RelationshipToPermissions'
      type: object
    IncidentUpdateAttributes:
      description: The incident's attributes for an update request.
      properties:
        customer_impact_end:
          description: Timestamp when customers were no longer impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impact_scope:
          description: A summary of the impact customers experienced during the incident.
          example: Example customer impact scope
          type: string
        customer_impact_start:
          description: Timestamp when customers began being impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impacted:
          description: A flag indicating whether the incident caused customer impact.
          example: false
          type: boolean
        detected:
          description: Timestamp when the incident was detected.
          format: date-time
          nullable: true
          type: string
          example: example_value
        fields:
          additionalProperties:
            $ref: '#/components/schemas/IncidentFieldAttributes'
          description: A condensed view of the user-defined fields for which to update selections.
          example:
            severity:
              type: dropdown
              value: SEV-5
          type: object
        notification_handles:
          description: Notification handles that will be notified of the incident during update.
          example:
          - display_name: Jane Doe
            handle: '@user@email.com'
          - display_name: Slack Channel
            handle: '@slack-channel'
          - display_name: Incident Workflow
            handle: '@workflow-from-incident'
          items:
            $ref: '#/components/schemas/IncidentNotificationHandle'
          type: array
        title:
          description: The title of the incident, which summarizes what happened.
          example: A test incident title
          type: string
      type: object
    InputSchemaParameters:
      description: The definition of `InputSchemaParameters` object.
      properties:
        defaultValue:
          description: The `InputSchemaParameters` `defaultValue`.
          example: example_value
        description:
          description: The `InputSchemaParameters` `description`.
          type: string
          example: example_value
        label:
          description: The `InputSchemaParameters` `label`.
          type: string
          example: example_value
        name:
          description: The `InputSchemaParameters` `name`.
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/InputSchemaParametersType'
      required:
      - name
      - type
      type: object
    SecurityMonitoringRuleCaseCreate:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    ConnectionEnv:
      description: A list of connections or connection groups used in the workflow.
      properties:
        connectionGroups:
          description: The `ConnectionEnv` `connectionGroups`.
          items:
            $ref: '#/components/schemas/ConnectionGroup'
          type: array
        connections:
          description: The `ConnectionEnv` `connections`.
          items:
            $ref: '#/components/schemas/Connection'
          type: array
        env:
          $ref: '#/components/schemas/ConnectionEnvEnv'
      required:
      - env
      type: object
    IncidentTeamResponse:
      description: Response with an incident team payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTeamResponseData'
        included:
          description: Included objects from relationships.
          items:
            $ref: '#/components/schemas/IncidentTeamIncludedItems'
          readOnly: true
          type: array
      required:
      - data
      type: object
    ActionConnectionIntegrationUpdate:
      description: The definition of `ActionConnectionIntegrationUpdate` object.
      oneOf:
      - $ref: '#/components/schemas/AWSIntegrationUpdate'
      - $ref: '#/components/schemas/HTTPIntegrationUpdate'
    IncidentResponseAttributes:
      description: The incident's attributes from a response.
      properties:
        archived:
          description: Timestamp of when the incident was archived.
          format: date-time
          nullable: true
          readOnly: true
          type: string
          example: example_value
        case_id:
          description: The incident case id.
          format: int64
          nullable: true
          type: integer
          example: 42
        created:
          description: Timestamp when the incident was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        customer_impact_duration:
          description: 'Length of the incident''s customer impact in seconds.

            Equals the difference between `customer_impact_start` and `customer_impact_end`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        customer_impact_end:
          description: Timestamp when customers were no longer impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impact_scope:
          description: A summary of the impact customers experienced during the incident.
          example: An example customer impact scope
          nullable: true
          type: string
        customer_impact_start:
          description: Timestamp when customers began being impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impacted:
          description: A flag indicating whether the incident caused customer impact.
          example: false
          type: boolean
        detected:
          description: Timestamp when the incident was detected.
          format: date-time
          nullable: true
          type: string
          example: example_value
        fields:
          additionalProperties:
            $ref: '#/components/schemas/IncidentFieldAttributes'
          description: A condensed view of the user-defined fields attached to incidents.
          example:
            severity:
              type: dropdown
              value: SEV-5
          type: object
        incident_type_uuid:
          description: A unique identifier that represents an incident type.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        modified:
          description: Timestamp when the incident was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        non_datadog_creator:
          $ref: '#/components/schemas/IncidentNonDatadogCreator'
        notification_handles:
          description: Notification handles that will be notified of the incident during update.
          example:
          - display_name: Jane Doe
            handle: '@user@email.com'
          - display_name: Slack Channel
            handle: '@slack-channel'
          - display_name: Incident Workflow
            handle: '@workflow-from-incident'
          items:
            $ref: '#/components/schemas/IncidentNotificationHandle'
          nullable: true
          type: array
        public_id:
          description: The monotonically increasing integer ID for the incident.
          example: 1
          format: int64
          type: integer
        resolved:
          description: Timestamp when the incident's state was last changed from active or stable to resolved or completed.
          format: date-time
          nullable: true
          type: string
          example: example_value
        severity:
          $ref: '#/components/schemas/IncidentSeverity'
        state:
          description: The state incident.
          nullable: true
          type: string
          example: example_value
        time_to_detect:
          description: 'The amount of time in seconds to detect the incident.

