openapi: 3.0.0 info: contact: email: support@datadoghq.com name: Datadog Support url: https://www.datadoghq.com/support/ description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically. title: Datadog Account Get API version: '1.0' servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for Datadog customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - datadoghq.eu - ddog-gov.com subdomain: default: api description: The subdomain where the API is deployed. - url: '{protocol}://{name}' variables: name: default: api.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: api description: The subdomain where the API is deployed. security: - apiKeyAuth: [] appKeyAuth: [] tags: - name: Get paths: /api/v2/actions/connections/{connection_id}: get: description: Get an existing Action Connection operationId: GetActionConnection parameters: - $ref: '#/components/parameters/ConnectionId' responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetActionConnectionResponse' description: Successfully get Action Connection '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Not Found '429': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Too Many Request summary: Datadog Get an Existing Action Connection tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/agentless_scanning/accounts/aws: get: description: Fetches the scan options configured for AWS accounts. operationId: ListAwsScanOptions responses: '200': content: application/json: schema: $ref: '#/components/schemas/AwsScanOptionsListResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Aws Scan Options tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/agentless_scanning/ondemand/aws: get: description: Fetches the most recent 1000 AWS on demand tasks. operationId: ListAwsOnDemandTasks responses: '200': content: application/json: schema: $ref: '#/components/schemas/AwsOnDemandListResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Aws on Demand Tasks tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - security_monitoring_findings_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/agentless_scanning/ondemand/aws/{task_id}: get: description: Fetch the data of a specific on demand task. operationId: GetAwsOnDemandTask parameters: - $ref: '#/components/parameters/OnDemandTaskId' responses: '200': content: application/json: schema: $ref: '#/components/schemas/AwsOnDemandResponse' description: OK. '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Aws on Demand Task by Id tags: - Get x-menu-order: 6 x-permission: operator: OR permissions: - security_monitoring_findings_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/api_keys: x-merge-override: post: true get: description: List all API keys available for your account. operationId: ListAPIKeys parameters: - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - $ref: '#/components/parameters/APIKeysSortParameter' - $ref: '#/components/parameters/APIKeyFilterParameter' - $ref: '#/components/parameters/APIKeyFilterCreatedAtStartParameter' - $ref: '#/components/parameters/APIKeyFilterCreatedAtEndParameter' - $ref: '#/components/parameters/APIKeyFilterModifiedAtStartParameter' - $ref: '#/components/parameters/APIKeyFilterModifiedAtEndParameter' - $ref: '#/components/parameters/APIKeyIncludeParameter' - $ref: '#/components/parameters/APIKeyReadConfigReadEnabledParameter' - $ref: '#/components/parameters/APIKeyCategoryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/APIKeysResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Api Keys tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - api_keys_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/api_keys/{api_key_id}: x-merge-override: delete: true get: true patch: true get: description: Get an API key. operationId: GetAPIKey parameters: - $ref: '#/components/parameters/APIKeyId' - $ref: '#/components/parameters/APIKeyIncludeParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/APIKeyResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Api Key tags: - Get x-menu-order: 3 x-merge-override: parameters: false x-permission: operator: OR permissions: - api_keys_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apicatalog/api/{id}/openapi: get: deprecated: true description: Retrieve information about a specific API in [OpenAPI](https://spec.openapis.org/oas/latest.html) format file. operationId: GetOpenAPI parameters: - description: ID of the API to retrieve in: path name: id required: true schema: $ref: '#/components/schemas/ApiID' example: abc-123-def responses: '200': content: multipart/form-data: schema: format: binary type: string description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: API not found error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_read summary: Datadog Get an Api tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - apm_api_catalog_read x-undo: type: safe x-unstable: '**Note**: This endpoint is deprecated.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apm/config/metrics: get: description: Get the list of configured span-based metrics with their definitions. operationId: ListSpansMetrics responses: '200': content: application/json: schema: $ref: '#/components/schemas/SpansMetricsResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Span-based Metrics tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - apm_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apm/config/metrics/{metric_id}: get: description: Get a specific span-based metric from your organization. operationId: GetSpansMetric parameters: - $ref: '#/components/parameters/SpansMetricIDParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/SpansMetricResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Span-based Metric tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - apm_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apm/config/retention-filters/{filter_id}: get: description: Get an APM retention filter. operationId: GetApmRetentionFilter parameters: - $ref: '#/components/parameters/RetentionFilterIdParam' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RetentionFilterResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Given Apm Retention Filter tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - apm_retention_filter_read - apm_pipelines_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/app-builder/apps/{app_id}: get: description: Get the full definition of an app. operationId: GetApp parameters: - description: The ID of the app to retrieve. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string - description: The version number of the app to retrieve. If not specified, the latest version is returned. Version numbers start at 1 and increment with each update. The special values `latest` and `deployed` can be used to retrieve the latest version or the published version, respectively. in: query name: version required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetAppResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Not Found '410': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Gone '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get App tags: - Get x-menu-order: 4 x-permission: operator: AND permissions: - apps_run - connections_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/application_keys: get: description: List all application keys available for your org operationId: ListApplicationKeys parameters: - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - $ref: '#/components/parameters/ApplicationKeysSortParameter' - $ref: '#/components/parameters/ApplicationKeyFilterParameter' - $ref: '#/components/parameters/ApplicationKeyFilterCreatedAtStartParameter' - $ref: '#/components/parameters/ApplicationKeyFilterCreatedAtEndParameter' - $ref: '#/components/parameters/ApplicationKeyIncludeParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListApplicationKeysResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Application Keys tags: - Get x-menu-order: 9 x-permission: operator: OR permissions: - org_app_keys_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/application_keys/{app_key_id}: x-merge-override: delete: true get: false get: description: Get an application key for your org. operationId: GetApplicationKey parameters: - $ref: '#/components/parameters/ApplicationKeyID' - $ref: '#/components/parameters/ApplicationKeyIncludeParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationKeyResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get an Application Key tags: - Get x-menu-order: 8 x-permission: operator: OR permissions: - org_app_keys_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/audit/events: get: description: 'List endpoint returns events that match a Audit Logs search query. [Results are paginated][1]. Use this endpoint to see your latest Audit Logs events. [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination' operationId: ListAuditLogs parameters: - description: Search query following Audit Logs syntax. example: '@type:session @application_id:xxxx' in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: '2019-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: '2019-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: '#/components/schemas/AuditLogsSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/AuditLogsEventsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a List of Audit Logs Events tags: - Get x-menu-order: 2 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - audit_logs_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/authn_mappings/{authn_mapping_id}: x-merge-override: get: false patch: false get: description: Get an AuthN Mapping specified by the AuthN Mapping UUID. operationId: GetAuthNMapping parameters: - $ref: '#/components/parameters/AuthNMappingID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/AuthNMappingResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get an Authn Mapping by Uuid tags: - Get x-menu-order: 1 x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cases/projects: get: description: Get all projects. operationId: GetProjects responses: '200': content: application/json: schema: $ref: '#/components/schemas/ProjectsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Datadog Get All Projects tags: - Get x-menu-order: 2 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cases/projects/{project_id}: get: description: Get the details of a project by `project_id`. operationId: GetProject parameters: - $ref: '#/components/parameters/ProjectIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ProjectResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Datadog Get the Details of a Project tags: - Get x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cases/{case_id}: get: description: Get the details of case by `case_id` operationId: GetCase parameters: - $ref: '#/components/parameters/CaseIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CaseResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Datadog Get the Details of a Case tags: - Get x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/catalog/entity: get: description: Get a list of entities from Software Catalog. operationId: ListCatalogEntity parameters: - $ref: '#/components/parameters/PageOffset' - description: Maximum number of entities in the response. example: 100 in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer - $ref: '#/components/parameters/FilterByID' - $ref: '#/components/parameters/FilterByRef' - $ref: '#/components/parameters/FilterByName' - $ref: '#/components/parameters/FilterByKind' - $ref: '#/components/parameters/FilterByOwner' - $ref: '#/components/parameters/FilterByRelationType' - $ref: '#/components/parameters/FilterByExcludeSnapshot' - $ref: '#/components/parameters/Include' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListEntityCatalogResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Datadog Get a List of Entities tags: - Get x-menu-order: 1 x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/catalog/relation: get: description: Get a list of entity relations from Software Catalog. operationId: ListCatalogRelation parameters: - $ref: '#/components/parameters/PageOffset' - description: Maximum number of relations in the response. example: 100 in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer - $ref: '#/components/parameters/FilterRelationByType' - $ref: '#/components/parameters/FilterRelationByFromRef' - $ref: '#/components/parameters/FilterRelationByToRef' - $ref: '#/components/parameters/RelationInclude' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListRelationCatalogResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Datadog Get a List of Entity Relations tags: - Get x-menu-order: 3 x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ci/pipelines/events: get: description: 'List endpoint returns CI Visibility pipeline events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/). [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to see your latest pipeline events.' operationId: ListCIAppPipelineEvents parameters: - description: Search query following log syntax. example: '@ci.provider.name:github @ci.pipeline.name:Pull Request Labeler' in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: '2019-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: '2019-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: '#/components/schemas/CIAppSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/CIAppPipelineEventsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read summary: Datadog Get a List of Pipelines Events tags: - Get x-menu-order: 2 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - ci_visibility_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ci/tests/events: get: description: 'List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/). [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to see your latest test events.' operationId: ListCIAppTestEvents parameters: - description: Search query following log syntax. example: '@test.name:test_foo @test.suite:github.com/DataDog/dd-go/model' in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: '2019-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: '2019-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: '#/components/schemas/CIAppSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/CIAppTestEventsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read summary: Datadog Get a List of Tests Events tags: - Get x-menu-order: 1 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - ci_visibility_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cloud_security_management/custom_frameworks/{handle}/{version}: get: description: Get a custom framework. operationId: GetCustomFramework parameters: - $ref: '#/components/parameters/CustomFrameworkHandle' - $ref: '#/components/parameters/CustomFrameworkVersion' responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetCustomFrameworkResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' '500': $ref: '#/components/responses/BadRequestResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Datadog Get a Custom Framework tags: - Get x-codegen-request-body-name: body x-menu-order: 4 x-permission: operator: OR permissions: - security_monitoring_rules_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/container_images: get: description: Get all Container Images for your organization. operationId: ListContainerImages parameters: - description: Comma-separated list of tags to filter Container Images by. example: short_image:redis,status:running in: query name: filter[tags] required: false schema: type: string - description: Comma-separated list of tags to group Container Images by. example: registry,image_tags in: query name: group_by required: false schema: type: string - description: Attribute to sort Container Images by. example: container_count in: query name: sort required: false schema: type: string - description: Maximum number of results returned. in: query name: page[size] required: false schema: default: 1000 format: int32 maximum: 10000 minimum: 1 type: integer example: 42 - description: 'String to query the next page of results. This key is provided with each valid response from the API in `meta.pagination.next_cursor`.' in: query name: page[cursor] required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/ContainerImagesResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get All Container Images tags: - Get x-menu-order: 1 x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/containers: get: description: Get all containers for your organization. operationId: ListContainers parameters: - description: Comma-separated list of tags to filter containers by. example: env:prod,short_image:cassandra in: query name: filter[tags] required: false schema: type: string - description: Comma-separated list of tags to group containers by. example: datacenter,cluster in: query name: group_by required: false schema: type: string - description: Attribute to sort containers by. example: started_at in: query name: sort required: false schema: type: string - description: Maximum number of results returned. in: query name: page[size] required: false schema: default: 1000 format: int32 maximum: 10000 minimum: 1 type: integer example: 42 - description: 'String to query the next page of results. This key is provided with each valid response from the API in `meta.pagination.next_cursor`.' in: query name: page[cursor] required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/ContainersResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get All Containers tags: - Get x-menu-order: 1 x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/budget/{budget_id}: get: description: Get a budget. operationId: GetBudget parameters: - $ref: '#/components/parameters/BudgetID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/BudgetWithEntries' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Datadog Get a Budget tags: - Get x-menu-order: 16 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/custom_costs/{file_id}: get: description: Fetch the specified Custom Costs file. operationId: GetCustomCostsFile parameters: - $ref: '#/components/parameters/FileID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomCostsFileGetResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Datadog Get Custom Costs File tags: - Get x-menu-order: 12 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost_by_tag/active_billing_dimensions: get: description: Get active billing dimensions for cost attribution. Cost data for a given month becomes available no later than the 19th of the following month. operationId: GetActiveBillingDimensions responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/ActiveBillingDimensionsResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Active Billing Dimensions for Cost Attribution tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost_by_tag/monthly_cost_attribution: get: description: "Get monthly cost attribution by tag across multi-org and single root-org accounts.\nCost Attribution data for a given month becomes available no later than the 19th of the following month.\nThis API endpoint is paginated. To make sure you receive all records, check if the value of `next_record_id` is\nset in the response. If it is, make another request and pass `next_record_id` as a parameter.\nPseudo code example:\n```\nresponse := GetMonthlyCostAttribution(start_month, end_month)\ncursor := response.metadata.pagination.next_record_id\nWHILE cursor != null BEGIN\n sleep(5 seconds) # Avoid running into rate limit\n response := GetMonthlyCostAttribution(start_month, end_month, next_record_id=cursor)\n cursor := response.metadata.pagination.next_record_id\nEND\n```\n\nThis endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). This endpoint is not available in the Government (US1-FED) site." operationId: GetMonthlyCostAttribution parameters: - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning in this month.' in: query name: start_month required: true schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month.' in: query name: end_month required: false schema: format: date-time type: string example: example_value - description: 'Comma-separated list specifying cost types (e.g., `_on_demand_cost`, `_committed_cost`, `_total_cost`) and the proportions (`_percentage_in_org`, `_percentage_in_account`). Use `*` to retrieve all fields. Example: `infra_host_on_demand_cost,infra_host_percentage_in_account` To obtain the complete list of active billing dimensions that can be used to replace `` in the field names, make a request to the [Get active billing dimensions API](https://docs.datadoghq.com/api/latest/usage-metering/#get-active-billing-dimensions-for-cost-attribution).' in: query name: fields required: true schema: type: string example: example_value - description: 'The direction to sort by: `[desc, asc]`.' in: query name: sort_direction required: false schema: $ref: '#/components/schemas/SortDirection' example: example_value - description: 'The billing dimension to sort by. Always sorted by total cost. Example: `infra_host`.' in: query name: sort_name required: false schema: type: string example: Example Monitor - description: 'Comma separated list of tag keys used to group cost. If no value is provided the cost will not be broken down by tags. To see which tags are available, look for the value of `tag_config_source` in the API response.' in: query name: tag_breakdown_keys required: false schema: type: string example: env:production - description: List following results with a next_record_id provided in the previous query. in: query name: next_record_id required: false schema: type: string example: abc-123-def - description: Include child org cost in the response. Defaults to `true`. in: query name: include_descendants required: false schema: default: true type: boolean example: true responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/MonthlyCostAttributionResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Monthly Cost Attribution tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/csm/onboarding/agents: get: description: Get the list of all CSM Agents running on your hosts and containers. operationId: ListAllCSMAgents parameters: - description: The page index for pagination (zero-based). in: query name: page required: false schema: example: 2 format: int32 maximum: 1000000 minimum: 0 type: integer example: 2 - description: The number of items to include in a single page. in: query name: size required: false schema: example: 12 format: int32 maximum: 100 minimum: 0 type: integer example: 12 - description: A search query string to filter results (for example, `hostname:COMP-T2H4J27423`). in: query name: query required: false schema: example: hostname:COMP-T2H4J27423 type: string example: hostname:COMP-T2H4J27423 - description: The sort direction for results. Use `asc` for ascending or `desc` for descending. in: query name: order_direction required: false schema: $ref: '#/components/schemas/OrderDirection' example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/CsmAgentsResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Csm Agents tags: - Get x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/csm/onboarding/coverage_analysis/cloud_accounts: get: description: 'Get the CSM Coverage Analysis of your Cloud Accounts. This is calculated based on the number of your Cloud Accounts that are scanned for security issues.' operationId: GetCSMCloudAccountsCoverageAnalysis responses: '200': content: application/json: schema: $ref: '#/components/schemas/CsmCloudAccountsCoverageAnalysisResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the Csm Cloud Accounts Coverage Analysis tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/csm/onboarding/coverage_analysis/hosts_and_containers: get: description: 'Get the CSM Coverage Analysis of your Hosts and Containers. This is calculated based on the number of agents running on your Hosts and Containers with CSM feature(s) enabled.' operationId: GetCSMHostsAndContainersCoverageAnalysis responses: '200': content: application/json: schema: $ref: '#/components/schemas/CsmHostsAndContainersCoverageAnalysisResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the Csm Hosts and Containers Coverage Analysis tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/csm/onboarding/coverage_analysis/serverless: get: description: 'Get the CSM Coverage Analysis of your Serverless Resources. This is calculated based on the number of agents running on your Serverless Resources with CSM feature(s) enabled.' operationId: GetCSMServerlessCoverageAnalysis responses: '200': content: application/json: schema: $ref: '#/components/schemas/CsmServerlessCoverageAnalysisResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the Csm Serverless Coverage Analysis tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/csm/onboarding/serverless/agents: get: description: Get the list of all CSM Serverless Agents running on your hosts and containers. operationId: ListAllCSMServerlessAgents parameters: - description: The page index for pagination (zero-based). in: query name: page required: false schema: example: 2 format: int32 maximum: 1000000 minimum: 0 type: integer example: 2 - description: The number of items to include in a single page. in: query name: size required: false schema: example: 12 format: int32 maximum: 100 minimum: 0 type: integer example: 12 - description: A search query string to filter results (for example, `hostname:COMP-T2H4J27423`). in: query name: query required: false schema: example: hostname:COMP-T2H4J27423 type: string example: hostname:COMP-T2H4J27423 - description: The sort direction for results. Use `asc` for ascending or `desc` for descending. in: query name: order_direction required: false schema: $ref: '#/components/schemas/OrderDirection' example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/CsmAgentsResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Csm Serverless Agents tags: - Get x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/current_user/application_keys: get: description: List all application keys available for current user operationId: ListCurrentUserApplicationKeys parameters: - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - $ref: '#/components/parameters/ApplicationKeysSortParameter' - $ref: '#/components/parameters/ApplicationKeyFilterParameter' - $ref: '#/components/parameters/ApplicationKeyFilterCreatedAtStartParameter' - $ref: '#/components/parameters/ApplicationKeyFilterCreatedAtEndParameter' - $ref: '#/components/parameters/ApplicationKeyIncludeParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListApplicationKeysResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Application Keys Owned by Current User tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - user_app_keys x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/current_user/application_keys/{app_key_id}: x-merge-override: delete: true patch: true get: description: Get an application key owned by current user operationId: GetCurrentUserApplicationKey parameters: - $ref: '#/components/parameters/ApplicationKeyID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationKeyResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get One Application Key Owned by Current User tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - user_app_keys x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/dashboard/lists/manual/{dashboard_list_id}/dashboards: get: description: Fetch the dashboard list’s dashboard definitions. operationId: GetDashboardListItems parameters: - description: ID of the dashboard list to get items from. in: path name: dashboard_list_id required: true schema: format: int64 type: integer example: 42 responses: '200': content: application/json: schema: $ref: '#/components/schemas/DashboardListItems' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Datadog Get Items of a Dashboard List tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - dashboards_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/domain_allowlist: get: description: Get the domain allowlist for an organization. operationId: GetDomainAllowlist responses: '200': content: application/json: schema: $ref: '#/components/schemas/DomainAllowlistResponse' description: OK '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Datadog Get Domain Allowlist tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - org_management x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/dora/deployments: post: description: Use this API endpoint to get a list of deployment events. operationId: ListDORADeployments requestBody: content: application/json: schema: $ref: '#/components/schemas/DORAListDeploymentsRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/DORAListResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] summary: Datadog Get a List of Deployment Events tags: - Get x-codegen-request-body-name: body x-menu-order: 3 x-permission: operator: OR permissions: - dora_metrics_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/dora/deployments/{deployment_id}: get: description: Use this API endpoint to get a deployment event. operationId: GetDORADeployment parameters: - description: The ID of the deployment event. in: path name: deployment_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/DORAFetchResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] - appKeyAuth: [] summary: Datadog Get a Deployment Event tags: - Get x-codegen-request-body-name: body x-menu-order: 5 x-permission: operator: OR permissions: - dora_metrics_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/dora/failures: post: description: Use this API endpoint to get a list of failure events. operationId: ListDORAFailures requestBody: content: application/json: schema: $ref: '#/components/schemas/DORAListFailuresRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/DORAListResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] summary: Datadog Get a List of Failure Events tags: - Get x-codegen-request-body-name: body x-menu-order: 4 x-permission: operator: OR permissions: - dora_metrics_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/dora/failures/{failure_id}: get: description: Use this API endpoint to get a failure event. operationId: GetDORAFailure parameters: - description: The ID of the failure event. in: path name: failure_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/DORAFetchResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] - appKeyAuth: [] summary: Datadog Get a Failure Event tags: - Get x-codegen-request-body-name: body x-menu-order: 6 x-permission: operator: OR permissions: - dora_metrics_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/downtime: get: description: Get all scheduled downtimes. operationId: ListDowntimes parameters: - description: Only return downtimes that are active when the request is made. in: query name: current_only required: false schema: type: boolean example: true - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource paths are `created_by` and `monitor`.' in: query name: include required: false schema: example: created_by,monitor type: string example: created_by,monitor - $ref: '#/components/parameters/PageOffset' - description: Maximum number of downtimes in the response. example: 100 in: query name: page[limit] required: false schema: default: 30 format: int64 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListDowntimesResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Datadog Get All Downtimes tags: - Get x-menu-order: 1 x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-permission: operator: OR permissions: - monitors_downtime