            Equals the difference between `customer_impact_start` and `detected`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_internal_response:
          description: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_repair:
          description: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_resolve:
          description: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        title:
          description: The title of the incident, which summarizes what happened.
          example: A test incident title
          type: string
        visibility:
          description: The incident visibility status.
          nullable: true
          type: string
          example: example_value
      required:
      - title
      type: object
    CloudConfigurationRuleComplianceSignalOptions:
      description: How to generate compliance signals. Useful for cloud_configuration rules only.
      properties:
        defaultActivationStatus:
          description: The default activation status.
          nullable: true
          type: boolean
          example: true
        defaultGroupByFields:
          description: The default group by fields.
          items:
            type: string
          nullable: true
          type: array
        userActivationStatus:
          description: Whether signals will be sent.
          nullable: true
          type: boolean
          example: true
        userGroupByFields:
          description: Fields to use to group findings by when sending signals.
          items:
            type: string
          nullable: true
          type: array
      type: object
    InputSchemaParametersType:
      description: The definition of `InputSchemaParametersType` object.
      enum:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
      example: STRING
      type: string
      x-enum-varnames:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
    IncidentResponseIncludedItem:
      description: An object related to an incident that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/IncidentUserData'
      - $ref: '#/components/schemas/IncidentAttachmentData'
    IncidentTeamUpdateData:
      description: Incident Team data for an update request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTeamUpdateAttributes'
        id:
          description: The incident team's ID.
          example: 00000000-7ea3-0000-0001-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTeamRelationships'
        type:
          $ref: '#/components/schemas/IncidentTeamType'
      required:
      - type
      type: object
    Parameter:
      description: The definition of `Parameter` object.
      properties:
        name:
          description: The `Parameter` `name`.
          example: ''
          type: string
        value:
          description: The `Parameter` `value`.
          example: example_value
      required:
      - name
      - value
      type: object
    IncidentRespondersType:
      description: The incident responders type.
      enum:
      - incident_responders
      example: incident_responders
      type: string
      x-enum-varnames:
      - INCIDENT_RESPONDERS
    WorkflowDataType:
      description: The definition of `WorkflowDataType` object.
      enum:
      - workflows
      example: workflows
      type: string
      x-enum-varnames:
      - WORKFLOWS
    UrlParam:
      description: The definition of `UrlParam` object.
      properties:
        name:
          $ref: '#/components/schemas/TokenName'
          example: MyUrlParameter
        value:
          description: The `UrlParam` `value`.
          example: Some Url Parameter value
          type: string
      required:
      - name
      - value
      type: object
    AWSAssumeRole:
      description: The definition of `AWSAssumeRole` object.
      properties:
        account_id:
          description: AWS account the connection is created for
          example: '111222333444'
          pattern: ^\d{12}$
          type: string
        external_id:
          description: External ID used to scope which connection can be used to assume the role
          example: 33a1011635c44b38a064cf14e82e1d8f
          readOnly: true
          type: string
        principal_id:
          description: AWS account that will assume the role
          example: '123456789012'
          readOnly: true
          type: string
        role:
          description: Role to assume
          example: my-role
          type: string
        type:
          $ref: '#/components/schemas/AWSAssumeRoleType'
      required:
      - type
      - account_id
      - role
      type: object
    RoleCloneRequest:
      description: Request to create a role by cloning an existing role.
      properties:
        data:
          $ref: '#/components/schemas/RoleClone'
      required:
      - data
      type: object
    IncidentServiceResponseAttributes:
      description: The incident service's attributes from a response.
      properties:
        created:
          description: Timestamp of when the incident service was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified:
          description: Timestamp of when the incident service was modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the incident service.
          example: service name
          type: string
      type: object
    RelationshipToRule:
      description: Scorecard create rule response relationship.
      properties:
        scorecard:
          $ref: '#/components/schemas/RelationshipToRuleData'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    IncidentImpactsType:
      description: The incident impacts type.
      enum:
      - incident_impacts
      example: incident_impacts
      type: string
      x-enum-varnames:
      - INCIDENT_IMPACTS
    RelationshipToRoleData:
      description: Relationship to role object.
      properties:
        id:
          description: The unique identifier of the role.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        type:
          $ref: '#/components/schemas/RolesType'
      type: object
      x-merge-override:
        required: false
    RelationshipToIncidentAttachmentData:
      description: The attachment relationship data.
      properties:
        id:
          description: A unique identifier that represents the attachment.
          example: 00000000-0000-abcd-1000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    UpdateRuleResponseData:
      description: The data for a rule update response.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        relationships:
          $ref: '#/components/schemas/RelationshipToRule'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    ActionConnectionData:
      description: Data related to the connection.
      properties:
        attributes:
          $ref: '#/components/schemas/ActionConnectionAttributes'
        id:
          description: The connection identifier
          readOnly: true
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/ActionConnectionDataType'
      required:
      - type
      - attributes
      type: object
    SlackIntegrationMetadataChannelItem:
      description: Item in the Slack integration metadata channel array.
      properties:
        channel_id:
          description: Slack channel ID.
          example: C0123456789
          type: string
        channel_name:
          description: Name of the Slack channel.
          example: '#example-channel-name'
          type: string
        redirect_url:
          description: URL redirecting to the Slack channel.
          example: https://slack.com/app_redirect?channel=C0123456789&team=T01234567
          type: string
        team_id:
          description: Slack team ID.
          example: T01234567
          type: string
      required:
      - channel_id
      - channel_name
      - redirect_url
      type: object
    RelationshipToIncidentImpactData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the impact.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentImpactsType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    RelationshipToOrganizationData:
      description: Relationship to organization object.
      properties:
        id:
          description: ID of the organization.
          example: 00000000-0000-beef-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/OrganizationsType'
      required:
      - id
      - type
      type: object
    SecurityMonitoringRuleConvertResponse:
      description: Result of the convert rule request containing Terraform content.
      properties:
        terraformContent:
          description: Terraform string as a result of converting the rule from JSON.
          type: string
          example: example_value
      type: object
    AWSIntegrationType:
      description: The definition of `AWSIntegrationType` object.
      enum:
      - AWS
      example: AWS
      type: string
      x-enum-varnames:
      - AWS
    Role:
      description: Role object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/RoleAttributes'
        id:
          description: The unique identifier of the role.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RoleResponseRelationships'
        type:
          $ref: '#/components/schemas/RolesType'
      required:
      - type
      type: object
      x-merge-override:
        required: false
    IncidentTeamResponseData:
      description: Incident Team data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTeamResponseAttributes'
        id:
          description: The incident team's ID.
          example: 00000000-7ea3-0000-000a-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTeamRelationships'
        type:
          $ref: '#/components/schemas/IncidentTeamType'
      type: object
    CloudConfigurationComplianceRuleOptions:
      additionalProperties: {}
      description: 'Options for cloud_configuration rules.

        Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules.

        '
      properties:
        complexRule:
          description: 'Whether the rule is a complex one.

            Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false.

            '
          type: boolean
          example: true
        regoRule:
          $ref: '#/components/schemas/CloudConfigurationRegoRule'
        resourceType:
          description: 'Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`.

            '
          example: aws_acm
          type: string
      type: object
    SecurityMonitoringRuleQuery:
      description: Query for matching rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleQuery'
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    DashboardTriggerWrapper:
      description: Schema for a Dashboard-based trigger.
      properties:
        dashboardTrigger:
          description: Trigger a workflow from a Dashboard.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - dashboardTrigger
      type: object
    SecurityMonitoringThirdPartyRuleCase:
      description: Case when signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    RelationshipToUsers:
      description: Relationship to users.
      properties:
        data:
          description: Relationships to user objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToUserData'
          type: array
      required:
      - data
      type: object
    HTTPCredentialsUpdate:
      description: The definition of `HTTPCredentialsUpdate` object.
      oneOf:
      - $ref: '#/components/schemas/HTTPTokenAuthUpdate'
    IncidentFieldAttributes:
      description: Dynamic fields for which selections can be made, with field names as keys.
      oneOf:
      - $ref: '#/components/schemas/IncidentFieldAttributesSingleValue'
      - $ref: '#/components/schemas/IncidentFieldAttributesMultipleValue'
    ActionConnectionIntegration:
      description: The definition of `ActionConnectionIntegration` object.
      oneOf:
      - $ref: '#/components/schemas/AWSIntegration'
      - $ref: '#/components/schemas/HTTPIntegration'
    Connection:
      description: The definition of `Connection` object.
      properties:
        connectionId:
          description: The `Connection` `connectionId`.
          example: ''
          type: string
        label:
          description: The `Connection` `label`.
          example: ''
          type: string
      required:
      - connectionId
      - label
      type: object
    IncidentNonDatadogCreator:
      description: Incident's non Datadog creator.
      nullable: true
      properties:
        image_48_px:
          description: Non Datadog creator `48px` image.
          type: string
          example: example_value
        name:
          description: Non Datadog creator name.
          type: string
          example: Example Monitor
      type: object
    ReadinessGate:
      description: Used to merge multiple branches into a single branch.