x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/downtime/{downtime_id}: get: description: Get downtime detail by `downtime_id`. operationId: GetDowntime parameters: - description: ID of the downtime to fetch. in: path name: downtime_id required: true schema: example: 00000000-0000-1234-0000-000000000000 type: string example: 00000000-0000-1234-0000-000000000000 - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource paths are `created_by` and `monitor`.' in: query name: include required: false schema: example: created_by,monitor type: string example: created_by,monitor responses: '200': content: application/json: schema: $ref: '#/components/schemas/DowntimeResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Datadog Get a Downtime tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - monitors_downtime x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/events: x-merge-override: get: false post: false get: description: 'List endpoint returns events that match an events search query. [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to see your latest events.' operationId: ListEvents parameters: - description: Search query following events syntax. in: query name: filter[query] required: false schema: type: string example: avg:system.cpu.user{*} - description: Minimum timestamp for requested events, in milliseconds. in: query name: filter[from] required: false schema: type: string example: example_value - description: Maximum timestamp for requested events, in milliseconds. in: query name: filter[to] required: false schema: type: string example: example_value - description: Order of events in results. in: query name: sort required: false schema: $ref: '#/components/schemas/EventsSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/EventsListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - events_read summary: Datadog Get a List of Events tags: - Get x-menu-order: 1 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - events_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents: get: description: Get all incidents for the user's organization. operationId: ListIncidents parameters: - $ref: '#/components/parameters/IncidentIncludeQueryParameter' - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageOffset' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get a List of Incidents tags: - Get x-menu-order: 5 x-pagination: limitParam: page[size] pageOffsetParam: page[offset] resultsPath: data x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/config/types: get: description: Get all incident types. operationId: ListIncidentTypes parameters: - $ref: '#/components/parameters/IncidentTypeIncludeDeletedParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentTypeListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get a List of Incident Types tags: - Get x-menu-order: 20 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/config/types/{incident_type_id}: get: description: Get incident type details. operationId: GetIncidentType parameters: - $ref: '#/components/parameters/IncidentTypeIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentTypeResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get Incident Type Details tags: - Get x-menu-order: 21 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}: x-merge-override: delete: true get: description: Get the details of an incident by `incident_id`. operationId: GetIncident parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' - $ref: '#/components/parameters/IncidentIncludeQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get the Details of an Incident tags: - Get x-menu-order: 2 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/attachments: get: description: Get all attachments for a given incident. operationId: ListIncidentAttachments parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' - $ref: '#/components/parameters/IncidentAttachmentIncludeQueryParameter' - $ref: '#/components/parameters/IncidentAttachmentFilterQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentAttachmentsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a List of Attachments tags: - Get x-menu-order: 7 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/relationships/integrations: get: description: Get all integration metadata for an incident. operationId: ListIncidentIntegrations parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentIntegrationMetadataListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get a List of an Incident's Integration Metadata tags: - Get x-menu-order: 9 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/relationships/integrations/{integration_metadata_id}: get: description: Get incident integration metadata details. operationId: GetIncidentIntegration parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' - $ref: '#/components/parameters/IncidentIntegrationMetadataIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentIntegrationMetadataResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get Incident Integration Metadata Details tags: - Get x-menu-order: 11 x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/relationships/todos: get: description: Get all todos for an incident. operationId: ListIncidentTodos parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentTodoListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get a List of an Incident's Todos tags: - Get x-menu-order: 14 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/relationships/todos/{todo_id}: get: description: Get incident todo details. operationId: GetIncidentTodo parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' - $ref: '#/components/parameters/IncidentTodoIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentTodoResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get Incident Todo Details tags: - Get x-menu-order: 16 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/aws/accounts/{aws_account_config_id}: get: description: Get an AWS Account Integration Config by config ID. operationId: GetAWSAccount parameters: - $ref: '#/components/parameters/AWSAccountConfigIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/AWSAccountResponse' description: AWS Account object '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get an Aws Integration by Config Id tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - aws_configuration_read x-undo: type: safe x-unstable: '**Note: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).**' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/aws/logs/services: get: description: Get a list of AWS services that can send logs to Datadog. operationId: ListAWSLogsServices responses: '200': content: application/json: schema: $ref: '#/components/schemas/AWSLogsServicesResponse' description: AWS Logs Services List object '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get List of Aws Log Ready Services tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - aws_configuration_read x-undo: type: safe x-unstable: '**Note: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).**' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/channel/{tenant_name}/{team_name}/{channel_name}: x-merge-override: get: true get: description: Get the tenant, team, and channel ID of a channel in the Datadog Microsoft Teams integration. operationId: GetChannelByName parameters: - $ref: '#/components/parameters/MicrosoftTeamsTenantNamePathParameter' - $ref: '#/components/parameters/MicrosoftTeamsTeamNamePathParameter' - $ref: '#/components/parameters/MicrosoftTeamsChannelNamePathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsGetChannelByNameResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Channel Information by Name tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/tenant-based-handles: x-merge-override: get: true post: true get: description: Get a list of all tenant-based handles from the Datadog Microsoft Teams integration. operationId: ListTenantBasedHandles parameters: - $ref: '#/components/parameters/MicrosoftTeamsTenantIDQueryParameter' - $ref: '#/components/parameters/MicrosoftTeamsHandleNameQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandlesResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '412': $ref: '#/components/responses/PreconditionFailedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Tenant-based Handles tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/tenant-based-handles/{handle_id}: x-merge-override: delete: true get: true patch: true get: description: Get the tenant, team, and channel information of a tenant-based handle from the Datadog Microsoft Teams integration. operationId: GetTenantBasedHandle parameters: - $ref: '#/components/parameters/MicrosoftTeamsTenantBasedHandleIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '412': $ref: '#/components/responses/PreconditionFailedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Tenant-based Handle Information tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/workflows-webhook-handles: get: description: Get a list of all Workflows webhook handles from the Datadog Microsoft Teams integration. operationId: ListWorkflowsWebhookHandles parameters: - $ref: '#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleNameQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandlesResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '412': $ref: '#/components/responses/PreconditionFailedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Workflows Webhook Handles tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/workflows-webhook-handles/{handle_id}: get: description: Get the name of a Workflows webhook handle from the Datadog Microsoft Teams integration. operationId: GetWorkflowsWebhookHandle parameters: - $ref: '#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '412': $ref: '#/components/responses/PreconditionFailedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Workflows Webhook Handle Information tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/opsgenie/services: x-merge-override: get: true post: true get: description: Get a list of all services from the Datadog Opsgenie integration. operationId: ListOpsgenieServices responses: '200': content: application/json: schema: $ref: '#/components/schemas/OpsgenieServicesResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Service Objects tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/opsgenie/services/{integration_service_id}: x-merge-override: delete: true get: true patch: true get: description: Get a single service from the Datadog Opsgenie integration. operationId: GetOpsgenieService parameters: - $ref: '#/components/parameters/OpsgenieServiceIDPathParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/OpsgenieServiceResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Single Service Object tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integrations/cloudflare/accounts/{account_id}: x-merge-override: delete: true patch: true get: description: Get a Cloudflare account. operationId: GetCloudflareAccount parameters: - description: None in: path name: account_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudflareAccountResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Cloudflare Account tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integrations/confluent-cloud/accounts/{account_id}: x-merge-override: delete: true get: description: Get the Confluent account with the provided account ID. operationId: GetConfluentAccount parameters: - $ref: '#/components/parameters/ConfluentAccountID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ConfluentAccountResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Confluent Account tags: - Get x-menu-order: 7 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integrations/confluent-cloud/accounts/{account_id}/resources/{resource_id}: x-merge-override: delete: true get: description: Get a Confluent resource with the provided resource id for the account associated with the provided account ID. operationId: GetConfluentResource parameters: - $ref: '#/components/parameters/ConfluentAccountID' - $ref: '#/components/parameters/ConfluentResourceID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ConfluentResourceResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Resource from Confluent Account tags: - Get x-menu-order: 2 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integrations/fastly/accounts/{account_id}: x-merge-override: delete: true patch: true get: description: Get a Fastly account. operationId: GetFastlyAccount parameters: - $ref: '#/components/parameters/FastlyAccountID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/FastlyAccountResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Fastly Account tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integrations/fastly/accounts/{account_id}/services/{service_id}: x-merge-override: delete: true get: true patch: true get: description: Get a Fastly service for an account. operationId: GetFastlyService parameters: - $ref: '#/components/parameters/FastlyAccountID' - $ref: '#/components/parameters/FastlyServiceID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/FastlyServiceResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Fastly Service tags: - Get x-menu-order: 8 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integrations/okta/accounts/{account_id}: x-merge-override: delete: true get: true patch: true get: description: Get an Okta account. operationId: GetOktaAccount parameters: - description: None in: path name: account_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/OktaAccountResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Okta Account tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - integrations_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ip_allowlist: get: description: Returns the IP allowlist and its enabled or disabled state. operationId: GetIPAllowlist responses: '200': content: application/json: schema: $ref: '#/components/schemas/IPAllowlistResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Datadog Get Ip Allowlist tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - org_management x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/archive-order: get: description: 'Get the current order of your archives. This endpoint takes no JSON arguments.' operationId: GetLogsArchiveOrder responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsArchiveOrder' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Archive Order tags: - Get x-menu-order: 9 x-permission: operator: OR permissions: - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/archives: get: description: Get the list of configured logs archives with their definitions. operationId: ListLogsArchives responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsArchives' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Archives tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - logs_read_archives x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/archives/{archive_id}: get: description: Get a specific archive from your organization. operationId: GetLogsArchive parameters: - $ref: '#/components/parameters/ArchiveID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsArchive' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get an Archive tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - logs_read_archives x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/custom-destinations: get: description: Get the list of configured custom destinations in your organization with their definitions. operationId: ListLogsCustomDestinations responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationsResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Custom Destinations tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - logs_read_data - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/custom-destinations/{custom_destination_id}: get: description: Get a specific custom destination in your organization. operationId: GetLogsCustomDestination parameters: - $ref: '#/components/parameters/CustomDestinationId' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Custom Destination tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - logs_read_data - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/metrics: get: description: Get the list of configured log-based metrics with their definitions. operationId: ListLogsMetrics responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsMetricsResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Log-based Metrics tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/metrics/{metric_id}: get: description: Get a specific log-based metric from your organization. operationId: GetLogsMetric parameters: - $ref: '#/components/parameters/MetricID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsMetricResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Log-based Metric tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - logs_read_config x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/restriction_queries/role/{role_id}: get: description: Get restriction query for a given role. operationId: GetRoleRestrictionQuery parameters: - $ref: '#/components/parameters/RestrictionQueryRoleID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RestrictionQueryListResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get Restriction Query for a Given Role tags: - Get x-menu-order: 10 x-permission: operator: OR permissions: - logs_read_config x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/restriction_queries/user/{user_id}: get: description: Get all restriction queries for a given user. operationId: ListUserRestrictionQueries parameters: - $ref: '#/components/parameters/RestrictionQueryUserID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RestrictionQueryListResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Restriction Queries for a Given User tags: - Get x-menu-order: 9 x-permission: operator: OR permissions: - logs_read_config x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/restriction_queries/{restriction_query_id}: get: description: Get a restriction query in the organization specified by the restriction query's `restriction_query_id`. operationId: GetRestrictionQuery parameters: - $ref: '#/components/parameters/RestrictionQueryID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RestrictionQueryWithRelationshipsResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Restriction Query tags: - Get x-codegen-request-body-name: body x-menu-order: 3 x-permission: operator: OR permissions: - logs_read_config x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/events: get: description: 'List endpoint returns logs that match a log search query. [Results are paginated][1]. Use this endpoint to search and filter your logs. **If you are considering archiving logs for your organization, consider use of the Datadog archive capabilities instead of the log list API. See [Datadog Logs Archive documentation][2].** [1]: /logs/guide/collect-multiple-logs-with-pagination [2]: https://docs.datadoghq.com/logs/archives' operationId: ListLogsGet parameters: - description: Search query following logs syntax. example: '@datacenter:us @role:db' in: query name: filter[query] required: false schema: type: string - description: 'For customers with multiple indexes, the indexes to search. Defaults to ''*'' which means all indexes' example: - main - web explode: false in: query name: filter[indexes] required: false schema: items: description: The name of a log index. type: string type: array - description: Minimum timestamp for requested logs. example: '2019-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested logs. example: '2019-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: format: date-time type: string - description: Specifies the storage type to be used example: indexes in: query name: filter[storage_tier] required: false schema: $ref: '#/components/schemas/LogsStorageTier' - description: Order of logs in results. in: query name: sort required: false schema: $ref: '#/components/schemas/LogsSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of logs in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Search Logs (get) tags: - Get x-menu-order: 4 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - logs_read_data x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/metrics: get: description: 'Returns all metrics that can be configured in the Metrics Summary page or with Metrics without Limitsâ„¢ (matching additional filters if specified). Optionally, paginate by using the `page[cursor]` and/or `page[size]` query parameters. To fetch the first page, pass in a query parameter with either a valid `page[size]` or an empty cursor like `page[cursor]=`. To fetch the next page, pass in the `next_cursor` value from the response as the new `page[cursor]` value. Once the `meta.pagination.next_cursor` value is null, all pages have been retrieved.' operationId: ListTagConfigurations parameters: - description: Filter custom metrics that have configured tags. example: true in: query name: filter[configured] required: false schema: type: boolean - description: Filter tag configurations by configured tags. example: app in: query name: filter[tags_configured] required: false schema: description: Tag keys to filter by. type: string - description: Filter metrics by metric type. in: query name: filter[metric_type] required: false schema: $ref: '#/components/schemas/MetricTagConfigurationMetricTypeCategory' example: metric alert - description: 'Filter distributions with additional percentile aggregations enabled or disabled.' example: true in: query name: filter[include_percentiles] required: false schema: type: boolean - description: '(Preview) Filter custom metrics that have or have not been queried in the specified window[seconds]. If no window is provided or the window is less than 2 hours, a default of 2 hours will be applied.' example: true in: query name: filter[queried] required: false schema: type: boolean - description: 'Filter metrics that have been submitted with the given tags. Supports boolean and wildcard expressions. Can only be combined with the filter[queried] filter.' example: env IN (staging,test) AND service:web in: query name: filter[tags] required: false schema: type: string - description: (Preview) Filter metrics that are used in dashboards, monitors, notebooks, SLOs. example: true in: query name: filter[related_assets] required: false schema: type: boolean - description: 'The number of seconds of look back (from now) to apply to a filter[tag] or filter[queried] query. Default value is 3600 (1 hour), maximum value is 2,592,000 (30 days).' example: 3600 in: query name: window[seconds] required: false schema: format: int64 type: integer - description: Maximum number of results returned. in: query name: page[size] required: false schema: default: 10000 format: int32 maximum: 10000 minimum: 1 type: integer example: 42 - description: 'String to query the next page of results. This key is provided with each valid response from the API in `meta.pagination.next_cursor`. Once the `meta.pagination.next_cursor` key is null, all pages have been retrieved.' in: query name: page[cursor] required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/MetricsAndMetricTagConfigurationsResponse' description: Success '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: Datadog Get a List of Metrics tags: - Get x-menu-order: 5 x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data x-permission: operator: OR permissions: - metrics_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/notification_rule: get: description: Returns a list of all monitor notification rules. operationId: GetMonitorNotificationRules parameters: - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource path is `created_by`.' in: query name: include required: false schema: example: created_by type: string example: created_by responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorNotificationRuleListResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Datadog Get All Monitor Notification Rules tags: - Get x-menu-order: 15 x-permission: operator: OR permissions: - monitors_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/notification_rule/{rule_id}: get: description: Returns a monitor notification rule by `rule_id`. operationId: GetMonitorNotificationRule parameters: - description: ID of the monitor notification rule to fetch. in: path name: rule_id required: true schema: type: string example: abc-123-def - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource path is `created_by`.' in: query name: include required: false schema: example: created_by type: string example: created_by responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorNotificationRuleResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Datadog Get a Monitor Notification Rule tags: - Get x-menu-order: 14 x-permission: operator: OR permissions: - monitors_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/policy: get: description: Get all monitor configuration policies. operationId: ListMonitorConfigPolicies responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorConfigPolicyListResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Datadog Get All Monitor Configuration Policies tags: - Get x-menu-order: 10 x-permission: operator: OR permissions: - monitors_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/policy/{policy_id}: get: description: Get a monitor configuration policy by `policy_id`. operationId: GetMonitorConfigPolicy parameters: - description: ID of the monitor configuration policy. in: path name: policy_id required: true schema: example: 00000000-0000-1234-0000-000000000000 type: string example: 00000000-0000-1234-0000-000000000000 responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorConfigPolicyResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Datadog Get a Monitor Configuration Policy tags: - Get x-menu-order: 9 x-permission: operator: OR permissions: - monitors_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/{monitor_id}/downtime_matches: get: description: Get all active downtimes for the specified monitor. operationId: ListMonitorDowntimes parameters: - description: The id of the monitor. in: path name: monitor_id required: true schema: format: int64 type: integer example: 42 - $ref: '#/components/parameters/PageOffset' - description: Maximum number of downtimes in the response. example: 100 in: query name: page[limit] required: false schema: default: 30 format: int64 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorDowntimeMatchResponse' description: OK '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Monitor Not Found error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Datadog Get Active Downtimes for a Monitor tags: - Get x-codegen-request-body-name: body x-menu-order: 7 x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-permission: operator: OR permissions: - monitors_downtime x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ndm/devices: get: description: Get the list of devices. operationId: ListDevices parameters: - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - description: The field to sort the devices by. example: status in: query name: sort required: false schema: type: string - description: Filter devices by tag. example: status:ok in: query name: filter[tag] required: false schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListDevicesResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the List of Devices tags: - Get x-menu-order: 1 x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ndm/devices/{device_id}: get: description: Get the device details. operationId: GetDevice parameters: - description: The id of the device to fetch. example: example:1.2.3.4 in: path name: device_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetDeviceResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the Device Details tags: - Get x-menu-order: 2 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ndm/interfaces: get: description: Get the list of interfaces of the device. operationId: GetInterfaces parameters: - description: The ID of the device to get interfaces from. example: example:1.2.3.4 in: query name: device_id required: true schema: type: string - description: Whether to get the IP addresses of the interfaces. example: true in: query name: get_ip_addresses required: false schema: type: boolean responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetInterfacesResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the List of Interfaces of the Device tags: - Get x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/ndm/tags/devices/{device_id}: get: description: Get the list of tags for a device. operationId: ListDeviceUserTags parameters: - description: The id of the device to fetch tags for. example: example:1.2.3.4 in: path name: device_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListTagsResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the List of Tags for a Device tags: - Get x-menu-order: 4 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/network/connections/aggregate: get: description: Get all aggregated connections. operationId: GetAggregatedConnections parameters: - description: Unix timestamp (number of seconds since epoch) of the start of the query window. If not provided, the start of the query window is 15 minutes before the `to` timestamp. If neither `from` nor `to` are provided, the query window is `[now - 15m, now]`. in: query name: from schema: format: int64 type: integer example: 42 - description: Unix timestamp (number of seconds since epoch) of the end of the query window. If not provided, the end of the query window is the current time. If neither `from` nor `to` are provided, the query window is `[now - 15m, now]`. in: query name: to schema: format: int64 type: integer example: 42 - description: Comma-separated list of fields to group connections by. in: query name: group_by schema: type: string example: example_value - description: Comma-separated list of tags to filter connections by. in: query name: tags schema: type: string example: env:production - description: The number of connections to be returned. The maximum value is 5000. in: query name: limit schema: default: 100 format: int32 maximum: 5000 minimum: 1 type: integer example: 42 responses: '200': content: application/json: schema: $ref: '#/components/schemas/SingleAggregatedConnectionResponseArray' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Aggregated Connections tags: - Get x-menu-order: 1 x-undo: type: safe x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/escalation-policies/{policy_id}: get: description: Get an On-Call escalation policy operationId: GetOnCallEscalationPolicy parameters: - description: The ID of the escalation policy in: path name: policy_id required: true schema: example: a3000000-0000-0000-0000-000000000000 type: string example: a3000000-0000-0000-0000-000000000000 - description: 'Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`.' in: query name: include schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/EscalationPolicy' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get On-call Escalation Policy tags: - Get x-menu-order: 7 x-permission: operator: AND permissions: - on_call_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/schedules/{schedule_id}: get: description: Get an On-Call schedule operationId: GetOnCallSchedule parameters: - description: 'Comma-separated list of included relationships to be returned. Allowed values: `teams`, `layers`, `layers.members`, `layers.members.user`.' in: query name: include schema: type: string example: example_value - description: The ID of the schedule in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d responses: '200': content: application/json: schema: $ref: '#/components/schemas/Schedule' description: OK '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get On-call Schedule tags: - Get x-menu-order: 2 x-permission: operator: AND permissions: - on_call_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/schedules/{schedule_id}/on-call: get: description: Retrieves the user who is on-call for the specified schedule at a given time. operationId: GetScheduleOnCallUser parameters: - description: 'Specifies related resources to include in the response as a comma-separated list. Allowed value: `user`.' in: query name: include schema: type: string example: example_value - description: The ID of the schedule. in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d - description: Retrieves the on-call user at the given timestamp (ISO-8601). Defaults to the current time if omitted." in: query name: filter[at_ts] schema: example: '2025-05-07T02:53:01Z' type: string example: '2025-05-07T02:53:01Z' responses: '200': content: application/json: schema: $ref: '#/components/schemas/Shift' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get the Schedule On-call User tags: - Get x-menu-order: 11 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/teams/{team_id}/on-call: get: description: Get a team's on-call users at a given time operationId: GetTeamOnCallUsers parameters: - description: 'Comma-separated list of included relationships to be returned. Allowed values: `responders`, `escalations`, `escalations.responders`.' in: query name: include schema: type: string example: example_value - description: The team ID in: path name: team_id required: true schema: example: 27590dae-47be-4a7d-9abf-8f4e45124020 type: string example: 27590dae-47be-4a7d-9abf-8f4e45124020 responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamOnCallResponders' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get Team On-call Users tags: - Get x-menu-order: 12 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/teams/{team_id}/routing-rules: get: description: Get a team's On-Call routing rules operationId: GetOnCallTeamRoutingRules parameters: - description: The team ID in: path name: team_id required: true schema: example: 27590dae-47be-4a7d-9abf-8f4e45124020 type: string example: 27590dae-47be-4a7d-9abf-8f4e45124020 - description: 'Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`.' in: query name: include schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamRoutingRules' description: OK '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get On-call Team Routing Rules tags: - Get x-menu-order: 9 x-permission: operator: AND permissions: - on_call_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/org_configs/{org_config_name}: get: description: Return the name, description, and value of a specific Org Config. operationId: GetOrgConfig parameters: - $ref: '#/components/parameters/OrgConfigName' responses: '200': content: application/json: schema: $ref: '#/components/schemas/OrgConfigGetResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Specific Org Config Value tags: - Get x-menu-order: 101 x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/posture_management/findings/{finding_id}: get: description: Returns a single finding with message and resource configuration. operationId: GetFinding parameters: - description: The ID of the finding. in: path name: finding_id required: true schema: type: string example: abc-123-def - description: Return the finding for a given snapshot of time (Unix ms). example: 1678721573794 in: query name: snapshot_timestamp required: false schema: format: int64 minimum: 1 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetFindingResponse' description: OK '400': $ref: '#/components/responses/FindingsBadRequestResponse' '403': $ref: '#/components/responses/FindingsForbiddenResponse' '404': $ref: '#/components/responses/FindingsNotFoundResponse' '429': $ref: '#/components/responses/FindingsTooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Datadog Get a Finding tags: - Get x-menu-order: 2 x-undo: type: safe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/powerpacks: get: description: Get a list of all powerpacks. operationId: ListPowerpacks parameters: - description: Maximum number of powerpacks in the response. example: 25 in: query name: page[limit] required: false schema: default: 25 format: int64 maximum: 1000 type: integer - $ref: '#/components/parameters/PageOffset' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListPowerpacksResponse' description: OK '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Datadog Get All Powerpacks tags: - Get x-menu-order: 1 x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-permission: operator: OR permissions: - dashboards_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/powerpacks/{powerpack_id}: x-merge-override: delete: true get: description: Get a powerpack. operationId: GetPowerpack parameters: - description: ID of the powerpack. in: path name: powerpack_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/PowerpackResponse' description: OK '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Powerpack Not Found. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Datadog Get a Powerpack tags: - Get x-menu-order: 4 x-permission: operator: OR permissions: - dashboards_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/processes: get: description: Get all processes for your organization. operationId: ListProcesses parameters: - description: String to search processes by. in: query name: search required: false schema: type: string example: example_value - description: Comma-separated list of tags to filter processes by. example: account:prod,user:admin in: query name: tags required: false schema: type: string - description: 'Unix timestamp (number of seconds since epoch) of the start of the query window. If not provided, the start of the query window will be 15 minutes before the `to` timestamp. If neither `from` nor `to` are provided, the query window will be `[now - 15m, now]`.' in: query name: from required: false schema: format: int64 type: integer example: 42 - description: 'Unix timestamp (number of seconds since epoch) of the end of the query window. If not provided, the end of the query window will be 15 minutes after the `from` timestamp. If neither `from` nor `to` are provided, the query window will be `[now - 15m, now]`.' in: query name: to required: false schema: format: int64 type: integer example: 42 - description: Maximum number of results returned. in: query name: page[limit] required: false schema: default: 1000 format: int32 maximum: 10000 minimum: 1 type: integer example: 42 - description: 'String to query the next page of results. This key is provided with each valid response from the API in `meta.page.after`.' in: query name: page[cursor] required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/ProcessSummariesResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get All Processes tags: - Get x-menu-order: 1 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}: get: description: Retrieve a WAF custom rule by ID. operationId: GetApplicationSecurityWafCustomRule parameters: - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Waf Custom Rule tags: - Get x-menu-order: 10 x-terraform-resource: appsec_waf_custom_rule x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/asm/waf/exclusion_filters/{exclusion_filter_id}: get: description: Retrieve a specific WAF exclusion filter using its identifier. operationId: GetApplicationSecurityWafExclusionFilter parameters: - $ref: '#/components/parameters/ApplicationSecurityWafExclusionFilterID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Waf Exclusion Filter tags: - Get x-menu-order: 1 x-permission: operator: AND permissions: - appsec_protect_read x-terraform-resource: appsec_waf_exclusion_filter x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/cws/agent_rules: get: description: 'Get the list of Workload Protection agent rules. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.' operationId: ListCSMThreatsAgentRules parameters: - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Workload Protection Agent Rules tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}: get: description: 'Get the details of a specific Workload Protection agent rule. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.' operationId: GetCSMThreatsAgentRule parameters: - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID' - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Workload Protection Agent Rule tags: - Get x-menu-order: 2 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/cws/policy: get: description: 'Get the list of Workload Protection policies. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.' operationId: ListCSMThreatsAgentPolicies responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPoliciesListResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Workload Protection Policies tags: - Get x-menu-order: 6 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/cws/policy/{policy_id}: get: description: 'Get the details of a specific Workload Protection policy. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.' operationId: GetCSMThreatsAgentPolicy parameters: - $ref: '#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Workload Protection Policy tags: - Get x-menu-order: 7 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/obs_pipelines/pipelines/{pipeline_id}: get: description: Get a specific pipeline by its ID. operationId: GetPipeline parameters: - description: The ID of the pipeline to retrieve. in: path name: pipeline_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/ObservabilityPipeline' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Specific Pipeline tags: - Get x-menu-order: 2 x-permission: operator: OR permissions: - observability_pipelines_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in Preview.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/restriction_policy/{resource_id}: get: description: Retrieves the restriction policy associated with a specified resource. operationId: GetRestrictionPolicy parameters: - $ref: '#/components/parameters/ResourceID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RestrictionPolicyResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get a Restriction Policy tags: - Get x-menu-order: 2 x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/roles/{role_id}: x-merge-override: delete: true patch: true get: description: Get a role in the organization specified by the role’s `role_id`. operationId: GetRole parameters: - $ref: '#/components/parameters/RoleID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RoleResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Datadog Get a Role tags: - Get x-codegen-request-body-name: body x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/roles/{role_id}/users: get: description: Gets all users of a role. operationId: ListRoleUsers parameters: - $ref: '#/components/parameters/RoleID' - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - description: 'User attribute to order results by. Sort order is **ascending** by default. Sort order is **descending** if the field is prefixed by a negative sign, for example `sort=-name`. Options: `name`, `email`, `status`.' in: query name: sort required: false schema: default: name type: string example: example_value - description: Filter all users by the given string. Defaults to no filtering. in: query name: filter required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/UsersResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Datadog Get All Users of a Role tags: - Get x-menu-order: 9 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/applications/{app_id}/retention_filters: get: description: Get the list of RUM retention filters for a RUM application. operationId: ListRetentionFilters parameters: - $ref: '#/components/parameters/RumApplicationIDParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RumRetentionFiltersResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Rum Retention Filters tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/applications/{app_id}/retention_filters/{rf_id}: get: description: Get a RUM retention filter for a RUM application. operationId: GetRetentionFilter parameters: - $ref: '#/components/parameters/RumApplicationIDParameter' - $ref: '#/components/parameters/RumRetentionFilterIDParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RumRetentionFilterResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Rum Retention Filter tags: - Get x-menu-order: 2 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/applications/{id}: x-merge-override: delete: true get: false patch: false get: description: Get the RUM application with given ID in your organization. operationId: GetRUMApplication parameters: - description: RUM application ID. in: path name: id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/RUMApplicationResponse' description: OK '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Rum Application tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - rum_apps_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/config/metrics: get: description: Get the list of configured rum-based metrics with their definitions. operationId: ListRumMetrics responses: '200': content: application/json: schema: $ref: '#/components/schemas/RumMetricsResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Rum-based Metrics tags: - Get x-menu-order: 1 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/config/metrics/{metric_id}: get: description: Get a specific rum-based metric from your organization. operationId: GetRumMetric parameters: - $ref: '#/components/parameters/RumMetricIDParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RumMetricResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Rum-based Metric tags: - Get x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/events: get: description: 'List endpoint returns events that match a RUM search query. [Results are paginated][1]. Use this endpoint to see your latest RUM events. [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination' operationId: ListRUMEvents parameters: - description: Search query following RUM syntax. example: '@type:session @application_id:xxxx' in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: '2019-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: '2019-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: '#/components/schemas/RUMSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/RUMEventsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get a List of Rum Events tags: - Get x-menu-order: 2 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/scim/Groups/{group_id}: get: description: Get a single group using the `group_id`. operationId: GetSCIMGroup parameters: - description: None in: path name: group_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/ExternalUserGroup' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - bearerAuth: [] summary: Datadog Get Group tags: - Get x-menu-order: 9 x-permission: operator: AND permissions: - user_access_invite - user_access_manage x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/scim/Users/{user_uuid}: get: description: Get a single user using the `user_uuid`. operationId: GetSCIMUser parameters: - description: None in: path name: user_uuid required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/ExternalUser' description: OK '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - bearerAuth: [] summary: Datadog Get User tags: - Get x-menu-order: 3 x-permission: operator: AND permissions: - user_access_invite - user_access_manage x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/sboms/{asset_type}: get: description: 'Get a single SBOM related to an asset by its type and name. ' operationId: GetSBOM parameters: - description: The type of the asset for the SBOM request. example: Repository in: path name: asset_type required: true schema: $ref: '#/components/schemas/AssetType' - description: The name of the asset for the SBOM request. example: github.com/datadog/datadog-agent in: query name: filter[asset_name] required: true schema: type: string - description: The container image `repo_digest` for the SBOM request. When the requested asset type is 'Image', this filter is mandatory. example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7 in: query name: filter[repo_digest] required: false schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetSBOMResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Bad request: The server cannot process the request due to invalid syntax in the request.' '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Forbidden: Access denied' '404': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Not found: asset not found' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - appsec_vm_read summary: Datadog Get Sbom tags: - Get x-menu-order: 27 x-undo: type: safe x-unstable: '**Note**: This endpoint is a private preview. If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/signals/notification_rules: get: description: Returns the list of notification rules for security signals. operationId: GetSignalNotificationRules responses: '200': $ref: '#/components/responses/NotificationRulesList' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_read summary: Datadog Get the List of Signal-based Notification Rules tags: - Get x-menu-order: 15 x-permission: operator: OR permissions: - security_monitoring_notification_profiles_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/signals/notification_rules/{id}: get: description: Get the details of a notification rule for security signals. operationId: GetSignalNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/NotificationRuleResponse' description: Notification rule details. '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_read summary: Datadog Get Details of a Signal-based Notification Rule tags: - Get x-menu-order: 18 x-permission: operator: OR permissions: - security_monitoring_notification_profiles_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/vulnerabilities/notification_rules: get: description: Returns the list of notification rules for security vulnerabilities. operationId: GetVulnerabilityNotificationRules responses: '200': $ref: '#/components/responses/NotificationRulesList' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_read summary: Datadog Get the List of Vulnerability Notification Rules tags: - Get x-menu-order: 15 x-permission: operator: OR permissions: - security_monitoring_notification_profiles_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/vulnerabilities/notification_rules/{id}: get: description: Get the details of a notification rule for security vulnerabilities. operationId: GetVulnerabilityNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/NotificationRuleResponse' description: Notification rule details. '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_read summary: Datadog Get Details of a Vulnerability Notification Rule tags: - Get x-menu-order: 18 x-permission: operator: OR permissions: - security_monitoring_notification_profiles_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/cloud_workload_security/agent_rules: get: description: 'Get the list of agent rules. **Note**: This endpoint should only be used for the Government (US1-FED) site.' operationId: ListCloudWorkloadSecurityAgentRules responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get All Workload Protection Agent Rules (us1-fed) tags: - Get x-menu-order: 12 x-permission: operator: OR permissions: - security_monitoring_cws_agent_rules_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}: get: description: 'Get the details of a specific agent rule. **Note**: This endpoint should only be used for the Government (US1-FED) site.' operationId: GetCloudWorkloadSecurityAgentRule parameters: - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Workload Protection Agent Rule (us1-fed) tags: - Get x-menu-order: 13 x-permission: operator: OR permissions: - security_monitoring_cws_agent_rules_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/configuration/security_filters: get: description: Get the list of configured security filters with their definitions. operationId: ListSecurityFilters responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityFiltersResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: Datadog Get All Security Filters tags: - Get x-menu-order: 18 x-permission: operator: OR permissions: - security_monitoring_filters_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/configuration/security_filters/{security_filter_id}: get: description: 'Get the details of a specific security filter. See the [security filter guide](https://docs.datadoghq.com/security_platform/guide/how-to-setup-security-filters-using-security-monitoring-api/) for more examples.' operationId: GetSecurityFilter parameters: - $ref: '#/components/parameters/SecurityFilterID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityFilterResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: Datadog Get a Security Filter tags: - Get x-menu-order: 16 x-permission: operator: OR permissions: - security_monitoring_filters_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/configuration/suppressions: get: description: Get the list of all suppression rules. operationId: ListSecurityMonitoringSuppressions responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSuppressionsResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Datadog Get All Suppression Rules tags: - Get x-menu-order: 0 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/configuration/suppressions/{suppression_id}: get: description: Get the details of a specific suppression rule. operationId: GetSecurityMonitoringSuppression parameters: - $ref: '#/components/parameters/SecurityMonitoringSuppressionID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Datadog Get a Suppression Rule tags: - Get x-menu-order: 0 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/rules/{rule_id}: get: description: Get a rule's details. operationId: GetSecurityMonitoringRule parameters: - $ref: '#/components/parameters/SecurityMonitoringRuleID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringRuleResponse' description: OK '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Datadog Get a Rule's Details tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - security_monitoring_rules_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/rules/{rule_id}/version_history: get: description: Get a rule's version history. operationId: GetRuleVersionHistory parameters: - $ref: '#/components/parameters/SecurityMonitoringRuleID' - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetRuleVersionHistoryResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get a Rule's Version History tags: - Get x-menu-order: 25 x-permission: operator: OR permissions: - security_monitoring_rules_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/signals: get: description: 'The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.' operationId: ListSecurityMonitoringSignals parameters: - description: The search query for security signals. example: security:attack status:high in: query name: filter[query] required: false schema: type: string - description: The minimum timestamp for requested security signals. example: '2019-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: format: date-time type: string - description: The maximum timestamp for requested security signals. example: '2019-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: format: date-time type: string - description: The order of the security signals in results. in: query name: sort required: false schema: $ref: '#/components/schemas/SecurityMonitoringSignalsSort' example: example_value - description: A list of results using the cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: The maximum number of security signals in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Datadog Get a Quick List of Security Signals tags: - Get x-menu-order: 14 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - security_monitoring_signals_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/signals/search: post: description: 'Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.' operationId: SearchSecurityMonitoringSignals requestBody: content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSignalListRequest' required: false responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Datadog Get a List of Security Signals tags: - Get x-codegen-request-body-name: body x-menu-order: 13 x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data x-permission: operator: OR permissions: - security_monitoring_signals_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/signals/{signal_id}: get: description: Get a signal's details. operationId: GetSecurityMonitoringSignal parameters: - $ref: '#/components/parameters/SignalID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSignalResponse' description: OK '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Datadog Get a Signal's Details tags: - Get x-menu-order: 13 x-permission: operator: OR permissions: - security_monitoring_signals_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/service_accounts/{service_account_id}/application_keys/{app_key_id}: x-merge-override: delete: true get: description: Get an application key owned by this service account. operationId: GetServiceAccountApplicationKey parameters: - $ref: '#/components/parameters/ServiceAccountID' - $ref: '#/components/parameters/ApplicationKeyID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/PartialApplicationKeyResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get One Application Key for This Service Account tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - service_account_write x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/services: get: deprecated: true description: Get all incident services uploaded for the requesting user's organization. If the `include[users]` query parameter is provided, the included attribute will contain the users related to these incident services. operationId: ListIncidentServices parameters: - $ref: '#/components/parameters/IncidentServiceIncludeQueryParameter' - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageOffset' - $ref: '#/components/parameters/IncidentServiceSearchQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentServicesResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get a List of All Incident Services tags: - Get x-menu-order: 4 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is deprecated.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/services/definitions: get: description: Get a list of all service definitions from the Datadog Service Catalog. operationId: ListServiceDefinitions parameters: - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - $ref: '#/components/parameters/SchemaVersion' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ServiceDefinitionsListResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Datadog Get All Service Definitions tags: - Get x-menu-order: 1 x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - apm_service_catalog_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/services/definitions/{service_name}: get: description: Get a single service definition from the Datadog Service Catalog. operationId: GetServiceDefinition parameters: - $ref: '#/components/parameters/ServiceName' - $ref: '#/components/parameters/SchemaVersion' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ServiceDefinitionGetResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Datadog Get a Single Service Definition tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - apm_service_catalog_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/services/{service_id}: get: deprecated: true description: 'Get details of an incident service. If the `include[users]` query parameter is provided, the included attribute will contain the users related to these incident services.' operationId: GetIncidentService parameters: - $ref: '#/components/parameters/IncidentServiceIDPathParameter' - $ref: '#/components/parameters/IncidentServiceIncludeQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentServiceResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get Details of an Incident Service tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is deprecated.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/siem-historical-detections/jobs/{job_id}: get: description: Get a job's details. operationId: GetHistoricalJob parameters: - $ref: '#/components/parameters/HistoricalJobID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/HistoricalJobResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Datadog Get a Job's Details tags: - Get x-menu-order: 21 x-permission: operator: OR permissions: - security_monitoring_rules_read x-undo: type: safe x-unstable: '**Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/slo/report/{report_id}/download: get: description: 'Download an SLO report. This can only be performed after the report job has completed. Reports are not guaranteed to exist indefinitely. Datadog recommends that you download the report as soon as it is available.' operationId: GetSLOReport parameters: - $ref: '#/components/parameters/ReportID' responses: '200': content: text/csv: schema: type: string description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Datadog Get Slo Report tags: - Get x-menu-order: 103 x-undo: type: safe x-unstable: '**Note**: This feature is in private beta. To request access, use the request access form in the [Service Level Objectives](https://docs.datadoghq.com/service_management/service_level_objectives/#slo-csv-export) docs.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/slo/report/{report_id}/status: get: description: Get the status of the SLO report job. operationId: GetSLOReportJobStatus parameters: - $ref: '#/components/parameters/ReportID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/SLOReportStatusGetResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Datadog Get Slo Report Status tags: - Get x-menu-order: 102 x-undo: type: safe x-unstable: '**Note**: This feature is in private beta. To request access, use the request access form in the [Service Level Objectives](https://docs.datadoghq.com/service_management/service_level_objectives/#slo-csv-export) docs.