      properties:
        thresholdType:
          $ref: '#/components/schemas/ReadinessGateThresholdType'
      required:
      - thresholdType
      type: object
    ChangeEventTriggerWrapper:
      description: Schema for a Change Event-based trigger.
      properties:
        changeEventTrigger:
          description: Trigger a workflow from a Change Event.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - changeEventTrigger
      type: object
    AWSIntegrationUpdate:
      description: The definition of `AWSIntegrationUpdate` object.
      properties:
        credentials:
          $ref: '#/components/schemas/AWSCredentialsUpdate'
        type:
          $ref: '#/components/schemas/AWSIntegrationType'
      required:
      - type
      type: object
    OutboundEdge:
      description: The definition of `OutboundEdge` object.
      properties:
        branchName:
          description: The `OutboundEdge` `branchName`.
          example: ''
          type: string
        nextStepName:
          description: The `OutboundEdge` `nextStepName`.
          example: ''
          type: string
      required:
      - nextStepName
      - branchName
      type: object
    NullableRelationshipToUserData:
      description: Relationship to user object.
      nullable: true
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentServiceIncludedItems:
      description: An object related to an incident service which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    PermissionsType:
      default: permissions
      description: Permissions resource type.
      enum:
      - permissions
      example: permissions
      type: string
      x-enum-varnames:
      - PERMISSIONS
    APITriggerWrapper:
      description: Schema for an API-based trigger.
      properties:
        apiTrigger:
          $ref: '#/components/schemas/APITrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - apiTrigger
      type: object
    SecurityMonitoringSignalRuleType:
      description: The rule type.
      enum:
      - signal_correlation
      type: string
      x-enum-varnames:
      - SIGNAL_CORRELATION
    AnnotationDisplayBounds:
      description: The definition of `AnnotationDisplayBounds` object.
      properties:
        height:
          description: The `bounds` `height`.
          format: double
          type: number
          example: 95.5
        width:
          description: The `bounds` `width`.
          format: double
          type: number
          example: 95.5
        x:
          description: The `bounds` `x`.
          format: double
          type: number
          example: 95.5
        y:
          description: The `bounds` `y`.
          format: double
          type: number
          example: 95.5
      type: object
    IncidentUpdateRelationships:
      description: The incident's relationships for an update request.
      properties:
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        postmortem:
          $ref: '#/components/schemas/RelationshipToIncidentPostmortem'
      type: object
    RuleId:
      description: The unique ID for a scorecard rule.
      example: q8MQxk8TCqrHnWkx
      type: string
    NotebookTriggerWrapper:
      description: Schema for a Notebook-based trigger.
      properties:
        notebookTrigger:
          description: Trigger a workflow from a Notebook.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - notebookTrigger
      type: object
    RelationshipToRoles:
      description: Relationship to roles.
      properties:
        data:
          description: An array containing type and the unique identifier of a role.
          items:
            $ref: '#/components/schemas/RelationshipToRoleData'
          type: array
      type: object
      x-merge-override:
        required: false
    UrlParamUpdate:
      description: The definition of `UrlParamUpdate` object.
      properties:
        deleted:
          description: Should the header be deleted.
          type: boolean
          example: true
        name:
          $ref: '#/components/schemas/TokenName'
          example: MyUrlParameter
        value:
          description: The `UrlParamUpdate` `value`.
          example: Some Url Parameter value
          type: string
      required:
      - name
      type: object
    RelationshipToOrganizations:
      description: Relationship to organizations.
      properties:
        data:
          description: Relationships to organization objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToOrganizationData'
          type: array
      required:
      - data
      type: object
    TokenName:
      description: Name for tokens.
      example: MyTokenName
      pattern: ^[A-Za-z][A-Za-z\\d]*$
      type: string
    WorkflowData:
      description: Data related to the workflow.
      properties:
        attributes:
          $ref: '#/components/schemas/WorkflowDataAttributes'
        id:
          description: The workflow identifier
          readOnly: true
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/WorkflowDataRelationships'
        type:
          $ref: '#/components/schemas/WorkflowDataType'
      required:
      - type
      - attributes
      type: object
    HTTPTokenAuthType:
      description: The definition of `HTTPTokenAuthType` object.
      enum:
      - HTTPTokenAuth
      example: HTTPTokenAuth
      type: string
      x-enum-varnames:
      - HTTPTOKENAUTH
    IncidentServiceResponse:
      description: Response with an incident service payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentServiceResponseData'
        included:
          description: Included objects from relationships.
          items:
            $ref: '#/components/schemas/IncidentServiceIncludedItems'
          readOnly: true
          type: array
      required:
      - data
      type: object
    IncidentIntegrationMetadataResponse:
      description: Response with an incident integration metadata.
      properties:
        data:
          $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem'
          readOnly: true
          type: array
      required:
      - data
      type: object
    SecurityMonitoringThirdPartyRootQuery:
      description: A query to be combined with the third party case query.
      properties:
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        query:
          description: Query to run on logs.
          example: source:cloudtrail
          type: string
      type: object
    WorkflowUserRelationship:
      description: The definition of `WorkflowUserRelationship` object.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowUserRelationshipData'
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningMethod:
      default: duration
      description: The learning method used to determine when signals should be generated for values that weren't learned.
      enum:
      - duration
      - threshold
      type: string
      x-enum-varnames:
      - DURATION
      - THRESHOLD
    SecurityMonitoringRuleCaseAction:
      description: Action to perform when a signal is triggered. Only available for Application Security rule type.
      properties:
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
      type: object
    WorkflowUserRelationshipData:
      description: The definition of `WorkflowUserRelationshipData` object.
      properties:
        id:
          description: The user identifier
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/WorkflowUserRelationshipType'
      required:
      - type
      - id
      type: object
    GetActionConnectionResponse:
      description: The response for found connection
      properties:
        data:
          $ref: '#/components/schemas/ActionConnectionData'
      type: object
    NullableRelationshipToUser:
      description: Relationship to user.
      nullable: true
      properties:
        data:
          $ref: '#/components/schemas/NullableRelationshipToUserData'
      required:
      - data
      type: object
    IncidentTriggerWrapper:
      description: Schema for an Incident-based trigger.
      properties:
        incidentTrigger:
          $ref: '#/components/schemas/IncidentTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - incidentTrigger
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningDuration:
      default: 0
      description: 'The duration in days during which values are learned, and after which signals will be generated for values that

        weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.'
      enum:
      - 0
      - 1
      - 7
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_DAYS
      - ONE_DAY
      - SEVEN_DAYS
    SlackTriggerWrapper:
      description: Schema for a Slack-based trigger.
      properties:
        slackTrigger:
          description: Trigger a workflow from Slack. The workflow must be published.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - slackTrigger
      type: object
    RuleAttributes:
      description: Details of a rule.
      properties:
        category:
          deprecated: true
          description: The scorecard name to which this rule must belong.
          type: string
          example: example_value
        created_at:
          description: Creation time of the rule outcome.
          format: date-time
          type: string
          example: example_value
        custom:
          description: Defines if the rule is a custom rule.
          type: boolean
          example: true
        description:
          description: Explanation of the rule.
          type: string
          example: example_value
        enabled:
          description: If enabled, the rule is calculated as part of the score.
          example: true
          type: boolean
        modified_at:
          description: Time of the last rule outcome modification.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the rule.
          example: Team Defined
          type: string
        owner:
          description: Owner of the rule.
          type: string
          example: example_value
        scorecard_name:
          description: The scorecard name to which this rule must belong.
          example: Deployments automated via Deployment Trains
          type: string
      type: object
    ScheduleTrigger:
      description: Trigger a workflow from a Schedule. The workflow must be published.
      properties:
        rruleExpression:
          description: Recurrence rule expression for scheduling.
          example: ''
          type: string
      required:
      - rruleExpression
      type: object
    SecurityMonitoringRuleUpdatePayload:
      description: Update an existing rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        version:
          description: The version of the rule being updated.
          example: 1
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    IncidentAttachmentsPostmortemAttributesAttachmentObject:
      description: The postmortem attachment.
      properties:
        documentUrl:
          description: The URL of this notebook attachment.
          example: https://app.datadoghq.com/notebook/123
          type: string
        title:
          description: The title of this postmortem attachment.
          example: Postmortem IR-123
          type: string
      required:
      - documentUrl
      - title
      type: object
    RoleCloneAttributes:
      description: Attributes required to create a new role by cloning an existing one.
      properties:
        name:
          description: Name of the new role that is cloned.
          example: cloned-role
          type: string
      required:
      - name
      type: object
    IncidentAttachmentData:
      description: A single incident attachment.
      example:
        attributes:
          attachment:
            documentUrl: ''
            title: Postmortem IR-123
          attachment_type: postmortem
        id: 00000000-abcd-0002-0000-000000000000
        relationships:
          last_modified_by_user:
            data:
              id: 00000000-0000-0000-cccc-000000000000
              type: users
        type: incident_attachments
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentAttachmentAttributes'
        id:
          description: A unique identifier that represents the incident attachment.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentAttachmentRelationships'
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - type
      - attributes
      - id
      - relationships
      type: object
    RetryStrategy:
      description: The definition of `RetryStrategy` object.
      properties:
        kind:
          $ref: '#/components/schemas/RetryStrategyKind'
        linear:
          $ref: '#/components/schemas/RetryStrategyLinear'
      required:
      - kind
      type: object
    IncidentAttachmentPostmortemAttachmentType:
      default: postmortem
      description: The type of postmortem attachment attributes.
      enum:
      - postmortem
      example: postmortem
      type: string
      x-enum-varnames:
      - POSTMORTEM
    SecurityMonitoringRuleCase:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    SecurityMonitoringRuleNewValueOptions:
      description: Options on new value detection method.
      properties:
        forgetAfter:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
        learningDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
        learningMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod'
        learningThreshold:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold'
      type: object
    HTTPTokenUpdate:
      description: The definition of `HTTPTokenUpdate` object.
      properties:
        deleted:
          description: Should the header be deleted.
          type: boolean
          example: true
        name:
          description: The `HTTPToken` `name`.
          example: MyToken
          pattern: ^[A-Za-z][A-Za-z\\d]*$
          type: string
        type:
          $ref: '#/components/schemas/TokenType'
        value:
          description: The `HTTPToken` `value`.
          example: Some Token Value
          type: string
      required:
      - name
      - type
      - value
      type: object
    RetryStrategyKind:
      description: The definition of `RetryStrategyKind` object.
      enum:
      - RETRY_STRATEGY_LINEAR
      example: RETRY_STRATEGY_LINEAR
      type: string
      x-enum-varnames:
      - RETRY_STRATEGY_LINEAR
    IncidentIntegrationMetadataAttributes:
      description: Incident integration metadata's attributes for a create request.
      properties:
        created:
          description: Timestamp when the incident todo was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        incident_id:
          description: UUID of the incident this integration metadata is connected to.
          example: 00000000-aaaa-0000-0000-000000000000
          type: string
        integration_type:
          description: 'A number indicating the type of integration this metadata is for. 1 indicates Slack;

            8 indicates Jira.'
          example: 1
          format: int32
          maximum: 9
          type: integer
        metadata:
          $ref: '#/components/schemas/IncidentIntegrationMetadataMetadata'
        modified:
          description: Timestamp when the incident todo was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        status:
          description: 'A number indicating the status of this integration metadata. 0 indicates unknown;

            1 indicates pending; 2 indicates complete; 3 indicates manually created;

            4 indicates manually updated; 5 indicates failed.'
          format: int32
          maximum: 5
          type: integer
          example: 42
      required:
      - integration_type
      - metadata
      type: object
    SecurityMonitoringStandardRuleTestPayload:
      description: The payload of a rule to test
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeTest'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    SecurityMonitoringFilter:
      description: The rule's suppression filter.
      properties:
        action:
          $ref: '#/components/schemas/SecurityMonitoringFilterAction'
        query:
          description: Query for selecting logs to apply the filtering action.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    IncidentSeverity:
      description: The incident severity.
      enum:
      - UNKNOWN
      - SEV-0
      - SEV-1
      - SEV-2
      - SEV-3
      - SEV-4
      - SEV-5
      example: UNKNOWN
      type: string
      x-enum-varnames:
      - UNKNOWN
      - SEV_0
      - SEV_1
      - SEV_2
      - SEV_3
      - SEV_4
      - SEV_5
    HTTPIntegrationUpdate:
      description: The definition of `HTTPIntegrationUpdate` object.
      properties:
        base_url:
          description: Base HTTP url for the integration
          example: http://datadoghq.com
          type: string
        credentials:
          $ref: '#/components/schemas/HTTPCredentialsUpdate'
        type:
          $ref: '#/components/schemas/HTTPIntegrationType'
      required:
      - type
      type: object
    ErrorHandler:
      description: Used to handle errors in an action.
      properties:
        fallbackStepName:
          description: The `ErrorHandler` `fallbackStepName`.
          example: ''
          type: string
        retryStrategy:
          $ref: '#/components/schemas/RetryStrategy'
      required:
      - retryStrategy
      - fallbackStepName
      type: object
    MonitorTriggerWrapper:
      description: Schema for a Monitor-based trigger.
      properties:
        monitorTrigger:
          $ref: '#/components/schemas/MonitorTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - monitorTrigger
      type: object
    CompletionGate:
      description: Used to create conditions before running subsequent actions.
      properties:
        completionCondition:
          $ref: '#/components/schemas/CompletionCondition'
        retryStrategy:
          $ref: '#/components/schemas/RetryStrategy'
      required:
      - completionCondition
      - retryStrategy
      type: object
    SecurityMonitoringStandardRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        defaultTags:
          description: Default Tags for default rules (included in tags)
          example:
          - security:attacks
          items:
            description: Default Tag.
            type: string
          type: array
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        updatedAt:
          description: The date the rule was last updated, in milliseconds.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    IncidentRelatedObject:
      description: Object related to an incident.
      enum:
      - users
      - attachments
      type: string
      x-enum-varnames:
      - USERS
      - ATTACHMENTS
    RolesType:
      default: roles
      description: Roles type.
      enum:
      - roles
      example: roles
      type: string
      x-enum-varnames:
      - ROLES
    IncidentServiceResponseData:
      description: Incident Service data from responses.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentServiceResponseAttributes'
        id:
          description: The incident service's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentServiceRelationships'
        type:
          $ref: '#/components/schemas/IncidentServiceType'
      required:
      - id
      - type
      type: object
    Spec:
      description: The spec defines what the workflow does.
      properties:
        annotations:
          description: A list of annotations used in the workflow. These are like sticky notes for your workflow!
          items:
            $ref: '#/components/schemas/Annotation'
          type: array
        connectionEnvs:
          description: A list of connections or connection groups used in the workflow.
          items:
            $ref: '#/components/schemas/ConnectionEnv'
          type: array
        handle:
          description: Unique identifier used to trigger workflows automatically in Datadog.
          type: string
          example: example_value
        inputSchema:
          $ref: '#/components/schemas/InputSchema'
        outputSchema:
          $ref: '#/components/schemas/OutputSchema'
        steps:
          description: A `Step` is a sub-component of a workflow. Each `Step` performs an action.
          items:
            $ref: '#/components/schemas/Step'
          type: array
        triggers:
          description: The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
          items:
            $ref: '#/components/schemas/Trigger'
          type: array
      type: object
    Step:
      description: A Step is a sub-component of a workflow. Each Step performs an action.
      properties:
        actionId:
          description: The unique identifier of an action.
          example: ''
          type: string
        completionGate:
          $ref: '#/components/schemas/CompletionGate'
        connectionLabel:
          description: The unique identifier of a connection defined in the spec.
          type: string
          example: example_value
        display:
          $ref: '#/components/schemas/StepDisplay'
        errorHandlers:
          description: The `Step` `errorHandlers`.
          items:
            $ref: '#/components/schemas/ErrorHandler'
          type: array
        name:
          description: Name of the step.
          example: ''
          type: string
        outboundEdges:
          description: A list of subsequent actions to run.
          items:
            $ref: '#/components/schemas/OutboundEdge'
          type: array
        parameters:
          description: A list of inputs for an action.
          items:
            $ref: '#/components/schemas/Parameter'
          type: array
        readinessGate:
          $ref: '#/components/schemas/ReadinessGate'
      required:
      - name
      - actionId
      type: object
    HTTPToken:
      description: The definition of `HTTPToken` object.
      properties:
        name:
          description: The `HTTPToken` `name`.
          example: MyToken
          pattern: ^[A-Za-z][A-Za-z\\d]*$
          type: string
        type:
          $ref: '#/components/schemas/TokenType'
        value:
          description: The `HTTPToken` `value`.
          example: Some Token Value
          type: string
      required:
      - name
      - value
      - type
      type: object
    SecurityMonitoringRuleDetectionMethod:
      description: The detection method.
      enum:
      - threshold
      - new_value
      - anomaly_detection
      - impossible_travel
      - hardcoded
      - third_party
      - anomaly_threshold
      type: string
      x-enum-varnames:
      - THRESHOLD
      - NEW_VALUE
      - ANOMALY_DETECTION
      - IMPOSSIBLE_TRAVEL
      - HARDCODED
      - THIRD_PARTY
      - ANOMALY_THRESHOLD
    RelationshipToPermissions:
      description: Relationship to multiple permissions objects.
      properties:
        data:
          description: Relationships to permission objects.
          items:
            $ref: '#/components/schemas/RelationshipToPermissionData'
          type: array
      type: object
      x-merge-override:
        required: false
    IncidentTeamType:
      default: teams
      description: Incident Team resource type.
      enum:
      - teams
      example: teams
      type: string
      x-enum-varnames:
      - TEAMS
    SecurityMonitoringRuleTestRequest:
      description: Test the rule queries of a rule (rule property is ignored when applied to an existing rule)
      properties:
        rule:
          $ref: '#/components/schemas/SecurityMonitoringRuleTestPayload'
        ruleQueryPayloads:
          description: Data payloads used to test rules query with the expected result.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleQueryPayload'
          type: array
      type: object
    IncidentIntegrationMetadataPatchRequest:
      description: Patch request for an incident integration metadata.
      properties:
        data:
          $ref: '#/components/schemas/IncidentIntegrationMetadataPatchData'
      required:
      - data
      type: object
    GetWorkflowResponse:
      description: The response object after getting a workflow.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowData'
      type: object
  responses:
    NotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Found
    UnauthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Unauthorized
    ForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Forbidden
    ConflictResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Conflict
    ConcurrentModificationResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Concurrent Modification
    NotAuthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Authorized
    TooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Too many requests
    BadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Bad Request
  parameters:
    IncidentIncludeQueryParameter:
      description: Specifies which types of related objects should be included in the response.
      explode: false
      in: query
      name: include
      required: false
      schema:
        items:
          $ref: '#/components/schemas/IncidentRelatedObject'
        type: array
    RoleID:
      description: The unique identifier of the role.
      in: path
      name: role_id
      required: true
      schema:
        type: string
    RuleId:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    IncidentIntegrationMetadataIDPathParameter:
      description: The UUID of the incident integration metadata.
      in: path
      name: integration_metadata_id
      required: true
      schema:
        type: string
    ConnectionId:
      description: The ID of the action connection
      in: path
      name: connection_id
      required: true
      schema:
        type: string
    HistoricalJobID:
      description: The ID of the job.
      in: path
      name: job_id
      required: true
      schema:
        type: string
    SecurityMonitoringRuleID:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    WorkflowId:
      description: The ID of the workflow.
      in: path
      name: workflow_id
      required: true
      schema:
        type: string
    IncidentTeamIDPathParameter:
      description: The ID of the incident team.
      in: path
      name: team_id
      required: true
      schema:
        type: string
    IncidentServiceIDPathParameter:
      description: The ID of the incident service.
      in: path
      name: service_id
      required: true
      schema:
        type: string
    IncidentIDPathParameter:
      description: The UUID of the incident.
      in: path
      name: incident_id
      required: true
      schema:
        type: string
  securitySchemes:
    AuthZ:
      description: This API uses OAuth 2 with the implicit grant flow.
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          scopes:
            apm_api_catalog_read: View API catalog and API definitions.
            apm_api_catalog_write: Add, modify, and delete API catalog definitions.
            apm_read: Read and query APM and Trace Analytics.
            apm_service_catalog_read: View service catalog and service definitions.
            apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
            appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source.
            cases_read: View Cases.
            cases_write: Create and update cases.
            ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API.
            ci_visibility_read: View CI Visibility.
            cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.
            cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.
            code_analysis_read: View Code Analysis.
            continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO).
            create_webhooks: Create webhooks integrations.
            dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'.
            dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'.
            dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally.
            dashboards_read: View dashboards.
            dashboards_write: Create and change dashboards.
            data_scanner_read: View Data Scanner configurations.
            data_scanner_write: Edit Data Scanner configurations.
            embeddable_graphs_share: Generate public links to share embeddable graphs externally.
            events_read: Read Events data.
            hosts_read: List hosts and their attributes.
            incident_notification_settings_write: Configure Incidents Notification settings.
            incident_read: View incidents in Datadog.
            incident_settings_write: Configure Incident Settings.
            incident_write: Create, view, and manage incidents in Datadog.
            metrics_read: View custom metrics.
            monitor_config_policy_write: Edit and delete monitor configuration.
            monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.
            monitors_read: View monitors.
            monitors_write: Edit, delete, and resolve individual monitors.
            org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.
            security_comments_read: Read comments of vulnerabilities.
            security_monitoring_filters_read: Read Security Filters.
            security_monitoring_filters_write: Create, edit, and delete Security Filters.
            security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks.
            security_monitoring_notification_profiles_read: View Rule Security Notification rules.
            security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules.
            security_monitoring_rules_read: Read Detection Rules.
            security_monitoring_rules_write: Create and edit Detection Rules.
            security_monitoring_signals_read: View Security Signals.
            security_monitoring_suppressions_read: Read Rule Suppressions.
            security_monitoring_suppressions_write: Write Rule Suppressions.
            security_pipelines_read: View Security Pipelines.
            security_pipelines_write: Create, edit, and delete CSM Security Pipelines.
            slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.
            slos_read: View SLOs and status corrections.
            slos_write: Create, edit, and delete SLOs.
            synthetics_global_variable_read: View, search, and use Synthetics global variables.
            synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics.
            synthetics_private_location_read: View, search, and use Synthetics private locations.
            synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines.
            synthetics_read: List and view configured Synthetic tests and test results.
            synthetics_write: Create, edit, and delete Synthetic tests.
            teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.
            teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.
            test_optimization_read: View Test Optimization.
            timeseries_query: Query Timeseries data.
            usage_read: View your organization's usage and usage attribution.
            user_access_invite: Invite other users to your organization.
            user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
            user_access_read: View users and their roles and settings.
            workflows_read: View workflows.
            workflows_run: Run workflows.
            workflows_write: Create, edit, and delete workflows.
          tokenUrl: /oauth2/v1/token
      type: oauth2
    apiKeyAuth:
      description: Your Datadog API Key.
      in: header
      name: DD-API-KEY
      type: apiKey
      x-env-name: DD_API_KEY
    appKeyAuth:
      description: Your Datadog APP Key.
      in: header
      name: DD-APPLICATION-KEY
      type: apiKey
      x-env-name: DD_APP_KEY
    bearerAuth:
      scheme: bearer
      type: http
      x-env-name: DD_BEARER_TOKEN
x-group-parameters: true
x-merge-override:
  paths: false