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/spans/events: get: description: 'List endpoint returns spans that match a span search query. [Results are paginated][1]. Use this endpoint to see your latest spans. This endpoint is rate limited to `300` requests per hour. [1]: /logs/guide/collect-multiple-logs-with-pagination?tab=v2api' operationId: ListSpansGet parameters: - description: Search query following spans syntax. example: '@datacenter:us @role:db' in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested spans. Supports date-time ISO8601, date math, and regular timestamps (milliseconds). example: '2023-01-02T09:42:36.320Z' in: query name: filter[from] required: false schema: type: string - description: Maximum timestamp for requested spans. Supports date-time ISO8601, date math, and regular timestamps (milliseconds). example: '2023-01-03T09:42:36.320Z' in: query name: filter[to] required: false schema: type: string - description: Order of spans in results. in: query name: sort required: false schema: $ref: '#/components/schemas/SpansSort' example: example_value - description: List following results with a cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string - description: Maximum number of spans in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/SpansListResponse' description: OK '400': $ref: '#/components/responses/SpansBadRequestResponse' '403': $ref: '#/components/responses/SpansForbiddenResponse' '422': $ref: '#/components/responses/SpansUnprocessableEntityResponse' '429': $ref: '#/components/responses/SpansTooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Datadog Get a List of Spans tags: - Get x-menu-order: 1 x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/synthetics/settings/on_demand_concurrency_cap: get: description: Get the on-demand concurrency cap. operationId: GetOnDemandConcurrencyCap responses: '200': content: application/json: schema: $ref: '#/components/schemas/OnDemandConcurrencyCapResponse' description: OK '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Get the On-demand Concurrency Cap tags: - Get x-menu-order: 10 x-permission: operator: OR permissions: - billing_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team: x-merge-override: get: false post: false get: description: 'Get all teams. Can be used to search for teams using the `filter[keyword]` and `filter[me]` query parameters.' operationId: ListTeams parameters: - $ref: '#/components/parameters/PageNumber' - $ref: '#/components/parameters/PageSize' - description: Specifies the order of the returned teams in: query name: sort required: false schema: $ref: '#/components/schemas/ListTeamsSort' example: example_value - description: 'Included related resources optionally requested. Allowed enum values: `team_links, user_team_permissions`' in: query name: include required: false schema: items: $ref: '#/components/schemas/ListTeamsInclude' type: array - description: Search query. Can be team name, team handle, or email of team member in: query name: filter[keyword] required: false schema: type: string example: example_value - description: When true, only returns teams the current user belongs to in: query name: filter[me] required: false schema: type: boolean example: true - description: List of fields that need to be fetched. explode: false in: query name: fields[team] required: false schema: items: $ref: '#/components/schemas/TeamsField' type: array responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamsResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get All Teams tags: - Get x-menu-order: 1 x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team/{team_id}: x-merge-override: delete: true get: false patch: false get: description: Get a single team using the team's `id`. operationId: GetTeam parameters: - description: None in: path name: team_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get a Team tags: - Get x-menu-order: 3 x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team/{team_id}/links: get: description: Get all links for a given team. operationId: GetTeamLinks parameters: - description: None in: path name: team_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamLinksResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get Links for a Team tags: - Get x-menu-order: 10 x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team/{team_id}/links/{link_id}: get: description: Get a single link for a team. operationId: GetTeamLink parameters: - description: None in: path name: team_id required: true schema: type: string example: abc-123-def - description: None in: path name: link_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamLinkResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get a Team Link tags: - Get x-menu-order: 12 x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team/{team_id}/memberships: get: description: Get a paginated list of members for a team operationId: GetTeamMemberships parameters: - description: None in: path name: team_id required: true schema: type: string example: abc-123-def - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageNumber' - description: Specifies the order of returned team memberships in: query name: sort required: false schema: $ref: '#/components/schemas/GetTeamMembershipsSort' example: example_value - description: Search query, can be user email or name in: query name: filter[keyword] required: false schema: type: string example: example_value responses: '200': content: application/json: schema: $ref: '#/components/schemas/UserTeamsResponse' description: Represents a user's association to a team '403': $ref: '#/components/responses/ForbiddenResponse' '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get Team Memberships tags: - Get x-menu-order: 6 x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team/{team_id}/permission-settings: get: description: Get all permission settings for a given team. operationId: GetTeamPermissionSettings parameters: - description: None in: path name: team_id required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamPermissionSettingsResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get Permission Settings for a Team tags: - Get x-menu-order: 17 x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/teams: get: deprecated: true description: Get all incident teams for the requesting user's organization. If the `include[users]` query parameter is provided, the included attribute will contain the users related to these incident teams. operationId: ListIncidentTeams parameters: - $ref: '#/components/parameters/IncidentTeamIncludeQueryParameter' - $ref: '#/components/parameters/PageSize' - $ref: '#/components/parameters/PageOffset' - $ref: '#/components/parameters/IncidentTeamSearchQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentTeamsResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get a List of All Incident Teams tags: - Get x-menu-order: 4 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/teams/{team_id}: get: deprecated: true description: 'Get details of an incident team. If the `include[users]` query parameter is provided, the included attribute will contain the users related to these incident teams.' operationId: GetIncidentTeam parameters: - $ref: '#/components/parameters/IncidentTeamIDPathParameter' - $ref: '#/components/parameters/IncidentTeamIncludeQueryParameter' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentTeamResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Datadog Get Details of an Incident Team tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - incident_read x-undo: type: safe x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/application_security: get: deprecated: true description: 'Get hourly usage for application security . **Note:** This endpoint has been deprecated. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family)' operationId: GetUsageApplicationSecurityMonitoring parameters: - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour.' in: query name: start_hr required: true schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending **before** this hour.' in: query name: end_hr required: false schema: format: date-time type: string example: example_value responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/UsageApplicationSecurityMonitoringResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Hourly Usage for Application Security tags: - Get x-menu-order: 38 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/billing_dimension_mapping: get: description: 'Get a mapping of billing dimensions to the corresponding keys for the supported usage metering public API endpoints. Mapping data is updated on a monthly cadence. This endpoint is only accessible to [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/).' operationId: GetBillingDimensionMapping parameters: - description: Datetime in ISO-8601 format, UTC, and for mappings beginning this month. Defaults to the current month. in: query name: filter[month] required: false schema: format: date-time type: string example: example_value - description: String to specify whether to retrieve active billing dimension mappings for the contract or for all available mappings. Allowed views have the string `active` or `all`. Defaults to `active`. in: query name: filter[view] required: false schema: default: active type: string example: example_value responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/BillingDimensionsMappingResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Billing Dimension Mapping for Usage Endpoints tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/cost_by_org: get: deprecated: true description: 'Get cost across multi-org account. Cost by org data for a given month becomes available no later than the 16th of the following month. **Note:** This endpoint has been deprecated. Please use the new endpoint [`/historical_cost`](https://docs.datadoghq.com/api/latest/usage-metering/#get-historical-cost-across-your-account) instead. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/).' operationId: GetCostByOrg parameters: - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month.' in: query name: start_month required: true schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month.' in: query name: end_month required: false schema: format: date-time type: string example: example_value responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/CostByOrgResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Cost Across Multi-org Account tags: - Get x-menu-order: 45 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/estimated_cost: get: description: 'Get estimated cost across multi-org and single root-org accounts. Estimated cost data is only available for the current month and previous month and is delayed by up to 72 hours from when it was incurred. To access historical costs prior to this, use the `/historical_cost` endpoint. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/).' operationId: GetEstimatedCostByOrg parameters: - description: String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`. in: query name: view required: false schema: type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month. **Either start_month or start_date should be specified, but not both.** (start_month cannot go beyond two months in the past). Provide an `end_month` to view month-over-month cost.' in: query name: start_month required: false schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month.' in: query name: end_month required: false schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to day: `[YYYY-MM-DD]` for cost beginning this day. **Either start_month or start_date should be specified, but not both.** (start_date cannot go beyond two months in the past). Provide an `end_date` to view day-over-day cumulative cost.' in: query name: start_date required: false schema: format: date-time type: string example: '2026-04-17T12:00:00Z' - description: 'Datetime in ISO-8601 format, UTC, precise to day: `[YYYY-MM-DD]` for cost ending this day.' in: query name: end_date required: false schema: format: date-time type: string example: '2026-04-17T12:00:00Z' - description: 'Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`. ' in: query name: include_connected_accounts required: false schema: default: false type: boolean example: true responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/CostByOrgResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Estimated Cost Across Your Account tags: - Get x-menu-order: 6 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/historical_cost: get: description: 'Get historical cost across multi-org and single root-org accounts. Cost data for a given month becomes available no later than the 16th of the following month. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/).' operationId: GetHistoricalCostByOrg parameters: - description: String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`. in: query name: view required: false schema: type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month.' in: query name: start_month required: true schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month.' in: query name: end_month required: false schema: format: date-time type: string example: example_value - description: 'Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`. ' in: query name: include_connected_accounts required: false schema: default: false type: boolean example: true responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/CostByOrgResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Historical Cost Across Your Account tags: - Get x-menu-order: 5 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/hourly_usage: get: description: Get hourly usage by product family. operationId: GetHourlyUsage parameters: - description: 'Datetime in ISO-8601 format, UTC, precise to hour: [YYYY-MM-DDThh] for usage beginning at this hour.' in: query name: filter[timestamp][start] required: true schema: format: date-time type: string example: '2026-04-17T12:00:00Z' - description: 'Datetime in ISO-8601 format, UTC, precise to hour: [YYYY-MM-DDThh] for usage ending **before** this hour.' in: query name: filter[timestamp][end] required: false schema: format: date-time type: string example: '2026-04-17T12:00:00Z' - description: 'Comma separated list of product families to retrieve. Available families are `all`, `analyzed_logs`, `application_security`, `audit_trail`, `serverless`, `ci_app`, `cloud_cost_management`, `cloud_siem`, `csm_container_enterprise`, `csm_host_enterprise`, `cspm`, `custom_events`, `cws`, `dbm`, `error_tracking`, `fargate`, `infra_hosts`, `incident_management`, `indexed_logs`, `indexed_spans`, `ingested_spans`, `iot`, `lambda_traced_invocations`, `logs`, `network_flows`, `network_hosts`, `network_monitoring`, `observability_pipelines`, `online_archive`, `profiling`, `rum`, `rum_browser_sessions`, `rum_mobile_sessions`, `sds`, `snmp`, `software_delivery`, `synthetics_api`, `synthetics_browser`, `synthetics_mobile`, `synthetics_parallel_testing`, `timeseries`, `vuln_management`, and `workflow_executions`. The following product family has been **deprecated**: `audit_logs`.' in: query name: filter[product_families] required: true schema: type: string example: example_value - description: Include child org usage in the response. Defaults to false. in: query name: filter[include_descendants] required: false schema: default: false type: boolean example: true - description: Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to false. in: query name: filter[include_connected_accounts] required: false schema: default: false type: boolean example: true - description: Include breakdown of usage by subcategories where applicable (for product family logs only). Defaults to false. in: query name: filter[include_breakdown] required: false schema: default: false type: boolean example: true - description: 'Comma separated list of product family versions to use in the format `product_family:version`. For example, `infra_hosts:1.0.0`. If this parameter is not used, the API will use the latest version of each requested product family. Currently all families have one version `1.0.0`.' in: query name: filter[versions] required: false schema: type: string example: example_value - description: Maximum number of results to return (between 1 and 500) - defaults to 500 if limit not specified. in: query name: page[limit] required: false schema: default: 500 format: int32 maximum: 500 minimum: 1 type: integer example: 42 - description: List following results with a next_record_id provided in the previous query. in: query name: page[next_record_id] required: false schema: type: string example: abc-123-def responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/HourlyUsageResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Hourly Usage by Product Family tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/lambda_traced_invocations: get: deprecated: true description: 'Get hourly usage for Lambda traced invocations. **Note:** This endpoint has been deprecated.. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family)' operationId: GetUsageLambdaTracedInvocations parameters: - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour.' in: query name: start_hr required: true schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending **before** this hour.' in: query name: end_hr required: false schema: format: date-time type: string example: example_value responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/UsageLambdaTracedInvocationsResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Hourly Usage for Lambda Traced Invocations tags: - Get x-menu-order: 37 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/observability_pipelines: get: deprecated: true description: 'Get hourly usage for observability pipelines. **Note:** This endpoint has been deprecated. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family)' operationId: GetUsageObservabilityPipelines parameters: - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour.' in: query name: start_hr required: true schema: format: date-time type: string example: example_value - description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending **before** this hour.' in: query name: end_hr required: false schema: format: date-time type: string example: example_value responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/UsageObservabilityPipelinesResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Hourly Usage for Observability Pipelines tags: - Get x-menu-order: 39 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/usage/projected_cost: get: description: 'Get projected cost across multi-org and single root-org accounts. Projected cost data is only available for the current month and becomes available around the 12th of the month. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/).' operationId: GetProjectedCost parameters: - description: String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`. in: query name: view required: false schema: type: string example: example_value - description: 'Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`. ' in: query name: include_connected_accounts required: false schema: default: false type: boolean example: true responses: '200': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/ProjectedCostResponse' description: OK '400': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden - User is not authorized '429': content: application/json;datetime-format=rfc3339: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Datadog Get Projected Cost Across Your Account tags: - Get x-menu-order: 7 x-permission: operator: OR permissions: - usage_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/user_invitations/{user_invitation_uuid}: get: description: Returns a single user invitation by its UUID. operationId: GetInvitation parameters: - description: The UUID of the user invitation. in: path name: user_invitation_uuid required: true schema: example: 00000000-0000-0000-3456-000000000000 type: string example: 00000000-0000-0000-3456-000000000000 responses: '200': content: application/json: schema: $ref: '#/components/schemas/UserInvitationResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_invite summary: Datadog Get a User Invitation tags: - Get x-codegen-request-body-name: body x-menu-order: 9 x-permission: operator: OR permissions: - user_access_invite x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/users/{user_id}: x-merge-override: delete: true get: description: Get a user in the organization specified by the user’s `user_id`. operationId: GetUser parameters: - $ref: '#/components/parameters/UserID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/UserResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Datadog Get User Details tags: - Get x-codegen-request-body-name: body x-menu-order: 3 x-permission: operator: OR permissions: - user_access_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/users/{user_id}/orgs: get: description: 'Get a user organization. Returns the user information and all organizations joined by this user.' operationId: ListUserOrganizations parameters: - $ref: '#/components/parameters/UserID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/UserResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Get a User Organization tags: - Get x-codegen-request-body-name: body x-menu-order: 6 x-permission: operator: OPEN permissions: [] x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/users/{user_id}/permissions: x-merge-override: get: true get: description: 'Get a user permission set. Returns a list of the user’s permissions granted by the associated user''s roles.' operationId: ListUserPermissions parameters: - $ref: '#/components/parameters/UserID' responses: '200': content: application/json: schema: $ref: '#/components/schemas/PermissionsResponse' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Datadog Get a User Permissions tags: - Get x-codegen-request-body-name: body x-menu-order: 7 x-permission: operator: OR permissions: - user_access_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/users/{user_uuid}/memberships: get: description: Get a list of memberships for a user operationId: GetUserMemberships parameters: - description: None in: path name: user_uuid required: true schema: type: string example: abc-123-def responses: '200': content: application/json: schema: $ref: '#/components/schemas/UserTeamsResponse' description: Represents a user's association to a team '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Get User Memberships tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - teams_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/workflows/{workflow_id}: get: description: Get a workflow by ID. This API requires an application key scoped with the `workflows_read` permission. operationId: GetWorkflow parameters: - $ref: '#/components/parameters/WorkflowId' responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetWorkflowResponse' description: Successfully got a workflow. '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Not found '429': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Too many requests summary: Datadog Get an Existing Workflow tags: - Get x-menu-order: 1 x-permission: operator: OR permissions: - workflows_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/workflows/{workflow_id}/instances/{instance_id}: get: description: Get a specific execution of a given workflow. This API requires an application key scoped with the workflows_read permission. operationId: GetWorkflowInstance parameters: - $ref: '#/components/parameters/WorkflowId' - $ref: '#/components/parameters/InstanceId' responses: '200': content: application/json: schema: $ref: '#/components/schemas/WorklflowGetInstanceResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workflows_read summary: Datadog Get a Workflow Instance tags: - Get x-menu-order: 7 x-permission: operator: OR permissions: - workflows_read x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: ServiceDefinitionV2: description: Service definition V2 for providing service metadata and integrations. properties: contacts: description: A list of contacts related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Contact' type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string dd-team: description: Experimental feature. A Team handle that matches a Team in the Datadog Teams product. example: my-team type: string docs: description: A list of documentation related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Doc' type: array extensions: additionalProperties: {} description: Extensions to V2 schema. example: myorg/extension: extensionValue type: object integrations: $ref: '#/components/schemas/ServiceDefinitionV2Integrations' links: description: A list of links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Link' type: array repos: description: A list of code repositories related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Repo' type: array schema-version: $ref: '#/components/schemas/ServiceDefinitionV2Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array team: description: Team that owns the service. example: my-team type: string required: - schema-version - dd-service type: object ScheduleMemberRelationshipsUserDataType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS LogsArchiveDestinationAzure: description: The Azure archive destination. properties: container: description: The container where the archive will be stored. example: container-name type: string integration: $ref: '#/components/schemas/LogsArchiveIntegrationAzure' path: description: The archive path. type: string example: example_value region: description: The region where the archive will be stored. type: string example: example_value storage_account: description: The associated storage account. example: account-name type: string type: $ref: '#/components/schemas/LogsArchiveDestinationAzureType' required: - storage_account - container - integration - type type: object ContainerImageFlavor: description: Container Image breakdown by supported platform. properties: built_at: description: Time the platform-specific Container Image was built. type: string example: example_value os_architecture: description: Operating System architecture supported by the Container Image. type: string example: example_value os_name: description: Operating System name supported by the Container Image. type: string example: Example Monitor os_version: description: Operating System version supported by the Container Image. type: string example: example_value size: description: Size of the platform-specific Container Image. format: int64 type: integer example: 42 type: object SecurityMonitoringSignalType: default: signal description: The type of event. enum: - signal example: signal type: string x-enum-varnames: - SIGNAL ActionQueryCondition: description: Whether to run this query. If specified, the query will only run if this condition evaluates to `true` in JavaScript and all other conditions are also met. oneOf: - type: boolean - example: ${true} type: string ServiceDefinitionV2Dot1SlackType: description: Contact type. enum: - slack example: slack type: string x-enum-varnames: - SLACK OrganizationAttributes: description: Attributes of the organization. properties: created_at: description: Creation time of the organization. format: date-time type: string example: example_value description: description: Description of the organization. type: string example: example_value disabled: description: Whether or not the organization is disabled. type: boolean example: true modified_at: description: Time of last organization modification. format: date-time type: string example: example_value name: description: Name of the organization. type: string example: Example Monitor public_id: description: Public ID of the organization. type: string example: abc-123-def sharing: description: Sharing type of the organization. type: string example: example_value url: description: URL of the site that this organization exists at. type: string example: https://app.datadoghq.com type: object ListTagsResponse: description: List tags response. properties: data: $ref: '#/components/schemas/ListTagsResponseData' type: object OrgConfigReadAttributes: description: Readable attributes of an Org Config. properties: description: description: The description of an Org Config. example: Frobulate the turbo encabulator manifold type: string modified_at: description: The timestamp of the last Org Config update (if any). format: date-time nullable: true type: string example: example_value name: description: The machine-friendly name of an Org Config. example: monitor_timezone type: string value: description: The value of an Org Config. example: example_value value_type: description: The type of an Org Config value. example: bool type: string required: - name - description - value_type - value type: object CustomConnectionAttributesOnPremRunner: description: Information about the Private Action Runner used by the custom connection, if the custom connection is associated with a Private Action Runner. properties: id: description: The Private Action Runner ID. type: string example: abc-123-def url: description: The URL of the Private Action Runner. type: string example: https://app.datadoghq.com type: object ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction: description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content. enum: - hash example: hash type: string x-enum-varnames: - HASH RelationshipToTeamLinks: description: Relationship between a team and a team link properties: data: description: Related team links items: $ref: '#/components/schemas/RelationshipToTeamLinkData' type: array links: $ref: '#/components/schemas/TeamRelationshipsLinks' type: object x-merge-override: required: false IncidentServicesResponse: description: Response with a list of incident service payloads. properties: data: description: An array of incident services. example: - id: 00000000-0000-0000-0000-000000000000 type: services items: $ref: '#/components/schemas/IncidentServiceResponseData' type: array included: description: Included related resources which the user requested. items: $ref: '#/components/schemas/IncidentServiceIncludedItems' readOnly: true type: array meta: $ref: '#/components/schemas/IncidentResponseMeta' required: - data type: object DomainAllowlistResponse: description: Response containing information about the email domain allowlist. properties: data: $ref: '#/components/schemas/DomainAllowlistResponseData' type: object LogsStorageTier: default: indexes description: Specifies storage type as indexes, online-archives or flex enum: - indexes - online-archives - flex example: indexes type: string x-enum-varnames: - INDEXES - ONLINE_ARCHIVES - FLEX TeamPermissionSettingSerializerAction: description: The identifier for the action enum: - manage_membership - edit readOnly: true type: string x-enum-varnames: - MANAGE_MEMBERSHIP - EDIT DORAListDeploymentsRequestDataType: description: The definition of `DORAListDeploymentsRequestDataType` object. enum: - dora_deployments_list_request type: string x-enum-varnames: - DORA_DEPLOYMENTS_LIST_REQUEST FastlyServiceType: default: fastly-services description: The JSON:API type for this API. Should always be `fastly-services`. enum: - fastly-services example: fastly-services type: string x-enum-varnames: - FASTLY_SERVICES EntityToOncalls: description: Entity to oncalls relationship. properties: data: $ref: '#/components/schemas/RelationshipArray' type: object Version: description: Version of the notification rule. It is updated when the rule is modified. example: 1 format: int64 type: integer ServiceNowTicket: description: ServiceNow ticket attached to case nullable: true properties: result: $ref: '#/components/schemas/ServiceNowTicketResult' status: $ref: '#/components/schemas/Case3rdPartyTicketStatus' readOnly: true type: object TeamRelationships: description: Resources related to a team properties: team_links: $ref: '#/components/schemas/RelationshipToTeamLinks' user_team_permissions: $ref: '#/components/schemas/RelationshipToUserTeamPermission' type: object CustomCostGetResponseMeta: description: Meta for the response from the Get Custom Costs endpoints. properties: version: description: Version of Custom Costs file type: string example: example_value type: object ObservabilityPipelineDedupeProcessorMode: description: The deduplication mode to apply to the fields. enum: - match - ignore example: match type: string x-enum-varnames: - MATCH - IGNORE IncidentResponseMetaPagination: description: Pagination properties. properties: next_offset: description: The index of the first element in the next page of results. Equal to page size added to the current offset. example: 1000 format: int64 type: integer offset: description: The index of the first element in the results. example: 10 format: int64 type: integer size: description: Maximum size of pages to return. example: 1000 format: int64 type: integer type: object ConfluentResourceType: default: confluent-cloud-resources description: The JSON:API type for this request. enum: - confluent-cloud-resources example: confluent-cloud-resources type: string x-enum-varnames: - CONFLUENT_CLOUD_RESOURCES ShiftDataAttributes: description: The definition of `ShiftDataAttributes` object. properties: end: description: The end time of the shift. format: date-time type: string example: example_value start: description: The start time of the shift. format: date-time type: string example: example_value type: object Deployment: description: The version of the app that was published. properties: attributes: $ref: '#/components/schemas/DeploymentAttributes' id: description: The deployment ID. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string meta: $ref: '#/components/schemas/DeploymentMetadata' type: $ref: '#/components/schemas/AppDeploymentType' type: object RelationshipToUserTeamTeamData: description: The team associated with the membership properties: id: description: The ID of the team associated with the membership example: d7e15d9d-d346-43da-81d8-3d9e71d9a5e9 type: string type: $ref: '#/components/schemas/UserTeamTeamType' required: - id - type type: object EntityV3DatastoreDatadog: additionalProperties: false description: Datadog product integrations for the datastore entity. properties: events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' type: object x-ignore-duplicate-object: true AWSLogsServicesResponseDataType: default: logs_services description: The `AWSLogsServicesResponseData` `type`. enum: - logs_services example: logs_services type: string x-enum-varnames: - LOGS_SERVICES EventStatusType: description: 'If an alert event is enabled, its status is one of the following: `failure`, `error`, `warning`, `info`, `success`, `user_update`, `recommendation`, or `snapshot`.' enum: - failure - error - warning - info - success - user_update - recommendation - snapshot example: info type: string x-enum-varnames: - FAILURE - ERROR - WARNING - INFO - SUCCESS - USER_UPDATE - RECOMMENDATION - SNAPSHOT IncidentResponseMeta: description: The metadata object containing pagination metadata. properties: pagination: $ref: '#/components/schemas/IncidentResponseMetaPagination' readOnly: true type: object MonthlyCostAttributionAttributes: description: Cost Attribution by Tag for a given organization. properties: month: description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]`.' format: date-time type: string example: example_value org_name: description: The name of the organization. type: string example: Example Monitor public_id: description: The organization public ID. type: string example: abc-123-def tag_config_source: description: The source of the cost attribution tag configuration and the selected tags in the format `::://////`. type: string example: env:production tags: $ref: '#/components/schemas/CostAttributionTagNames' updated_at: description: Shows the most recent hour in the current months for all organizations for which all costs were calculated. type: string example: '2026-04-17T12:00:00Z' values: description: 'Fields in Cost Attribution by tag(s). Example: `infra_host_on_demand_cost`, `infra_host_committed_cost`, `infra_host_total_cost`, `infra_host_percentage_in_org`, `infra_host_percentage_in_account`.' type: object type: object EventsSort: description: The sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING AzureStorageDestinationType: default: azure_storage description: The destination type. The value should always be `azure_storage`. enum: - azure_storage example: azure_storage type: string x-enum-varnames: - AZURE_STORAGE CloudWorkloadSecurityAgentRuleUpdaterAttributes: description: The attributes of the user who last updated the Agent rule properties: handle: description: The handle of the user example: datadog.user@example.com type: string name: description: The name of the user example: Datadog User nullable: true type: string type: object ObservabilityPipelineMetadataEntry: description: A custom metadata entry. properties: name: description: The metadata key. example: environment type: string value: description: The metadata value. example: production type: string required: - name - value type: object ProcessSummariesMeta: description: Response metadata object. properties: page: $ref: '#/components/schemas/ProcessSummariesMetaPage' type: object PowerpackGroupWidgetDefinition: description: Powerpack group widget object. properties: layout_type: description: Layout type of widgets. example: ordered type: string show_title: description: Boolean indicating whether powerpack group title should be visible or not. example: true type: boolean title: description: Name for the group widget. example: Sample Powerpack type: string type: description: Type of widget, must be group. example: group type: string widgets: description: Widgets inside the powerpack. example: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 items: $ref: '#/components/schemas/PowerpackInnerWidgets' type: array required: - widgets - layout_type - type type: object Permission: description: Permission object. properties: attributes: $ref: '#/components/schemas/PermissionAttributes' id: description: ID of the permission. type: string example: abc-123-def type: $ref: '#/components/schemas/PermissionsType' required: - type type: object TeamReference: description: Provides a reference to a team, including ID, type, and basic attributes/relationships. properties: attributes: $ref: '#/components/schemas/TeamReferenceAttributes' id: description: The team's unique identifier. type: string example: abc-123-def type: $ref: '#/components/schemas/TeamReferenceType' required: - type type: object LogsArchiveIntegrationGCS: description: The GCS archive's integration destination. properties: client_email: description: A client email. example: youremail@example.com type: string project_id: description: A project ID. example: project-id type: string required: - client_email type: object ServiceDefinitionV2Dot2: description: Service definition v2.2 for providing service metadata and integrations. properties: application: description: Identifier for a group of related services serving a product feature, which the service is a part of. example: my-app type: string ci-pipeline-fingerprints: description: A set of CI fingerprints. example: - j88xdEy0J5lc - eZ7LMljCk8vo items: type: string type: array contacts: description: A list of contacts related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Contact' type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string description: description: A short description of the service. example: My service description type: string extensions: additionalProperties: {} description: Extensions to v2.2 schema. example: myorg/extension: extensionValue type: object integrations: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Integrations' languages: description: 'The service''s programming language. Datadog recognizes the following languages: `dotnet`, `go`, `java`, `js`, `php`, `python`, `ruby`, and `c++`.' example: - dotnet - go - java - js - php - python - ruby - c++ items: type: string type: array lifecycle: description: The current life cycle phase of the service. example: sandbox type: string links: description: A list of links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Link' type: array schema-version: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array team: description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists. example: my-team type: string tier: description: Importance of the service. example: High type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Type' required: - schema-version - dd-service type: object ObservabilityPipelineSyslogNgDestinationType: default: syslog_ng description: The destination type. The value should always be `syslog_ng`. enum: - syslog_ng example: syslog_ng type: string x-enum-varnames: - SYSLOG_NG PowerpackAttributes: description: Powerpack attribute object. properties: description: description: Description of this powerpack. example: Powerpack for ABC type: string group_widget: $ref: '#/components/schemas/PowerpackGroupWidget' name: description: Name of the powerpack. example: Sample Powerpack type: string tags: description: List of tags to identify this powerpack. example: - tag:foo1 items: maxLength: 80 type: string maxItems: 8 type: array template_variables: description: List of template variables for this powerpack. example: - defaults: - '*' name: test items: $ref: '#/components/schemas/PowerpackTemplateVariable' type: array required: - group_widget - name type: object ObservabilityPipelineEnrichmentTableFileEncodingType: description: Specifies the encoding format (e.g., CSV) used for enrichment tables. enum: - csv example: csv type: string x-enum-varnames: - CSV AuthNMappingRelationships: description: All relationships associated with AuthN Mapping. properties: role: $ref: '#/components/schemas/RelationshipToRole' saml_assertion_attribute: $ref: '#/components/schemas/RelationshipToSAMLAssertionAttribute' team: $ref: '#/components/schemas/RelationshipToTeam' type: object ObservabilityPipelineFluentdSourceType: default: fluentd description: The source type. The value should always be `fluentd. enum: - fluentd example: fluentd type: string x-enum-varnames: - FLUENTD RetentionFilterAll: description: The definition of the retention filter. properties: attributes: $ref: '#/components/schemas/RetentionFilterAllAttributes' id: description: The ID of the retention filter. example: 7RBOb7dLSYWI01yc3pIH8w type: string type: $ref: '#/components/schemas/ApmRetentionFilterType' required: - id - type - attributes type: object IPAllowlistAttributes: description: Attributes of the IP allowlist. properties: enabled: description: Whether the IP allowlist logic is enabled or not. type: boolean example: true entries: description: Array of entries in the IP allowlist. items: $ref: '#/components/schemas/IPAllowlistEntry' type: array type: object TokenType: description: The definition of `TokenType` object. enum: - SECRET example: SECRET type: string x-enum-varnames: - SECRET ObservabilityPipelineOcsfMapperProcessorMappingMapping: description: Defines a single mapping rule for transforming logs into the OCSF schema. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineOcsfMappingLibrary' ContainerImageGroupRelationshipsLinks: description: Links attributes. properties: related: description: Link to related Container Images. type: string example: example_value type: object RelationResponseType: description: Relation type. enum: - relation type: string x-enum-varnames: - RELATION XRayServicesIncludeAll: description: Include all services. properties: include_all: description: Include all services. example: false type: boolean required: - include_all type: object MSTeamsIntegrationMetadataTeamsItem: description: Item in the Microsoft Teams integration metadata teams array. properties: ms_channel_id: description: Microsoft Teams channel ID. example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2 type: string ms_channel_name: description: Microsoft Teams channel name. example: incident-0001-example type: string ms_tenant_id: description: Microsoft Teams tenant ID. example: 00000000-abcd-0005-0000-000000000000 type: string redirect_url: description: URL redirecting to the Microsoft Teams channel. example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000 type: string required: - ms_tenant_id - ms_channel_id - ms_channel_name - redirect_url type: object UsageApplicationSecurityMonitoringResponse: description: Application Security Monitoring usage response. properties: data: description: Response containing Application Security Monitoring usage. items: $ref: '#/components/schemas/UsageDataObject' type: array type: object UserTeamPermissionAttributes: description: User team permission attributes properties: permissions: description: Object of team permission actions and boolean values that a logged in user can perform on this team. readOnly: true type: object type: object AWSLogsServicesResponse: description: AWS Logs Services response body properties: data: $ref: '#/components/schemas/AWSLogsServicesResponseData' required: - data type: object LogsArchiveEncryptionS3: description: The S3 encryption settings. properties: key: description: An Amazon Resource Name (ARN) used to identify an AWS KMS key. example: arn:aws:kms:us-east-1:012345678901:key/DatadogIntegrationRoleKms type: string type: $ref: '#/components/schemas/LogsArchiveEncryptionS3Type' required: - type type: object AWSNamespaceTagFilter: description: 'AWS Metrics Collection tag filters list. Defaults to `[]`. The array of custom AWS resource tags (in the form `key:value`) defines a filter that Datadog uses when collecting metrics from a specified service. Wildcards, such as `?` (match a single character) and `*` (match multiple characters), and exclusion using `!` before the tag are supported. For EC2, only hosts that match one of the defined tags will be imported into Datadog. The rest will be ignored. For example, `env:production,instance-type:c?.*,!region:us-east-1`.' properties: namespace: description: The AWS service for which the tag filters defined in `tags` will be applied. example: AWS/EC2 type: string tags: description: The AWS resource tags to filter on for the service specified by `namespace`. items: description: Tag in the form `key:value`. example: datadog:true type: string nullable: true type: array type: object ObservabilityPipelineGoogleCloudStorageDestinationType: default: google_cloud_storage description: The destination type. Always `google_cloud_storage`. enum: - google_cloud_storage example: google_cloud_storage type: string x-enum-varnames: - GOOGLE_CLOUD_STORAGE CustomCostsFileLineItem: description: Line item details from a Custom Costs file. properties: BilledCost: description: Total cost in the cost file. example: 100.5 format: double type: number BillingCurrency: description: Currency used in the Custom Costs file. example: USD type: string ChargeDescription: description: Description for the line item cost. example: Monthly usage charge for my service type: string ChargePeriodEnd: description: End date of the usage charge. example: '2023-02-28' pattern: ^\d{4}-\d{2}-\d{2}$ type: string ChargePeriodStart: description: Start date of the usage charge. example: '2023-02-01' pattern: ^\d{4}-\d{2}-\d{2}$ type: string ProviderName: description: Name of the provider for the line item. type: string example: abc-123-def Tags: additionalProperties: type: string description: Additional tags for the line item. type: object type: object DowntimeNotifyEndStateActions: description: Action that will trigger a monitor notification if the downtime is in the `notify_end_types` state. enum: - canceled - expired example: canceled type: string x-enum-varnames: - CANCELED - EXPIRED DataRelationshipsTeamsDataItems: description: Relates a team to this schedule, identified by `id` and `type` (must be `teams`). properties: id: description: The unique identifier of the team in this relationship. example: 00000000-da3a-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/DataRelationshipsTeamsDataItemsType' required: - type - id type: object ApplicationSecurityWafExclusionFilterScope: description: Deploy on services based on their environment and/or service name. properties: env: description: Deploy on this environment. example: www type: string service: description: Deploy on this service. example: prod type: string type: object AnnotationDisplayBounds: description: The definition of `AnnotationDisplayBounds` object. properties: height: description: The `bounds` `height`. format: double type: number example: 95.5 width: description: The `bounds` `width`. format: double type: number example: 95.5 x: description: The `bounds` `x`. format: double type: number example: 95.5 y: description: The `bounds` `y`. format: double type: number example: 95.5 type: object IncidentTodoAssigneeHandle: description: Assignee's @-handle. example: '@test.user@test.com' type: string LogsArchiveState: description: The state of the archive. enum: - UNKNOWN - WORKING - FAILING - WORKING_AUTH_LEGACY example: WORKING type: string x-enum-varnames: - UNKNOWN - WORKING - FAILING - WORKING_AUTH_LEGACY BudgetWithEntriesData: description: A budget and all its entries. properties: attributes: $ref: '#/components/schemas/BudgetAttributes' id: description: The `BudgetWithEntriesData` `id`. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string type: description: The type of the object, must be `budget`. type: string example: metric alert type: object TeamRoutingRulesIncluded: description: Represents additional included resources for team routing rules, such as associated routing rules. oneOf: - $ref: '#/components/schemas/RoutingRule' ContainerImagesResponseLinks: description: Pagination links. properties: first: description: Link to the first page. type: string example: example_value last: description: Link to the last page. nullable: true type: string example: example_value next: description: Link to the next page. nullable: true type: string example: example_value prev: description: Link to previous page. nullable: true type: string example: example_value self: description: Link to current page. type: string example: example_value type: object ObservabilityPipelineQuotaProcessorLimitEnforceType: description: Unit for quota enforcement in bytes for data size or events for count. enum: - bytes - events example: bytes type: string x-enum-varnames: - BYTES - EVENTS CIAppResponsePage: description: Paging attributes. properties: after: description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object SecurityMonitoringRuleNewValueOptionsLearningDuration: default: 0 description: 'The duration in days during which values are learned, and after which signals will be generated for values that weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.' enum: - 0 - 1 - 7 format: int32 type: integer x-enum-varnames: - ZERO_DAYS - ONE_DAY - SEVEN_DAYS SlackTriggerWrapper: description: Schema for a Slack-based trigger. properties: slackTrigger: description: Trigger a workflow from Slack. The workflow must be published. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - slackTrigger type: object PermissionsResponse: description: Payload with API-returned permissions. properties: data: description: Array of permissions. items: $ref: '#/components/schemas/Permission' type: array type: object ObservabilityPipelineRsyslogDestinationType: default: rsyslog description: The destination type. The value should always be `rsyslog`. enum: - rsyslog example: rsyslog type: string x-enum-varnames: - RSYSLOG MonitorNotificationRuleFilter: description: Filter used to associate the notification rule with monitors. oneOf: - $ref: '#/components/schemas/MonitorNotificationRuleFilterTags' Selectors: description: 'Selectors are used to filter security issues for which notifications should be generated. Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source. Only the trigger_source field is required.' properties: query: $ref: '#/components/schemas/NotificationRuleQuery' rule_types: $ref: '#/components/schemas/RuleTypes' severities: description: The security rules severities to consider. items: $ref: '#/components/schemas/RuleSeverity' type: array trigger_source: $ref: '#/components/schemas/TriggerSource' required: - trigger_source type: object ErrorHandler: description: Used to handle errors in an action. properties: fallbackStepName: description: The `ErrorHandler` `fallbackStepName`. example: '' type: string retryStrategy: $ref: '#/components/schemas/RetryStrategy' required: - retryStrategy - fallbackStepName type: object ObservabilityPipelineParseGrokProcessorType: default: parse_grok description: The processor type. The value should always be `parse_grok`. enum: - parse_grok example: parse_grok type: string x-enum-varnames: - PARSE_GROK TeamTarget: description: Represents a team target for an escalation policy step, including the team's ID and resource type. properties: id: description: Specifies the unique identifier of the team resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/TeamTargetType' required: - type - id type: object RUMResponseStatus: description: The status of the response. enum: - done - timeout example: done type: string x-enum-varnames: - DONE - TIMEOUT ObservabilityPipelineAmazonOpenSearchDestinationType: default: amazon_opensearch description: The destination type. The value should always be `amazon_opensearch`. enum: - amazon_opensearch example: amazon_opensearch type: string x-enum-varnames: - AMAZON_OPENSEARCH GetDeviceAttributes: description: The device attributes properties: description: description: A description of the device. example: a device monitored with NDM type: string device_type: description: The type of the device. example: other type: string integration: description: The integration of the device. example: snmp type: string ip_address: description: The IP address of the device. example: 1.2.3.4 type: string location: description: The location of the device. example: paris type: string model: description: The model of the device. example: xx-123 type: string name: description: The name of the device. example: example device type: string os_hostname: description: The operating system hostname of the device. example: 1.0.2 type: string os_name: description: The operating system name of the device. example: example OS type: string os_version: description: The operating system version of the device. example: 1.0.2 type: string ping_status: description: The ping status of the device. example: unmonitored type: string product_name: description: The product name of the device. example: example device type: string serial_number: description: The serial number of the device. example: X12345 type: string status: description: The status of the device. example: ok type: string subnet: description: The subnet of the device. example: 1.2.3.4/24 type: string sys_object_id: description: The device `sys_object_id`. example: 1.3.6.1.4.1.99999 type: string tags: description: A list of tags associated with the device. example: - device_ip:1.2.3.4 - device_id:example:1.2.3.4 items: type: string type: array vendor: description: The vendor of the device. example: example vendor type: string version: description: The version of the device. example: 1.2.3 type: string type: object SecurityMonitoringRuleCaseActionOptionsUserBehaviorName: description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule. type: string RestrictionQueryAttributes: description: Attributes of the restriction query. properties: created_at: description: Creation time of the restriction query. example: '2020-03-17T21:06:44.000Z' format: date-time readOnly: true type: string modified_at: description: Time of last restriction query modification. example: '2020-03-17T21:15:15.000Z' format: date-time readOnly: true type: string restriction_query: description: The query that defines the restriction. Only the content matching the query can be returned. example: env:sandbox type: string type: object ObservabilityPipelineGeneratedMetric: description: 'Defines a log-based custom metric, including its name, type, filter, value computation strategy, and optional grouping fields. ' properties: group_by: description: Optional fields used to group the metric series. example: - service - env items: type: string type: array include: description: Datadog filter query to match logs for metric generation. example: service:billing type: string metric_type: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType' name: description: Name of the custom metric to be created. example: logs.processed type: string value: $ref: '#/components/schemas/ObservabilityPipelineMetricValue' required: - name - include - metric_type - value type: object HourlyUsageResponse: description: Hourly usage response. properties: data: description: Response containing hourly usage. items: $ref: '#/components/schemas/HourlyUsage' type: array meta: $ref: '#/components/schemas/HourlyUsageMetadata' type: object AWSRegionsIncludeAll: description: Include all regions. Defaults to `true`. properties: include_all: description: Include all regions. example: true type: boolean required: - include_all type: object ObservabilityPipelineGoogleChronicleDestination: description: The `google_chronicle` destination sends logs to Google Chronicle. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineGcpAuth' customer_id: description: The Google Chronicle customer ID. example: abcdefg123456789 type: string encoding: $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding' id: description: The unique identifier for this component. example: google-chronicle-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - parse-json-processor items: type: string type: array log_type: description: The log type metadata associated with the Chronicle destination. example: nginx_logs type: string type: $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType' required: - id - type - inputs - auth - customer_id type: object LogsArchiveStorageClassS3Type: default: STANDARD description: The storage class where the archive will be stored. enum: - STANDARD - STANDARD_IA - ONEZONE_IA - INTELLIGENT_TIERING - GLACIER_IR example: STANDARD type: string x-enum-varnames: - STANDARD - STANDARD_IA - ONEZONE_IA - INTELLIGENT_TIERING - GLACIER_IR MicrosoftTeamsTenantBasedHandleType: default: tenant-based-handle description: Specifies the tenant-based handle resource type. enum: - tenant-based-handle example: tenant-based-handle type: string x-enum-varnames: - TENANT_BASED_HANDLE LayerAttributesInterval: description: Defines how often the rotation repeats, using a combination of days and optional seconds. properties: days: description: The number of days in each rotation cycle. example: 1 format: int32 maximum: 400 type: integer seconds: description: Any additional seconds for the rotation cycle (up to 30 days). example: 300 format: int64 maximum: 2592000 type: integer type: object AWSRegions: description: AWS Regions to collect data from. Defaults to `include_all`. oneOf: - $ref: '#/components/schemas/AWSRegionsIncludeAll' - $ref: '#/components/schemas/AWSRegionsIncludeOnly' ListTagsResponseDataAttributes: description: The definition of ListTagsResponseDataAttributes object. properties: tags: description: The list of tags example: - tag:test - tag:testbis items: type: string type: array type: object AuditLogsResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: Time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: '#/components/schemas/AuditLogsResponsePage' request_id: description: The identifier of the request. example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR type: string status: $ref: '#/components/schemas/AuditLogsResponseStatus' warnings: description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.' items: $ref: '#/components/schemas/AuditLogsWarning' type: array type: object ObservabilityPipelineKafkaSource: description: The `kafka` source ingests data from Apache Kafka topics. properties: group_id: description: Consumer group ID used by the Kafka client. example: consumer-group-0 type: string id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: kafka-source type: string librdkafka_options: description: Optional list of advanced Kafka client configuration options, defined as key-value pairs. items: $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceLibrdkafkaOption' type: array sasl: $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceSasl' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' topics: description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified. example: - topic1 - topic2 items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceType' required: - id - type - group_id - topics type: object RUMResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: '#/components/schemas/RUMResponsePage' request_id: description: The identifier of the request. example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR type: string status: $ref: '#/components/schemas/RUMResponseStatus' warnings: description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.' items: $ref: '#/components/schemas/RUMWarning' type: array type: object ContainerGroupRelationshipsData: description: Links data. items: description: A link data. type: string type: array CsmAgentData: description: Single Agent Data. properties: attributes: $ref: '#/components/schemas/CsmAgentsAttributes' id: description: The ID of the Agent. example: fffffc5505f6a006fdf7cf5aae053653 type: string type: $ref: '#/components/schemas/CSMAgentsType' type: object ObservabilityPipelineSplunkTcpSource: description: 'The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP. TLS is supported for secure transmission. ' properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: splunk-tcp-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSourceType' required: - id - type type: object DowntimeMeta: description: Pagination metadata returned by the API. properties: page: $ref: '#/components/schemas/DowntimeMetaPage' type: object ActionQueryMockedOutputsObject: description: The mocked outputs of the action query. properties: enabled: $ref: '#/components/schemas/ActionQueryMockedOutputsEnabled' outputs: description: The mocked outputs of the action query, serialized as JSON. example: '{"status": "success"}' type: string required: - enabled type: object TeamRoutingRulesDataType: default: team_routing_rules description: Team routing rules resource type. enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES UserTeamPermissionType: default: user_team_permissions description: User team permission type enum: - user_team_permissions example: user_team_permissions type: string x-enum-varnames: - USER_TEAM_PERMISSIONS EntityResponseIncludedRelatedEntityAttributes: description: Related entity attributes. properties: kind: description: Entity kind. type: string example: example_value name: description: Entity name. type: string example: Example Monitor namespace: description: Entity namespace. type: string example: Example Monitor type: description: Entity relation type to the associated entity. type: string example: metric alert type: object LogsMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the log-based metric will be aggregated over. example: '@http.status_code' type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: status_code type: string type: object IncidentTeamResponseAttributes: description: The incident team's attributes from a response. properties: created: description: Timestamp of when the incident team was created. format: date-time readOnly: true type: string example: example_value modified: description: Timestamp of when the incident team was modified. format: date-time readOnly: true type: string example: example_value name: description: Name of the incident team. example: team name type: string type: object IncidentTypeObject: description: Incident type response data. properties: attributes: $ref: '#/components/schemas/IncidentTypeAttributes' id: description: The incident type's ID. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/IncidentTypeType' required: - id - type type: object ActionQueryDebounceInMs: description: The minimum time in milliseconds that must pass before the query can be triggered again. This is useful for preventing accidental double-clicks from triggering the query multiple times. oneOf: - example: 310.5 format: double type: number - description: If this is a string, it must be a valid JavaScript expression that evaluates to a number. example: ${1000} type: string MonitorDowntimeMatchResponseData: description: A downtime match. properties: attributes: $ref: '#/components/schemas/MonitorDowntimeMatchResponseAttributes' id: description: The downtime ID. example: 00000000-0000-1234-0000-000000000000 nullable: true type: string type: $ref: '#/components/schemas/MonitorDowntimeMatchResourceType' type: object AuditLogsEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from Audit Logs events. example: customAttribute: 123 duration: 2345 type: object message: description: Message of the event. type: string example: CPU usage is high on {{host.name}} service: description: 'Name of the application or service generating Audit Logs events. This name is used to correlate Audit Logs to APM, so make sure you specify the same value when you use both products.' example: web-app type: string tags: description: Array of tags associated with your event. example: - team:A items: description: Tag associated with your event. type: string type: array timestamp: description: Timestamp of your event. example: '2019-01-02T09:42:36.320Z' format: date-time type: string type: object CsmHostsAndContainersCoverageAnalysisResponse: description: CSM Hosts and Containers Coverage Analysis response. properties: data: $ref: '#/components/schemas/CsmHostsAndContainersCoverageAnalysisData' type: object AppBuilderEvent: additionalProperties: {} description: An event on a UI component that triggers a response or action in an app. properties: name: $ref: '#/components/schemas/AppBuilderEventName' type: $ref: '#/components/schemas/AppBuilderEventType' type: object ApplicationSecurityWafCustomRuleData: description: Object for a single WAF custom rule. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAttributes' id: description: The ID of the custom rule. example: 2857c47d-1e3a-4300-8b2f-dc24089c084b readOnly: true type: string type: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType' type: object TriggerSource: description: 'The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals", while notification rules based on security vulnerabilities need to use the trigger source "security_findings".' enum: - security_findings - security_signals example: security_findings type: string x-enum-varnames: - SECURITY_FINDINGS - SECURITY_SIGNALS LogsSort: description: Sort parameters when querying logs. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING TeamType: default: team description: Team type enum: - team example: team type: string x-enum-varnames: - TEAM SAMLAssertionAttributeAttributes: description: Key/Value pair of attributes used in SAML assertion attributes. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string type: object EntityV3QueueDatadog: additionalProperties: false description: Datadog product integrations for the datastore entity. properties: events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' type: object x-ignore-duplicate-object: true CSMAgentsMetadata: description: Metadata related to the paginated response. properties: page_index: description: The index of the current page in the paginated results. example: 0 format: int64 type: integer page_size: description: The number of items per page in the paginated results. example: 10 format: int64 type: integer total_filtered: description: Total number of items that match the filter criteria. example: 128697 format: int64 type: integer type: object IncidentTypeResponse: description: Incident type response data. properties: data: $ref: '#/components/schemas/IncidentTypeObject' required: - data type: object ObservabilityPipelineSentinelOneDestination: description: The `sentinel_one` destination sends logs to SentinelOne. properties: id: description: The unique identifier for this component. example: sentinelone-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array region: $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationRegion' type: $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationType' required: - id - type - inputs - region type: object SecurityMonitoringSignalsListResponseMetaPage: description: Paging attributes. properties: after: description: 'The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.' example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object Case: description: A case properties: attributes: $ref: '#/components/schemas/CaseAttributes' id: description: Case's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: '#/components/schemas/CaseRelationships' type: $ref: '#/components/schemas/CaseResourceType' required: - id - type - attributes type: object UserInvitationResponseData: description: Object of a user invitation returned by the API. properties: attributes: $ref: '#/components/schemas/UserInvitationDataAttributes' id: description: ID of the user invitation. type: string example: abc-123-def relationships: $ref: '#/components/schemas/UserInvitationRelationships' type: $ref: '#/components/schemas/UserInvitationsType' type: object x-merge-override: required: false UsageTimeSeriesType: default: usage_timeseries description: Type of usage data. enum: - usage_timeseries example: usage_timeseries type: string x-enum-varnames: - USAGE_TIMESERIES ScheduleDataType: default: schedules description: Schedules resource type. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES CsmCloudAccountsCoverageAnalysisResponse: description: CSM Cloud Accounts Coverage Analysis response. properties: data: $ref: '#/components/schemas/CsmCloudAccountsCoverageAnalysisData' type: object ServiceDefinitionV2Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: '#/components/schemas/ServiceDefinitionV2OpsgenieRegion' service-url: description: Opsgenie service url. example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 type: string required: - service-url type: object LogsArchiveOrderDefinitionType: default: archive_order description: Type of the archive order definition. enum: - archive_order example: archive_order type: string x-enum-varnames: - ARCHIVE_ORDER DowntimeNotifyEndStates: description: States that will trigger a monitor notification when the `notify_end_types` action occurs. example: - alert - warn items: $ref: '#/components/schemas/DowntimeNotifyEndStateTypes' type: array AwsOnDemandResponse: description: Response object that includes an AWS on demand task. properties: data: $ref: '#/components/schemas/AwsOnDemandData' type: object ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy: description: The authentication strategy to use. enum: - basic - aws example: aws type: string x-enum-varnames: - BASIC - AWS CustomFrameworkType: default: custom_framework description: The type of the resource. The value must be `custom_framework`. enum: - custom_framework example: custom_framework type: string x-enum-varnames: - CUSTOM_FRAMEWORK MicrosoftSentinelDestination: description: The `microsoft_sentinel` destination forwards logs to Microsoft Sentinel. properties: client_id: description: Azure AD client ID used for authentication. example: a1b2c3d4-5678-90ab-cdef-1234567890ab type: string dcr_immutable_id: description: The immutable ID of the Data Collection Rule (DCR). example: dcr-uuid-1234 type: string id: description: The unique identifier for this component. example: sentinel-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array table: description: The name of the Log Analytics table where logs are sent. example: CustomLogsTable type: string tenant_id: description: Azure AD tenant ID. example: abcdef12-3456-7890-abcd-ef1234567890 type: string type: $ref: '#/components/schemas/MicrosoftSentinelDestinationType' required: - id - type - inputs - client_id - tenant_id - dcr_immutable_id - table type: object CloudConfigurationRegoRule: description: Rule details. properties: policy: description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/' example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}\n" type: string resourceTypes: description: List of resource types that will be evaluated upon. Must have at least one element. example: - gcp_iam_service_account - gcp_iam_policy items: type: string type: array required: - policy - resourceTypes type: object LogsListResponse: description: Response object with all logs matching the request and pagination information. properties: data: description: Array of logs matching the request. items: $ref: '#/components/schemas/Log' type: array links: $ref: '#/components/schemas/LogsListResponseLinks' meta: $ref: '#/components/schemas/LogsResponseMetadata' type: object CompletionConditionOperator: description: The definition of `CompletionConditionOperator` object. enum: - OPERATOR_EQUAL - OPERATOR_NOT_EQUAL - OPERATOR_GREATER_THAN - OPERATOR_LESS_THAN - OPERATOR_GREATER_THAN_OR_EQUAL_TO - OPERATOR_LESS_THAN_OR_EQUAL_TO - OPERATOR_CONTAINS - OPERATOR_DOES_NOT_CONTAIN - OPERATOR_IS_NULL - OPERATOR_IS_NOT_NULL - OPERATOR_IS_EMPTY - OPERATOR_IS_NOT_EMPTY example: OPERATOR_EQUAL type: string x-enum-varnames: - OPERATOR_EQUAL - OPERATOR_NOT_EQUAL - OPERATOR_GREATER_THAN - OPERATOR_LESS_THAN - OPERATOR_GREATER_THAN_OR_EQUAL_TO - OPERATOR_LESS_THAN_OR_EQUAL_TO - OPERATOR_CONTAINS - OPERATOR_DOES_NOT_CONTAIN - OPERATOR_IS_NULL - OPERATOR_IS_NOT_NULL - OPERATOR_IS_EMPTY - OPERATOR_IS_NOT_EMPTY MicrosoftTeamsWorkflowsWebhookHandleType: default: workflows-webhook-handle description: Specifies the Workflows webhook handle resource type. enum: - workflows-webhook-handle example: workflows-webhook-handle type: string x-enum-varnames: - WORKFLOWS_WEBHOOK_HANDLE ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude: description: Excludes specific fields from sensitive data scanning. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions' target: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget' required: - target - options type: object CIAppResponseMetadataWithPagination: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: '#/components/schemas/CIAppResponsePage' request_id: description: The identifier of the request. example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR type: string status: $ref: '#/components/schemas/CIAppResponseStatus' warnings: description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.' items: $ref: '#/components/schemas/CIAppWarning' type: array type: object ListDevicesResponseMetadataPage: description: Pagination object. properties: total_filtered_count: description: Total count of devices matched by the filter. example: 1 format: int64 type: integer type: object ServiceDefinitionV2Pagerduty: description: PagerDuty service URL for the service. example: https://my-org.pagerduty.com/service-directory/PMyService type: string IncidentTeamResponseData: description: Incident Team data from a response. properties: attributes: $ref: '#/components/schemas/IncidentTeamResponseAttributes' id: description: The incident team's ID. example: 00000000-7ea3-0000-000a-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentTeamRelationships' type: $ref: '#/components/schemas/IncidentTeamType' type: object Connection: description: The definition of `Connection` object. properties: connectionId: description: The `Connection` `connectionId`. example: '' type: string label: description: The `Connection` `label`. example: '' type: string required: - connectionId - label type: object IncidentNonDatadogCreator: description: Incident's non Datadog creator. nullable: true properties: image_48_px: description: Non Datadog creator `48px` image. type: string example: example_value name: description: Non Datadog creator name. type: string example: Example Monitor type: object OpsgenieServicesResponse: description: Response with a list of Opsgenie services. properties: data: description: An array of Opsgenie services. example: - attributes: custom_url: null name: fake-opsgenie-service-name region: us id: 596da4af-0563-4097-90ff-07230c3f9db3 type: opsgenie-service - attributes: custom_url: null name: fake-opsgenie-service-name-2 region: eu id: 0d2937f1-b561-44fa-914a-99910f848014 type: opsgenie-service items: $ref: '#/components/schemas/OpsgenieServiceResponseData' type: array required: - data type: object ScheduleUserAttributes: description: Provides basic user information for a schedule, including a name and email address. properties: email: description: The user's email address. example: jane.doe@example.com type: string name: description: The user's name. example: Jane Doe type: string status: $ref: '#/components/schemas/UserAttributesStatus' type: object OnDemandConcurrencyCap: description: On-demand concurrency cap. properties: attributes: $ref: '#/components/schemas/OnDemandConcurrencyCapAttributes' type: $ref: '#/components/schemas/OnDemandConcurrencyCapType' type: object ObservabilityPipelineDatadogLogsDestination: description: The `datadog_logs` destination forwards logs to Datadog Log Management. properties: id: description: The unique identifier for this component. example: datadog-logs-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestinationType' required: - id - type - inputs type: object EntityV3DatadogEvents: additionalProperties: false description: Events associations. items: $ref: '#/components/schemas/EntityV3DatadogEventItem' type: array SecurityFiltersResponse: description: All the available security filters objects. properties: data: description: A list of security filters objects. items: $ref: '#/components/schemas/SecurityFilter' type: array meta: $ref: '#/components/schemas/SecurityFilterMeta' type: object IncidentIntegrationMetadataResponse: description: Response with an incident integration metadata. properties: data: $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData' included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem' readOnly: true type: array required: - data type: object Team: description: A team properties: attributes: $ref: '#/components/schemas/TeamAttributes' id: description: The team's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: '#/components/schemas/TeamRelationships' type: $ref: '#/components/schemas/TeamType' required: - attributes - id - type type: object x-merge-override: required: false ObservabilityPipelineAddEnvVarsProcessor: description: The `add_env_vars` processor adds environment variable values to log events. properties: id: description: The unique identifier for this component. Used to reference this processor in the pipeline. example: add-env-vars-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorType' variables: description: A list of environment variable mappings to apply to log fields. items: $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorVariable' type: array required: - id - type - include - inputs - variables type: object ObservabilityPipelineSensitiveDataScannerProcessorPattern: description: Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern' ObservabilityPipelineSensitiveDataScannerProcessorActionRedact: description: Configuration for completely redacting matched sensitive data. properties: action: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction' options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions' required: - action - options type: object SBOMType: description: The JSON:API type. enum: - sboms example: sboms type: string x-enum-varnames: - SBOMS PartialAPIKeyAttributes: description: Attributes of a partial API key. properties: category: description: The category of the API key. type: string example: example_value created_at: description: Creation date of the API key. example: '2020-11-23T10:00:00.000Z' readOnly: true type: string x-merge-override: format: false last4: description: The last four characters of the API key. example: abcd maxLength: 4 minLength: 4 readOnly: true type: string x-secret: true modified_at: description: Date the API key was last modified. example: '2020-11-23T10:00:00.000Z' readOnly: true type: string x-merge-override: format: false name: description: Name of the API key. example: API Key for submitting metrics type: string remote_config_read_enabled: description: The remote config read enabled status. type: boolean example: true type: object UserTeamIncluded: description: Included resources related to the team membership oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/Team' MonitorType: description: Attributes from the monitor that triggered the event. nullable: true properties: created_at: description: The POSIX timestamp of the monitor's creation in nanoseconds. example: 1646318692000 format: int64 type: integer group_status: description: Monitor group status used when there is no `result_groups`. format: int32 maximum: 2147483647 type: integer example: 42 groups: description: Groups to which the monitor belongs. items: description: A group. type: string type: array id: description: The monitor ID. format: int64 type: integer example: 42 message: description: The monitor message. type: string example: CPU usage is high on {{host.name}} modified: description: The monitor's last-modified timestamp. format: int64 type: integer example: 42 name: description: The monitor name. type: string example: Example Monitor query: description: The query that triggers the alert. type: string example: avg:system.cpu.user{*} tags: description: A list of tags attached to the monitor. example: - environment:test items: description: A tag. type: string type: array templated_name: description: The templated name of the monitor before resolving any template variables. type: string example: Example Monitor type: description: The monitor type. type: string example: metric alert type: object ApplicationSecurityWafExclusionFilterRulesTarget: description: Target WAF rules based either on an identifier or tags. properties: rule_id: description: Target a single WAF rule based on its identifier. example: dog-913-009 type: string tags: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTargetTags' type: object MonitorTriggerWrapper: description: Schema for a Monitor-based trigger. properties: monitorTrigger: $ref: '#/components/schemas/MonitorTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - monitorTrigger type: object LogsMetricComputeIncludePercentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `aggregation_type` is `distribution`.' example: true type: boolean CloudWorkloadSecurityAgentRulesListResponse: description: Response object that includes a list of Agent rule properties: data: description: A list of Agent rules objects items: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData' type: array type: object DowntimeScope: description: The scope to which the downtime applies. Must follow the [common search syntax](https://docs.datadoghq.com/logs/explorer/search_syntax/). example: env:(staging OR prod) AND datacenter:us-east-1 type: string AWSAccountPartition: description: 'AWS partition your AWS account is scoped to. Defaults to `aws`. See [Partitions](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html) in the AWS documentation for more information.' enum: - aws - aws-cn - aws-us-gov example: aws type: string x-enum-varnames: - AWS - AWS_CN - AWS_US_GOV EntityData: description: Entity data. properties: attributes: $ref: '#/components/schemas/EntityAttributes' id: description: Entity ID. type: string example: abc-123-def meta: $ref: '#/components/schemas/EntityMeta' relationships: $ref: '#/components/schemas/EntityRelationships' type: description: Entity. type: string example: metric alert type: object HourlyUsagePagination: description: The metadata for the current pagination. properties: next_record_id: description: The cursor to get the next results (if any). To make the next request, use the same parameters and add `next_record_id`. nullable: true type: string example: abc-123-def type: object ServiceDefinitionV2MSTeamsType: description: Contact type. enum: - microsoft-teams example: microsoft-teams type: string x-enum-varnames: - MICROSOFT_TEAMS ApplicationSecurityWafCustomRuleTagsCategory: description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`. enum: - attack_attempt - business_logic - security_response example: business_logic type: string x-enum-varnames: - ATTACK_ATTEMPT - BUSINESS_LOGIC - SECURITY_RESPONSE SBOMComponentType: description: The SBOM component type enum: - application - container - data - device - device-driver - file - firmware - framework - library - machine-learning-model - operating-system - platform example: application type: string x-enum-varnames: - APPLICATION - CONTAINER - DATA - DEVICE - DEVICE_DRIVER - FILE - FIRMWARE - FRAMEWORK - LIBRARY - MACHINE_LEARNING_MODEL - OPERATING_SYSTEM - PLATFORM IncidentTodoResponseIncludedItem: description: An object related to an incident todo that is included in the response. oneOf: - $ref: '#/components/schemas/User' ObservabilityPipelineSumoLogicSource: description: The `sumo_logic` source receives logs from Sumo Logic collectors. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: sumo-logic-source type: string type: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSourceType' required: - id - type type: object OutputSchemaParametersType: description: The definition of `OutputSchemaParametersType` object. enum: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT example: STRING type: string x-enum-varnames: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT UsageTimeSeriesObject: description: Usage timeseries data. properties: timestamp: description: Datetime in ISO-8601 format, UTC. The hour for the usage. format: date-time type: string example: '2026-04-17T12:00:00Z' value: description: Contains the number measured for the given usage_type during the hour. format: int64 nullable: true type: integer example: 42 type: object ObservabilityPipelineHttpClientSourceAuthStrategy: description: Optional authentication strategy for HTTP requests. enum: - basic - bearer example: basic type: string x-enum-varnames: - BASIC - BEARER SecurityMonitoringSuppressionID: description: The ID of the suppression rule. example: 3dd-0uc-h1s type: string EntityV3APIVersion: description: The schema version of entity type. The field is known as schema-version in the previous version. enum: - v3 example: v3 type: string x-enum-varnames: - V3 BillingDimensionsMappingBodyItemAttributes: description: Mapping of billing dimensions to endpoint keys. properties: endpoints: description: List of supported endpoints with their keys mapped to the billing_dimension. items: $ref: '#/components/schemas/BillingDimensionsMappingBodyItemAttributesEndpointsItems' type: array in_app_label: description: Label used for the billing dimension in the Plan & Usage charts. example: APM Hosts type: string timestamp: description: 'Month in ISO-8601 format, UTC, and precise to the second: `[YYYY-MM-DDThh:mm:ss]`.' format: date-time type: string example: '2026-04-17T12:00:00Z' type: object WorklflowGetInstanceResponse: additionalProperties: {} description: The state of the given workflow instance. properties: data: $ref: '#/components/schemas/WorklflowGetInstanceResponseData' type: object ObservabilityPipelineOcsfMapperProcessorMapping: description: Defines how specific events are transformed to OCSF using a mapping configuration. properties: include: description: A Datadog search query used to select the logs that this mapping should apply to. example: service:my-service type: string mapping: $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping' required: - include - mapping type: object MicrosoftSentinelDestinationType: default: microsoft_sentinel description: The destination type. The value should always be `microsoft_sentinel`. enum: - microsoft_sentinel example: microsoft_sentinel type: string x-enum-varnames: - MICROSOFT_SENTINEL ObservabilityPipelineQuotaProcessorLimit: description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events. properties: enforce: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType' limit: description: The limit for quota enforcement. example: 1000 format: int64 type: integer required: - enforce - limit type: object ActionConnectionAttributes: description: The definition of `ActionConnectionAttributes` object. properties: integration: $ref: '#/components/schemas/ActionConnectionIntegration' name: description: Name of the connection example: My AWS Connection type: string required: - name - integration type: object APIKeyResponseIncludedItem: description: An object related to an API key. oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/LeakedKey' DataRelationshipsTeams: description: Associates teams with this schedule in a data structure. properties: data: description: An array of team references for this schedule. items: $ref: '#/components/schemas/DataRelationshipsTeamsDataItems' type: array type: object ServiceDefinitionV2Dot1Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Opsgenie' pagerduty: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Pagerduty' type: object OpsgenieServiceResponse: description: Response of an Opsgenie service. properties: data: $ref: '#/components/schemas/OpsgenieServiceResponseData' required: - data type: object RelationshipToIncidentImpacts: description: Relationship to impacts. properties: data: description: An array of incident impacts. items: $ref: '#/components/schemas/RelationshipToIncidentImpactData' type: array required: - data type: object EventsResponseMetadataPage: description: Pagination attributes. properties: after: description: 'The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.' example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object EntityToRelatedEntities: description: Entity to related entities relationship. properties: data: $ref: '#/components/schemas/RelationshipArray' type: object IncidentAttachmentPostmortemAttributes: description: The attributes object for a postmortem attachment. properties: attachment: $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject' attachment_type: $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType' required: - attachment_type - attachment type: object AuditLogsEvent: description: Object description of an Audit Logs event after it is processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/AuditLogsEventAttributes' id: description: Unique ID of the event. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/AuditLogsEventType' type: object ComponentProperties: additionalProperties: {} description: Properties of a UI component. Different component types can have their own additional unique properties. See the [components documentation](https://docs.datadoghq.com/service_management/app_builder/components/) for more detail on each component type and its properties. properties: children: description: The child components of the UI component. items: $ref: '#/components/schemas/Component' type: array isVisible: $ref: '#/components/schemas/ComponentPropertiesIsVisible' type: object EscalationPolicyUser: description: Represents a user object in the context of an escalation policy, including their `id`, type, and basic attributes. properties: attributes: $ref: '#/components/schemas/EscalationPolicyUserAttributes' id: description: The unique user identifier. type: string example: abc-123-def type: $ref: '#/components/schemas/EscalationPolicyUserType' required: - type type: object SecurityMonitoringRuleCaseActionType: description: The action type. enum: - block_ip - block_user - user_behavior type: string x-enum-varnames: - BLOCK_IP - BLOCK_USER - USER_BEHAVIOR ObservabilityPipelineSampleProcessor: description: The `sample` processor allows probabilistic sampling of logs at a fixed rate. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: sample-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array percentage: description: The percentage of logs to sample. example: 10 format: double type: number rate: description: Number of events to sample (1 in N). example: 10 format: int64 minimum: 1 type: integer type: $ref: '#/components/schemas/ObservabilityPipelineSampleProcessorType' required: - id - type - include - inputs type: object CIAppPipelineEventsResponse: description: Response object with all pipeline events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: '#/components/schemas/CIAppPipelineEvent' type: array links: $ref: '#/components/schemas/CIAppResponseLinks' meta: $ref: '#/components/schemas/CIAppResponseMetadataWithPagination' type: object ObservabilityPipelineData: description: Contains the pipeline’s ID, type, and configuration attributes. properties: attributes: $ref: '#/components/schemas/ObservabilityPipelineDataAttributes' id: description: Unique identifier for the pipeline. example: 3fa85f64-5717-4562-b3fc-2c963f66afa6 type: string type: default: pipelines description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`. example: pipelines type: string required: - id - type - attributes type: object MetricsListResponseLinks: description: Pagination links. Only present if pagination query parameters were provided. properties: first: description: Link to the first page. type: string example: example_value last: description: Link to the last page. nullable: true type: string example: example_value next: description: Link to the next page. nullable: true type: string example: example_value prev: description: Link to previous page. nullable: true type: string example: example_value self: description: Link to current page. type: string example: example_value type: object ServiceDefinitionV2Dot1Version: default: v2.1 description: Schema version being used. enum: - v2.1 example: v2.1 type: string x-enum-varnames: - V2_1 CustomConnectionAttributes: description: The custom connection attributes. properties: name: description: The name of the custom connection. type: string example: Example Monitor onPremRunner: $ref: '#/components/schemas/CustomConnectionAttributesOnPremRunner' type: object HTTPIntegration: description: The definition of `HTTPIntegration` object. properties: base_url: description: Base HTTP url for the integration example: http://datadoghq.com type: string credentials: $ref: '#/components/schemas/HTTPCredentials' type: $ref: '#/components/schemas/HTTPIntegrationType' required: - type - base_url - credentials type: object AwsOnDemandListResponse: description: Response object that includes a list of AWS on demand tasks. properties: data: description: A list of on demand tasks. items: $ref: '#/components/schemas/AwsOnDemandData' type: array type: object CsmServerlessCoverageAnalysisAttributes: description: CSM Serverless Resources Coverage Analysis attributes. properties: cws_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' org_id: description: The ID of your organization. example: 123456 format: int64 type: integer total_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' type: object AnnotationDisplay: description: The definition of `AnnotationDisplay` object. properties: bounds: $ref: '#/components/schemas/AnnotationDisplayBounds' type: object AWSCredentials: description: The definition of `AWSCredentials` object. oneOf: - $ref: '#/components/schemas/AWSAssumeRole' RuleVersionHistory: description: Response object containing the version history of a rule. properties: count: description: The number of rule versions. format: int32 maximum: 2147483647 type: integer example: 42 data: additionalProperties: $ref: '#/components/schemas/RuleVersions' description: A rule version with a list of updates. description: The `RuleVersionHistory` `data`. type: object type: object LogsMetricsResponse: description: All the available log-based metric objects. properties: data: description: A list of log-based metric objects. items: $ref: '#/components/schemas/LogsMetricResponseData' type: array type: object RUMEvent: description: Object description of a RUM event after being processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/RUMEventAttributes' id: description: Unique ID of the event. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/RUMEventType' type: object ObservabilityPipelineDedupeProcessor: description: The `dedupe` processor removes duplicate fields in log events. properties: fields: description: A list of log field paths to check for duplicates. example: - log.message - log.error items: type: string type: array id: description: The unique identifier for this processor. example: dedupe-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - parse-json-processor items: type: string type: array mode: $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorMode' type: $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorType' required: - id - type - include - inputs - fields - mode type: object DowntimeMuteFirstRecoveryNotification: description: If the first recovery notification during a downtime should be muted. example: false type: boolean MSTeamsIntegrationMetadata: description: Incident integration metadata for the Microsoft Teams integration. properties: teams: description: Array of Microsoft Teams in this integration metadata. example: [] items: $ref: '#/components/schemas/MSTeamsIntegrationMetadataTeamsItem' type: array required: - teams type: object DowntimeMonitorIdentifier: description: Monitor identifier for the downtime. oneOf: - $ref: '#/components/schemas/DowntimeMonitorIdentifierId' - $ref: '#/components/schemas/DowntimeMonitorIdentifierTags' LogsArchiveDestinationAzureType: default: azure description: Type of the Azure archive destination. enum: - azure example: azure type: string x-enum-varnames: - AZURE RuleVersions: description: A rule version with a list of updates. properties: changes: description: A list of changes. items: $ref: '#/components/schemas/RuleVersionUpdate' type: array rule: $ref: '#/components/schemas/SecurityMonitoringRuleResponse' type: object RuleTypes: description: Security rule types used as filters in security rules. example: - misconfiguration - attack_path items: $ref: '#/components/schemas/RuleTypesItems' type: array LogsArchiveIntegrationS3: description: The S3 Archive's integration destination. properties: account_id: description: The account ID for the integration. example: '123456789012' type: string role_name: description: The path of the integration. example: role-name type: string required: - role_name - account_id type: object CalculatedField: description: Calculated field. properties: expression: description: Expression. example: '@request_end_timestamp - @request_start_timestamp' type: string name: description: Field name. example: response_time type: string required: - name - expression type: object CloudWorkloadSecurityAgentRuleCreatorAttributes: description: The attributes of the user who created the Agent rule properties: handle: description: The handle of the user example: datadog.user@example.com type: string name: description: The name of the user example: Datadog User nullable: true type: string type: object ContainerImageAttributes: description: Attributes for a Container Image. properties: container_count: description: Number of containers running the image. format: int64 type: integer example: 42 image_flavors: description: 'List of platform-specific images associated with the image record. The list contains more than 1 entry for multi-architecture images.' items: $ref: '#/components/schemas/ContainerImageFlavor' type: array image_tags: description: List of image tags associated with the Container Image. items: description: An image tag associated with the Container Image. type: string type: array images_built_at: description: 'List of build times associated with the Container Image. The list contains more than 1 entry for multi-architecture images.' items: description: Time the platform-specific Container Image was built. type: string type: array name: description: Name of the Container Image. type: string example: Example Monitor os_architectures: description: List of Operating System architectures supported by the Container Image. items: description: Operating System architecture supported by the Container Image. example: amd64 type: string type: array os_names: description: List of Operating System names supported by the Container Image. items: description: Operating System supported by the Container Image. example: linux type: string type: array os_versions: description: List of Operating System versions supported by the Container Image. items: description: Operating System version supported by the Container Image. type: string type: array published_at: description: Time the image was pushed to the container registry. type: string example: example_value registry: description: Registry the Container Image was pushed to. type: string example: example_value repo_digest: description: Digest of the compressed image manifest. type: string example: example_value repository: description: Repository where the Container Image is stored in. type: string example: example_value short_image: description: Short version of the Container Image name. type: string example: example_value sizes: description: 'List of size for each platform-specific image associated with the image record. The list contains more than 1 entry for multi-architecture images.' items: description: Size of the platform-specific Container Image. format: int64 type: integer type: array sources: description: List of sources where the Container Image was collected from. items: description: Source where the Container Image was collected from. type: string type: array tags: description: List of tags associated with the Container Image. items: description: A tag associated with the Container Image. type: string type: array vulnerability_count: $ref: '#/components/schemas/ContainerImageVulnerabilities' type: object ObservabilityPipelineGeneratedMetricIncrementByOne: description: Strategy that increments a generated metric by one for each matching event. properties: strategy: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOneStrategy' required: - strategy type: object SecurityMonitoringSignalRuleResponseQuery: description: Query for matching rule on signals. properties: aggregation: $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation' correlatedByFields: description: Fields to correlate by. items: description: Field. type: string type: array correlatedQueryIndex: description: Index of the rule query used to retrieve the correlated field. format: int32 maximum: 9 type: integer example: 42 defaultRuleId: description: Default Rule ID to match on signals. example: d3f-ru1-e1d type: string distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array metrics: description: Group of target fields to aggregate over. items: description: Field. type: string type: array name: description: Name of the query. type: string example: Example Monitor ruleId: description: Rule ID to match on signals. example: org-ru1-e1d type: string type: object ProcessSummariesResponse: description: List of process summaries. properties: data: description: Array of process summary objects. items: $ref: '#/components/schemas/ProcessSummary' type: array meta: $ref: '#/components/schemas/ProcessSummariesMeta' type: object EntityV3APIKind: description: The definition of Entity V3 API Kind object. enum: - api example: api type: string x-enum-varnames: - API ObservabilityPipelineEnrichmentTableFileEncoding: description: File encoding format. properties: delimiter: description: The `encoding` `delimiter`. example: ',' type: string includes_headers: description: The `encoding` `includes_headers`. example: true type: boolean type: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncodingType' required: - type - delimiter - includes_headers type: object UserResponse: description: Response containing information about a single user. properties: data: $ref: '#/components/schemas/User' included: description: Array of objects related to the user. items: $ref: '#/components/schemas/UserResponseIncludedItem' type: array type: object EntityV3APIDatadog: additionalProperties: false description: Datadog product integrations for the API entity. properties: codeLocations: $ref: '#/components/schemas/EntityV3DatadogCodeLocations' events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' pipelines: $ref: '#/components/schemas/EntityV3DatadogPipelines' type: object EscalationPolicyDataRelationships: description: Represents the relationships for an escalation policy, including references to steps and teams. properties: steps: $ref: '#/components/schemas/EscalationPolicyDataRelationshipsSteps' teams: $ref: '#/components/schemas/DataRelationshipsTeams' required: - steps type: object BillingDimensionsMappingResponse: description: Billing dimensions mapping response. properties: data: $ref: '#/components/schemas/BillingDimensionsMappingBody' type: object TeamOnCallRespondersDataRelationshipsRespondersDataItemsType: default: users description: Identifies the resource type for individual user entities associated with on-call response. enum: - users example: users type: string x-enum-varnames: - USERS ExternalUserNameType: description: The components of user's real name properties: formatted: description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display. type: string example: example_value type: object RetentionFilterResponse: description: The retention filters definition. properties: data: $ref: '#/components/schemas/RetentionFilterAll' type: object HistoricalJobResponseData: description: Historical job response data. properties: attributes: $ref: '#/components/schemas/HistoricalJobResponseAttributes' id: description: ID of the job. type: string example: abc-123-def type: $ref: '#/components/schemas/HistoricalJobDataType' type: object DowntimeMonitorIncludedItem: description: Information about the monitor identified by the downtime. properties: attributes: $ref: '#/components/schemas/DowntimeMonitorIncludedAttributes' id: description: ID of the monitor identified by the downtime. example: 12345 format: int64 type: integer type: $ref: '#/components/schemas/DowntimeIncludedMonitorType' type: object Shift: description: The definition of `Shift` object. example: data: attributes: end: '2025-05-07T03:53:01.206662873Z' start: '2025-05-07T02:53:01.206662814Z' id: 00000000-0000-0000-0000-000000000000 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: shifts included: - attributes: email: foo@bar.com name: User 1 status: '' id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: $ref: '#/components/schemas/ShiftData' nullable: true included: description: The `Shift` `included`. items: $ref: '#/components/schemas/ShiftIncluded' type: array type: object ContainerGroupAttributes: description: Attributes for a container group. properties: count: description: Number of containers in the group. format: int64 type: integer example: 42 tags: description: Tags from the group name parsed in key/value format. type: object type: object DowntimeMonitorIdentifierTags: additionalProperties: {} description: Object of the monitor tags. properties: monitor_tags: description: 'A list of monitor tags. For example, tags that are applied directly to monitors, not tags that are used in monitor queries (which are filtered by the scope parameter), to which the downtime applies. The resulting downtime applies to monitors that match **all** provided monitor tags. Setting `monitor_tags` to `[*]` configures the downtime to mute all monitors for the given scope.' example: - service:postgres - team:frontend items: description: A list of monitor tags. example: service:postgres type: string minItems: 1 type: array required: - monitor_tags type: object NullableUserRelationshipData: description: Relationship to user object. nullable: true properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UserResourceType' required: - id - type type: object TeamOnCallRespondersData: description: Defines the main on-call responder object for a team, including relationships and metadata. properties: id: description: Unique identifier of the on-call responder configuration. type: string example: abc-123-def relationships: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationships' type: $ref: '#/components/schemas/TeamOnCallRespondersDataType' required: - type type: object SpansMetricsResponse: description: All the available span-based metric objects. properties: data: description: A list of span-based metric objects. items: $ref: '#/components/schemas/SpansMetricResponseData' type: array type: object SBOMAttributes: description: The JSON:API attributes of the SBOM. properties: bomFormat: description: Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOM do not have a filename convention nor does JSON schema support namespaces. This value MUST be `CycloneDX`. example: CycloneDX type: string components: description: A list of software and hardware components. items: $ref: '#/components/schemas/SBOMComponent' type: array metadata: $ref: '#/components/schemas/SBOMMetadata' serialNumber: description: Every BOM generated has a unique serial number, even if the contents of the BOM have not changed overt time. The serial number follows [RFC-4122](https://datatracker.ietf.org/doc/html/rfc4122) example: urn:uuid:f7119d2f-1vgh-24b5-91f0-12010db72da7 type: string specVersion: $ref: '#/components/schemas/SpecVersion' version: description: It increments when a BOM is modified. The default value is 1. example: 1 format: int64 type: integer required: - bomFormat - specVersion - components - metadata - serialNumber - version type: object AWSIntegrationType: description: The definition of `AWSIntegrationType` object. enum: - AWS example: AWS type: string x-enum-varnames: - AWS SlackIntegrationMetadataChannelItem: description: Item in the Slack integration metadata channel array. properties: channel_id: description: Slack channel ID. example: C0123456789 type: string channel_name: description: Name of the Slack channel. example: '#example-channel-name' type: string redirect_url: description: URL redirecting to the Slack channel. example: https://slack.com/app_redirect?channel=C0123456789&team=T01234567 type: string team_id: description: Slack team ID. example: T01234567 type: string required: - channel_id - channel_name - redirect_url type: object EntityV3DatadogCodeLocationItem: additionalProperties: false description: Code location item. properties: paths: description: The paths (glob) to the source code of the service. items: type: string type: array repositoryURL: description: The repository path of the source code of the entity. type: string example: https://app.datadoghq.com type: object Metric: description: Object for a single metric tag configuration. example: id: metric.foo.bar type: metrics properties: id: $ref: '#/components/schemas/MetricName' type: $ref: '#/components/schemas/MetricType' type: object ComponentPropertiesIsVisible: description: Whether the UI component is visible. If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string ServiceDefinitionV1Info: description: Basic information about a service. properties: dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: myservice type: string description: description: A short description of the service. example: A shopping cart service type: string display-name: description: A friendly name of the service. example: My Service type: string service-tier: description: Service tier. example: Tier 1 type: string required: - dd-service type: object GetTeamMembershipsSort: description: Specifies the order of returned team memberships enum: - manager_name - -manager_name - name - -name - handle - -handle - email - -email type: string x-enum-varnames: - MANAGER_NAME - _MANAGER_NAME - NAME - _NAME - HANDLE - _HANDLE - EMAIL - _EMAIL CIAppEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from CI Visibility test events. example: customAttribute: 123 duration: 2345 type: object tags: $ref: '#/components/schemas/TagsEventAttribute' test_level: $ref: '#/components/schemas/CIAppTestLevel' type: object IncidentAttachmentAttachmentType: description: The type of the incident attachment attributes. enum: - link - postmortem example: link type: string x-enum-varnames: - LINK - POSTMORTEM SecurityFilter: description: The security filter's properties. properties: attributes: $ref: '#/components/schemas/SecurityFilterAttributes' id: $ref: '#/components/schemas/SecurityFilterID' type: $ref: '#/components/schemas/SecurityFilterType' type: object ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions: description: Configuration for fully redacting sensitive data. properties: replace: description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions` `replace`. example: '***' type: string required: - replace type: object WorkflowUserRelationship: description: The definition of `WorkflowUserRelationship` object. properties: data: $ref: '#/components/schemas/WorkflowUserRelationshipData' type: object RoutingRuleRelationshipsPolicy: description: Defines the relationship that links a routing rule to a policy. properties: data: $ref: '#/components/schemas/RoutingRuleRelationshipsPolicyData' nullable: true type: object DashboardListItems: description: Dashboards within a list. properties: dashboards: description: List of dashboards in the dashboard list. example: [] items: $ref: '#/components/schemas/DashboardListItem' type: array total: description: Number of dashboards in the dashboard list. format: int64 readOnly: true type: integer example: 42 required: - dashboards type: object IncidentTypeType: default: incident_types description: Incident type resource type. enum: - incident_types example: incident_types type: string x-enum-varnames: - INCIDENT_TYPES ServiceDefinitionV2MSTeams: description: Service owner's Microsoft Teams. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Microsoft Teams. example: My team channel type: string type: $ref: '#/components/schemas/ServiceDefinitionV2MSTeamsType' required: - type - contact type: object EscalationPolicyDataRelationshipsSteps: description: Defines the relationship to a collection of steps within an escalation policy. Contains an array of step data references. properties: data: description: An array of references to the steps defined in this escalation policy. items: $ref: '#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItems' type: array type: object Spec: description: The spec defines what the workflow does. properties: annotations: description: A list of annotations used in the workflow. These are like sticky notes for your workflow! items: $ref: '#/components/schemas/Annotation' type: array connectionEnvs: description: A list of connections or connection groups used in the workflow. items: $ref: '#/components/schemas/ConnectionEnv' type: array handle: description: Unique identifier used to trigger workflows automatically in Datadog. type: string example: example_value inputSchema: $ref: '#/components/schemas/InputSchema' outputSchema: $ref: '#/components/schemas/OutputSchema' steps: description: A `Step` is a sub-component of a workflow. Each `Step` performs an action. items: $ref: '#/components/schemas/Step' type: array triggers: description: The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once. items: $ref: '#/components/schemas/Trigger' type: array type: object AWSAuthConfigRole: description: AWS Authentication config to integrate your account using an IAM role. properties: external_id: description: AWS IAM External ID for associated role. type: string example: abc-123-def role_name: description: AWS IAM Role name. example: DatadogIntegrationRole maxLength: 576 minLength: 1 type: string required: - role_name type: object SecurityMonitoringRuleTypeRead: description: The rule type. enum: - log_detection - infrastructure_configuration - workload_security - cloud_configuration - application_security type: string x-enum-varnames: - LOG_DETECTION - INFRASTRUCTURE_CONFIGURATION - WORKLOAD_SECURITY - CLOUD_CONFIGURATION - APPLICATION_SECURITY MonitorNotificationRuleRelationships: description: All relationships associated with monitor notification rule. properties: created_by: $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedBy' type: object CloudWorkloadSecurityAgentRuleActionSet: description: The set action applied on the scope matching the rule properties: append: description: Whether the value should be appended to the field type: boolean example: true field: description: The field of the set action type: string example: example_value name: description: The name of the set action type: string example: Example Monitor scope: description: The scope of the set action type: string example: example_value size: description: The size of the set action format: int64 type: integer example: 42 ttl: description: The time to live of the set action format: int64 type: integer example: 42 value: description: The value of the set action type: string example: example_value type: object SendTeamsMessageActionType: default: send_teams_message description: Indicates that the action is a send Microsoft Teams message action. enum: - send_teams_message example: send_teams_message type: string x-enum-varnames: - SEND_TEAMS_MESSAGE ObservabilityPipelineHttpServerSourceAuthStrategy: description: HTTP authentication method. enum: - none - plain example: plain type: string x-enum-varnames: - NONE - PLAIN ObservabilityPipelineFluentdSource: description: The `fluentd` source ingests logs from a Fluentd-compatible service. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: fluent-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineFluentdSourceType' required: - id - type type: object SecurityMonitoringRuleMaxSignalDuration: description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY StateVariableType: default: stateVariable description: The state variable type. enum: - stateVariable example: stateVariable type: string x-enum-varnames: - STATEVARIABLE ObservabilityPipelineFluentBitSource: description: The `fluent_bit` source ingests logs from Fluent Bit. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: fluent-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineFluentBitSourceType' required: - id - type type: object IncidentIntegrationRelationships: description: The incident's integration relationships from a response. properties: created_by_user: $ref: '#/components/schemas/RelationshipToUser' last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' type: object SLOReportStatusGetResponseAttributes: description: The attributes portion of the SLO report status response. properties: status: $ref: '#/components/schemas/SLOReportStatus' type: object ServiceDefinitionV2Dot1LinkType: description: Link type. enum: - doc - repo - runbook - dashboard - other example: runbook type: string x-enum-varnames: - DOC - REPO - RUNBOOK - DASHBOARD - OTHER InterfaceAttributesStatus: description: The interface status enum: - up - down - warning - 'off' example: up type: string x-enum-varnames: - UP - DOWN - WARNING - 'OFF' MetricCustomAggregation: description: A time and space aggregation combination for use in query. example: space: sum time: sum properties: space: $ref: '#/components/schemas/MetricCustomSpaceAggregation' time: $ref: '#/components/schemas/MetricCustomTimeAggregation' required: - time - space type: object ListTagsResponseData: description: The list tags response data. properties: attributes: $ref: '#/components/schemas/ListTagsResponseDataAttributes' id: description: The device ID example: example:1.2.3.4 type: string type: description: The type of the resource. The value should always be tags. type: string example: metric alert type: object ScheduleDataAttributes: description: Provides core properties of a schedule object such as its name and time zone. properties: name: description: A short name for the schedule. example: Primary On-Call type: string time_zone: description: The time zone in which this schedule operates. example: America/New_York type: string type: object SecurityMonitoringRuleResponse: description: Create a new rule. oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse' AppTriggerWrapper: description: Schema for an App-based trigger. properties: appTrigger: description: Trigger a workflow from an App. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - appTrigger type: object MonitorConfigPolicyTagPolicy: description: Tag attributes of a monitor configuration policy. properties: tag_key: description: The key of the tag. example: datacenter maxLength: 255 type: string tag_key_required: description: If a tag key is required for monitor creation. example: true type: boolean valid_tag_values: description: Valid values for the tag. example: - prod - staging items: maxLength: 255 type: string type: array type: object IncidentAttachmentType: default: incident_attachments description: The incident attachment resource type. enum: - incident_attachments example: incident_attachments type: string x-enum-varnames: - INCIDENT_ATTACHMENTS IncidentUserAttributes: description: Attributes of user object returned by the API. properties: email: description: Email of the user. type: string example: user@example.com handle: description: Handle of the user. type: string example: example_value icon: description: URL of the user's icon. type: string example: example_value name: description: Name of the user. nullable: true type: string example: Example Monitor uuid: description: UUID of the user. type: string example: abc-123-def type: object CIAppTestEvent: description: Object description of test event after being processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/CIAppEventAttributes' id: description: Unique ID of the event. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/CIAppTestEventTypeName' type: object ContainerImageGroupType: default: container_image_group description: Type of Container Image Group. enum: - container_image_group example: container_image_group type: string x-enum-varnames: - CONTAINER_IMAGE_GROUP MonthlyCostAttributionResponse: description: Response containing the monthly cost attribution by tag(s). properties: data: description: Response containing cost attribution. items: $ref: '#/components/schemas/MonthlyCostAttributionBody' type: array meta: $ref: '#/components/schemas/MonthlyCostAttributionMeta' type: object ListApplicationKeysResponse: description: Response for a list of application keys. properties: data: description: Array of application keys. items: $ref: '#/components/schemas/PartialApplicationKey' type: array included: description: Array of objects related to the application key. items: $ref: '#/components/schemas/ApplicationKeyResponseIncludedItem' type: array meta: $ref: '#/components/schemas/ApplicationKeyResponseMeta' type: object BudgetAttributes: description: The attributes of a budget. properties: created_at: description: The timestamp when the budget was created. example: 1738258683590 format: int64 type: integer created_by: description: The id of the user that created the budget. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string end_month: description: The month when the budget ends. example: 202502 format: int64 type: integer entries: description: The entries of the budget. items: $ref: '#/components/schemas/BudgetEntry' type: array metrics_query: description: The cost query used to track against the budget. example: aws.cost.amortized{service:ec2} by {service} type: string name: description: The name of the budget. example: my budget type: string org_id: description: The id of the org the budget belongs to. example: 123 format: int64 type: integer start_month: description: The month when the budget starts. example: 202501 format: int64 type: integer total_amount: description: The sum of all budget entries' amounts. example: 1000 format: double type: number updated_at: description: The timestamp when the budget was last updated. example: 1738258683590 format: int64 type: integer updated_by: description: The id of the user that created the budget. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string type: object FullApplicationKey: description: Datadog application key. properties: attributes: $ref: '#/components/schemas/FullApplicationKeyAttributes' id: description: ID of the application key. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ApplicationKeyRelationships' type: $ref: '#/components/schemas/ApplicationKeysType' type: object x-merge-override: required: false WorkflowTriggerWrapper: description: Schema for a Workflow-based trigger. properties: startStepNames: $ref: '#/components/schemas/StartStepNames' workflowTrigger: description: Trigger a workflow from the Datadog UI. Only required if no other trigger exists. type: object required: - workflowTrigger type: object LayerAttributes: description: Describes key properties of a Layer, including rotation details, name, start/end times, and any restrictions. properties: effective_date: description: When the layer becomes active (ISO 8601). format: date-time type: string example: '2026-04-17T12:00:00Z' end_date: description: When the layer ceases to be active (ISO 8601). format: date-time type: string example: '2026-04-17T12:00:00Z' interval: $ref: '#/components/schemas/LayerAttributesInterval' name: description: The name of this layer. example: Weekend Layer type: string restrictions: description: An optional list of time restrictions for when this layer is in effect. items: $ref: '#/components/schemas/TimeRestriction' type: array rotation_start: description: The date/time when the rotation starts (ISO 8601). format: date-time type: string example: example_value type: object EscalationRelationships: description: Contains the relationships of an escalation object, including its responders. properties: responders: $ref: '#/components/schemas/EscalationRelationshipsResponders' type: object ObservabilityPipelineKafkaSourceSasl: description: Specifies the SASL mechanism for authenticating with a Kafka cluster. properties: mechanism: $ref: '#/components/schemas/ObservabilityPipelinePipelineKafkaSourceSaslMechanism' type: object ObservabilityPipelineSplunkHecDestination: description: 'The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC). ' properties: auto_extract_timestamp: description: 'If `true`, Splunk tries to extract timestamps from incoming log events. If `false`, Splunk assigns the time the event was received. ' example: true type: boolean encoding: $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: splunk-hec-destination type: string index: description: Optional name of the Splunk index where logs are written. example: main type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array sourcetype: description: The Splunk sourcetype to assign to log events. example: custom_sourcetype type: string type: $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationType' required: - id - type - inputs type: object StepDisplay: description: The definition of `StepDisplay` object. properties: bounds: $ref: '#/components/schemas/StepDisplayBounds' type: object RelationshipToUserData: description: Relationship to user object. properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/UsersType' required: - id - type type: object x-merge-override: required: false SecurityMonitoringStandardDataSource: default: logs description: Source of events, either logs, audit trail, or Datadog events. enum: - logs - audit - app_sec_spans - spans - security_runtime - network - events example: logs type: string x-enum-varnames: - LOGS - AUDIT - APP_SEC_SPANS - SPANS - SECURITY_RUNTIME - NETWORK - EVENTS ServiceDefinitionV1Version: default: v1 description: Schema version being used. enum: - v1 example: v1 type: string x-enum-varnames: - V1 DataRelationshipsTeamsDataItemsType: default: teams description: Teams resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS Query: description: A data query used by an app. This can take the form of an external action, a data transformation, or a state variable. oneOf: - $ref: '#/components/schemas/ActionQuery' - $ref: '#/components/schemas/DataTransform' - $ref: '#/components/schemas/StateVariable' ListDevicesResponse: description: List devices response. properties: data: description: The list devices response data. items: $ref: '#/components/schemas/DevicesListData' type: array meta: $ref: '#/components/schemas/ListDevicesResponseMetadata' type: object ActionQuerySpec: description: The definition of the action query. oneOf: - type: string - $ref: '#/components/schemas/ActionQuerySpecObject' ConnectionEnvEnv: description: The definition of `ConnectionEnvEnv` object. enum: - default example: default type: string x-enum-varnames: - DEFAULT IncidentAttachmentLinkAttributes: description: The attributes object for a link attachment. properties: attachment: $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject' attachment_type: $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType' modified: description: Timestamp when the incident attachment link was last modified. format: date-time readOnly: true type: string example: example_value required: - attachment_type - attachment type: object AuditLogsWarning: description: Warning message indicating something that went wrong with the query. properties: code: description: Unique code for this type of warning. example: unknown_index type: string detail: description: Detailed explanation of this specific warning. example: 'indexes: foo, bar' type: string title: description: Short human-readable summary of the warning. example: One or several indexes are missing or invalid, results hold data from the other indexes type: string type: object ContainerImageGroupImagesRelationshipsLink: description: Relationships to Container Images inside a Container Image Group. properties: data: $ref: '#/components/schemas/ContainerImageGroupRelationshipsData' links: $ref: '#/components/schemas/ContainerImageGroupRelationshipsLinks' type: object FindingTags: description: The tags associated with this finding. example: - cloud_provider:aws - myTag:myValue items: description: The list of tags. type: string type: array CIAppTestEventsResponse: description: Response object with all test events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: '#/components/schemas/CIAppTestEvent' type: array links: $ref: '#/components/schemas/CIAppResponseLinks' meta: $ref: '#/components/schemas/CIAppResponseMetadataWithPagination' type: object ListTeamsInclude: description: Included related resources optionally requested. enum: - team_links - user_team_permissions type: string x-enum-varnames: - TEAM_LINKS - USER_TEAM_PERMISSIONS IncidentUserData: description: User object returned by the API. properties: attributes: $ref: '#/components/schemas/IncidentUserAttributes' id: description: ID of the user. type: string example: abc-123-def type: $ref: '#/components/schemas/UsersType' type: object ObservabilityPipelineQuotaProcessorOverride: description: Defines a custom quota limit that applies to specific log events based on matching field values. properties: fields: description: A list of field matchers used to apply a specific override. If an event matches all listed key-value pairs, the corresponding override limit is enforced. items: $ref: '#/components/schemas/ObservabilityPipelineFieldValue' type: array limit: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit' required: - fields - limit type: object AWSAssumeRoleType: description: The definition of `AWSAssumeRoleType` object. enum: - AWSAssumeRole example: AWSAssumeRole type: string x-enum-varnames: - AWSASSUMEROLE AppBuilderEventName: description: The triggering action for the event. enum: - pageChange - tableRowClick - _tableRowButtonClick - change - submit - click - toggleOpen - close - open - executionFinished example: click type: string x-enum-varnames: - PAGECHANGE - TABLEROWCLICK - TABLEROWBUTTONCLICK - CHANGE - SUBMIT - CLICK - TOGGLEOPEN - CLOSE - OPEN - EXECUTIONFINISHED EntityV3DatadogPerformance: additionalProperties: false description: Performance stats association. properties: tags: description: A list of APM entity tags that associates the APM Stats data with the entity. items: type: string type: array type: object SpansFilter: description: The spans filter used to index spans. properties: query: description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/). example: '@http.status_code:200 service:my-service' type: string type: object SecurityMonitoringSignalAttributes: additionalProperties: {} description: 'The object containing all signal attributes and their associated values.' properties: custom: additionalProperties: {} description: A JSON object of attributes in the security signal. example: workflow: first_seen: '2020-06-23T14:46:01.000Z' last_seen: '2020-06-23T14:46:49.000Z' rule: id: 0f5-e0c-805 name: 'Brute Force Attack Grouped By User ' version: 12 type: object message: description: The message in the security signal defined by the rule that generated the signal. example: Detect Account Take Over (ATO) through brute force attempts type: string tags: description: An array of tags associated with the security signal. example: - security:attack - technique:T1110-brute-force items: description: The tag associated with the security signal. type: string type: array timestamp: description: The timestamp of the security signal. example: '2019-01-02T09:42:36.320Z' format: date-time type: string type: object TeamReferenceAttributes: description: Encapsulates the basic attributes of a Team reference, such as name, handle, and an optional avatar or description. properties: avatar: description: URL or reference for the team's avatar (if available). type: string example: example_value description: description: A short text describing the team. type: string example: example_value handle: description: A unique handle/slug for the team. type: string example: example_value name: description: The full, human-readable name of the team. type: string example: Example Monitor type: object CustomDestinationResponseHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER MonitorNotificationRuleData: description: Monitor notification rule data. properties: attributes: $ref: '#/components/schemas/MonitorNotificationRuleResponseAttributes' id: $ref: '#/components/schemas/MonitorNotificationRuleId' relationships: $ref: '#/components/schemas/MonitorNotificationRuleRelationships' type: $ref: '#/components/schemas/MonitorNotificationRuleResourceType' type: object ApplicationKeysType: default: application_keys description: Application Keys resource type. enum: - application_keys example: application_keys type: string x-enum-varnames: - APPLICATION_KEYS ObservabilityPipelineAmazonS3Source: description: 'The `amazon_s3` source ingests logs from an Amazon S3 bucket. It supports AWS authentication and TLS encryption. ' properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAwsAuth' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: aws-s3-source type: string region: description: AWS region where the S3 bucket resides. example: us-east-1 type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineAmazonS3SourceType' required: - id - type - region type: object RumMetricComputeIncludePercentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when `aggregation_type` is `distribution`.' example: true type: boolean RelationshipToUserTeamPermissionData: description: Related user team permission data properties: id: description: The ID of the user team permission example: UserTeamPermissions-aeadc05e-98a8-11ec-ac2c-da7ad0900001-416595 type: string type: $ref: '#/components/schemas/UserTeamPermissionType' required: - id - type type: object x-merge-override: required: false CloudflareAccountResponse: description: The expected response schema when getting a Cloudflare account. properties: data: $ref: '#/components/schemas/CloudflareAccountResponseData' type: object ContainerMetaPageType: default: cursor_limit description: Type of Container pagination. enum: - cursor_limit example: cursor_limit type: string x-enum-varnames: - CURSOR_LIMIT EntityResponseIncludedIncident: description: Included incident. properties: attributes: $ref: '#/components/schemas/EntityResponseIncludedRelatedIncidentAttributes' id: description: Incident ID. type: string example: abc-123-def type: $ref: '#/components/schemas/EntityResponseIncludedIncidentType' type: object ConfluentResourceResponseAttributes: description: Model representation of a Confluent Cloud resource. properties: enable_custom_metrics: default: false description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags. example: false type: boolean id: description: The ID associated with the Confluent resource. example: resource_id_abc123 type: string resource_type: description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, or `schema_registry`. example: kafka type: string tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: type: string type: array required: - resource_type type: object x-merge-override: required: false ObservabilityPipelineAmazonS3Destination: description: The `amazon_s3` destination sends your logs in Datadog-rehydratable format to an Amazon S3 bucket for archiving. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAwsAuth' bucket: description: S3 bucket name. example: error-logs type: string id: description: Unique identifier for the destination component. example: amazon-s3-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array key_prefix: description: Optional prefix for object keys. type: string example: example_value region: description: AWS region of the S3 bucket. example: us-east-1 type: string storage_class: $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationType' required: - id - type - inputs - bucket - region - storage_class type: object CIAppPipelineLevel: description: Pipeline execution level. enum: - pipeline - stage - job - step - custom example: pipeline type: string x-enum-varnames: - PIPELINE - STAGE - JOB - STEP - CUSTOM ServiceDefinitionV2Dot2Type: description: The type of service. example: web type: string TimeAggregation: description: 'Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation. Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation. Notifications are only sent for new issues discovered during the window. Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation is done.' example: 86400 format: int64 type: integer AWSNamespaceFiltersExcludeOnly: description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`. `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.' properties: exclude_only: description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`. `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.' example: - AWS/SQS - AWS/ElasticMapReduce items: example: AWS/SQS type: string type: array required: - exclude_only type: object ObservabilityPipelineFieldValue: description: Represents a static key-value pair used in various processors. properties: name: description: The field name. example: field_name type: string value: description: The field value. example: field_value type: string required: - name - value type: object CaseResponse: description: Case response properties: data: $ref: '#/components/schemas/Case' type: object ObservabilityPipelineDataAttributes: description: Defines the pipeline’s name and its components (sources, processors, and destinations). properties: config: $ref: '#/components/schemas/ObservabilityPipelineConfig' name: description: Name of the pipeline. example: Main Observability Pipeline type: string required: - name - config type: object Date: description: Date as Unix timestamp in milliseconds. example: 1722439510282 format: int64 type: integer ApplicationKeyResponseMeta: description: Additional information related to the application key response. properties: max_allowed_per_user: description: Max allowed number of application keys per user. format: int64 type: integer example: 42 page: $ref: '#/components/schemas/ApplicationKeyResponseMetaPage' type: object EntityV3Service: additionalProperties: false description: Schema for service entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3ServiceDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3ServiceKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3ServiceSpec' required: - apiVersion - kind - metadata type: object ObservabilityPipelineDatadogAgentSourceType: default: datadog_agent description: The source type. The value should always be `datadog_agent`. enum: - datadog_agent example: datadog_agent type: string x-enum-varnames: - DATADOG_AGENT EntityResponseIncludedSchemaType: description: Schema type. enum: - schema type: string x-enum-varnames: - SCHEMA SpansMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the span-based metric will be aggregated over. example: resource_name type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: resource_name type: string type: object IncidentResponseIncludedItem: description: An object related to an incident that is included in the response. oneOf: - $ref: '#/components/schemas/IncidentUserData' - $ref: '#/components/schemas/IncidentAttachmentData' ObservabilityPipelineFluentBitSourceType: default: fluent_bit description: The source type. The value should always be `fluent_bit`. enum: - fluent_bit example: fluent_bit type: string x-enum-varnames: - FLUENT_BIT WorkflowDataType: description: The definition of `WorkflowDataType` object. enum: - workflows example: workflows type: string x-enum-varnames: - WORKFLOWS ContainerGroup: description: Container group object. properties: attributes: $ref: '#/components/schemas/ContainerGroupAttributes' id: description: Container Group ID. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ContainerGroupRelationships' type: $ref: '#/components/schemas/ContainerGroupType' type: object LogsListResponseLinks: description: Links attributes. properties: next: description: 'Link for the next set of results. Note that the request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/logs/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object ContainerType: default: container description: Type of container. enum: - container example: container type: string x-enum-varnames: - CONTAINER OnDemandConcurrencyCapResponse: description: On-demand concurrency cap response. properties: data: $ref: '#/components/schemas/OnDemandConcurrencyCap' type: object ContainerImageMetaPageType: default: cursor_limit description: Type of Container Image pagination. enum: - cursor_limit example: cursor_limit type: string x-enum-varnames: - CURSOR_LIMIT MonitorConfigPolicyResourceType: default: monitor-config-policy description: Monitor configuration policy resource type. enum: - monitor-config-policy example: monitor-config-policy type: string x-enum-varnames: - MONITOR_CONFIG_POLICY RelationshipToTeamLinkData: description: Relationship between a link and a team properties: id: description: The team link's identifier example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamLinkType' required: - id - type type: object x-merge-override: required: false RumMetricResponse: description: The rum-based metric object. properties: data: $ref: '#/components/schemas/RumMetricResponseData' type: object DowntimeNotifyEndTypes: description: Actions that will trigger a monitor notification if the downtime is in the `notify_end_types` state. example: - canceled - expired items: $ref: '#/components/schemas/DowntimeNotifyEndStateActions' type: array ActionQuerySpecInput: additionalProperties: {} description: The inputs to the action query. See the [Actions Catalog](https://docs.datadoghq.com/actions/actions_catalog/) for more detail on each action and its inputs. type: object OrderDirection: description: The sort direction for results. enum: - asc - desc example: asc type: string x-enum-varnames: - ASC - DESC IncidentIntegrationMetadataListResponse: description: Response with a list of incident integration metadata. properties: data: description: An array of incident integration metadata. items: $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData' type: array included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem' readOnly: true type: array meta: $ref: '#/components/schemas/IncidentResponseMeta' required: - data type: object AuditLogsResponseStatus: description: The status of the response. enum: - done - timeout example: done type: string x-enum-varnames: - DONE - TIMEOUT RUMApplication: description: RUM application. properties: attributes: $ref: '#/components/schemas/RUMApplicationAttributes' id: description: RUM application ID. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string x-merge-override: format: false type: $ref: '#/components/schemas/RUMApplicationType' required: - attributes - id - type type: object ServiceDefinitionV1ResourceType: description: Link type. enum: - doc - wiki - runbook - url - repo - dashboard - oncall - code - link example: runbook type: string x-enum-varnames: - DOC - WIKI - RUNBOOK - URL - REPO - DASHBOARD - ONCALL - CODE - LINK MonthlyCostAttributionPagination: description: The metadata for the current pagination. properties: next_record_id: description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `next_record_id`. nullable: true type: string example: abc-123-def type: object DowntimeResourceType: default: downtime description: Downtime resource type. enum: - downtime example: downtime type: string x-enum-varnames: - DOWNTIME CaseStatus: description: Case status enum: - OPEN - IN_PROGRESS - CLOSED example: OPEN type: string x-enum-varnames: - OPEN - IN_PROGRESS - CLOSED TeamLinkType: default: team_links description: Team link type enum: - team_links example: team_links type: string x-enum-varnames: - TEAM_LINKS DowntimeMonitorIdentifierId: additionalProperties: {} description: Object of the monitor identifier. properties: monitor_id: description: ID of the monitor to prevent notifications. example: 123 format: int64 type: integer required: - monitor_id type: object ServiceDefinitionV2Dot2Contact: description: Service owner's contacts information. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Name. example: My team channel type: string type: description: 'Contact type. Datadog recognizes the following types: `email`, `slack`, and `microsoft-teams`.' example: slack type: string required: - type - contact type: object MicrosoftTeamsChannelInfoResponseAttributes: description: Channel attributes. properties: is_primary: description: Indicates if this is the primary channel. example: true maxLength: 255 type: boolean team_id: description: Team id. example: 00000000-0000-0000-0000-000000000000 maxLength: 255 type: string tenant_id: description: Tenant id. example: 00000000-0000-0000-0000-000000000001 maxLength: 255 type: string type: object x-merge-override: required: false BudgetEntry: description: The entry of a budget. properties: amount: description: The `amount` of the budget entry. example: 500 format: double type: number month: description: The `month` of the budget entry. example: 202501 format: int64 type: integer tag_filters: description: The `tag_filters` of the budget entry. items: $ref: '#/components/schemas/TagFilter' type: array type: object AuthNMappingTeamAttributes: description: Team attributes. properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: đŸ¥‘ nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer example: 42 handle: description: The team's identifier example: example-team maxLength: 195 type: string link_count: description: The number of links belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 name: description: The name of the team example: Example Team maxLength: 200 type: string summary: description: A brief summary of the team, derived from the `description` maxLength: 120 nullable: true type: string example: example_value user_count: description: The number of users belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 type: object MicrosoftTeamsWorkflowsWebhookHandleResponse: description: Response of a Workflows webhook handle. properties: data: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponseData' required: - data type: object FastlyServiceData: description: Data object for Fastly service requests. properties: attributes: $ref: '#/components/schemas/FastlyServiceAttributes' id: description: The ID of the Fastly service. example: abc123 type: string type: $ref: '#/components/schemas/FastlyServiceType' required: - id - type type: object ConfluentAccountResponseAttributes: description: The attributes of a Confluent account. properties: api_key: description: The API key associated with your Confluent account. example: TESTAPIKEY123 type: string resources: description: A list of Confluent resources associated with the Confluent account. items: $ref: '#/components/schemas/ConfluentResourceResponseAttributes' type: array tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: type: string type: array required: - api_key type: object EntityV3ServiceKind: description: The definition of Entity V3 Service Kind object. enum: - service example: service type: string x-enum-varnames: - SERVICE ObservabilityPipelineSensitiveDataScannerProcessorScopeAll: description: Applies scanning across all available fields. properties: target: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget' required: - target type: object RestrictionQueryListResponse: description: Response containing information about multiple restriction queries. properties: data: description: Array of returned restriction queries. items: $ref: '#/components/schemas/RestrictionQueryWithoutRelationships' type: array type: object RUMEventsResponse: description: Response object with all events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: '#/components/schemas/RUMEvent' type: array links: $ref: '#/components/schemas/RUMResponseLinks' meta: $ref: '#/components/schemas/RUMResponseMetadata' type: object CsmAgentsResponse: description: Response object that includes a list of CSM Agents. properties: data: description: A list of Agents. items: $ref: '#/components/schemas/CsmAgentData' type: array meta: $ref: '#/components/schemas/CSMAgentsMetadata' type: object DowntimeStatus: description: The current status of the downtime. enum: - active - canceled - ended - scheduled example: active type: string x-enum-varnames: - ACTIVE - CANCELED - ENDED - SCHEDULED CloudWorkloadSecurityAgentRuleType: default: agent_rule description: The type of the resource, must always be `agent_rule` enum: - agent_rule example: agent_rule type: string x-enum-varnames: - AGENT_RULE EntityV3DatadogIntegrationPagerduty: additionalProperties: false description: A PagerDuty integration schema. properties: serviceURL: description: The service URL for the PagerDuty integration. example: https://www.pagerduty.com/service-directory/Pshopping-cart minLength: 1 type: string required: - serviceURL type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions: description: Fields to which the scope rule applies. properties: fields: description: The `ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions` `fields`. example: - '' items: type: string type: array required: - fields type: object ContainersResponseLinks: description: Pagination links. properties: first: description: Link to the first page. type: string example: example_value last: description: Link to the last page. nullable: true type: string example: example_value next: description: Link to the next page. nullable: true type: string example: example_value prev: description: Link to previous page. nullable: true type: string example: example_value self: description: Link to current page. type: string example: example_value type: object SpansType: default: spans description: Type of the span. enum: - spans example: spans type: string x-enum-varnames: - SPANS IncidentRelatedObject: description: Object related to an incident. enum: - users - attachments type: string x-enum-varnames: - USERS - ATTACHMENTS GetWorkflowResponse: description: The response object after getting a workflow. properties: data: $ref: '#/components/schemas/WorkflowData' type: object SecurityMonitoringSignalListRequestFilter: description: Search filters for listing security signals. properties: from: description: The minimum timestamp for requested security signals. example: '2019-01-02T09:42:36.320Z' format: date-time type: string query: description: Search query for listing security signals. example: security:attack status:high type: string to: description: The maximum timestamp for requested security signals. example: '2019-01-03T09:42:36.320Z' format: date-time type: string type: object AWSMetricsConfig: description: AWS Metrics Collection config. properties: automute_enabled: description: Enable EC2 automute for AWS metrics. Defaults to `true`. example: true type: boolean collect_cloudwatch_alarms: description: Enable CloudWatch alarms collection. Defaults to `false`. example: false type: boolean collect_custom_metrics: description: Enable custom metrics collection. Defaults to `false`. example: false type: boolean enabled: description: Enable AWS metrics collection. Defaults to `true`. example: true type: boolean namespace_filters: $ref: '#/components/schemas/AWSNamespaceFilters' tag_filters: description: AWS Metrics collection tag filters list. Defaults to `[]`. items: $ref: '#/components/schemas/AWSNamespaceTagFilter' type: array type: object ObservabilityPipelineSplunkHecDestinationEncoding: description: Encoding format for log events. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE DowntimeRelationshipsMonitorData: description: Data for the monitor. nullable: true properties: id: description: Monitor ID of the downtime. example: '12345' type: string type: $ref: '#/components/schemas/DowntimeIncludedMonitorType' type: object FastlyServiceResponse: description: The expected response schema when getting a Fastly service. properties: data: $ref: '#/components/schemas/FastlyServiceData' type: object FindingMute: additionalProperties: false description: Information about the mute status of this finding. properties: description: description: Additional information about the reason why this finding is muted or unmuted. example: To be resolved later type: string expiration_date: description: The expiration date of the mute or unmute action (Unix ms). example: 1778721573794 format: int64 type: integer muted: description: Whether this finding is muted or unmuted. example: true type: boolean reason: $ref: '#/components/schemas/FindingMuteReason' start_date: description: The start of the mute period. example: 1678721573794 format: int64 type: integer uuid: description: The ID of the user who muted or unmuted this finding. example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string type: object RelationshipToIncidentUserDefinedFields: description: Relationship to incident user defined fields. properties: data: description: An array of user defined fields. items: $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFieldData' type: array required: - data type: object DataTransform: description: A data transformer, which is custom JavaScript code that executes and transforms data when its inputs change. properties: id: description: The ID of the data transformer. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this data transformer. This name is also used to access the transformer's result throughout the app. example: combineTwoOrders type: string properties: $ref: '#/components/schemas/DataTransformProperties' type: $ref: '#/components/schemas/DataTransformType' required: - id - name - type - properties type: object RestrictionQueryWithRelationshipsResponse: description: Response containing information about a single restriction query. properties: data: $ref: '#/components/schemas/RestrictionQueryWithRelationships' included: description: Array of objects related to the restriction query. items: $ref: '#/components/schemas/RestrictionQueryResponseIncludedItem' type: array type: object MonitorConfigPolicyListResponse: description: Response for retrieving all monitor configuration policies. properties: data: description: An array of monitor configuration policies. items: $ref: '#/components/schemas/MonitorConfigPolicyResponseData' type: array type: object UserResponseIncludedItem: description: An object related to a user. oneOf: - $ref: '#/components/schemas/Organization' - $ref: '#/components/schemas/Permission' - $ref: '#/components/schemas/Role' AuditLogsEventType: default: audit description: Type of the event. enum: - audit example: audit type: string x-enum-varnames: - Audit LayerType: default: layers description: Layers resource type. enum: - layers example: layers type: string x-enum-varnames: - LAYERS RuleVersionUpdate: description: A change in a rule version. properties: change: description: The new value of the field. example: cloud_provider:aws type: string field: description: The field that was changed. example: Tags type: string type: $ref: '#/components/schemas/RuleVersionUpdateType' type: object MicrosoftTeamsTenantBasedHandleInfoResponseAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: fake-channel-id maxLength: 255 type: string channel_name: description: Channel name. example: fake-channel-name maxLength: 255 type: string name: description: Tenant-based handle name. example: fake-handle-name maxLength: 255 type: string team_id: description: Team id. example: 00000000-0000-0000-0000-000000000000 maxLength: 255 type: string team_name: description: Team name. example: fake-team-name maxLength: 255 type: string tenant_id: description: Tenant id. example: 00000000-0000-0000-0000-000000000001 maxLength: 255 type: string tenant_name: description: Tenant name. example: fake-tenant-name maxLength: 255 type: string type: object x-merge-override: required: false ObservabilityPipelineRsyslogSourceType: default: rsyslog description: The source type. The value should always be `rsyslog`. enum: - rsyslog example: rsyslog type: string x-enum-varnames: - RSYSLOG ObservabilityPipelineOcsfMappingLibrary: description: Predefined library mappings for common log formats. enum: - CloudTrail Account Change - GCP Cloud Audit CreateBucket - GCP Cloud Audit CreateSink - GCP Cloud Audit SetIamPolicy - GCP Cloud Audit UpdateSink - Github Audit Log API Activity - Google Workspace Admin Audit addPrivilege - Microsoft 365 Defender Incident - Microsoft 365 Defender UserLoggedIn - Okta System Log Authentication - Palo Alto Networks Firewall Traffic example: CloudTrail Account Change type: string x-enum-varnames: - CLOUDTRAIL_ACCOUNT_CHANGE - GCP_CLOUD_AUDIT_CREATEBUCKET - GCP_CLOUD_AUDIT_CREATESINK - GCP_CLOUD_AUDIT_SETIAMPOLICY - GCP_CLOUD_AUDIT_UPDATESINK - GITHUB_AUDIT_LOG_API_ACTIVITY - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE - MICROSOFT_365_DEFENDER_INCIDENT - MICROSOFT_365_DEFENDER_USERLOGGEDIN - OKTA_SYSTEM_LOG_AUTHENTICATION - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC TeamsResponseMeta: description: Teams response metadata. properties: pagination: $ref: '#/components/schemas/TeamsResponseMetaPagination' type: object RuleSeverity: description: Severity of a security rule. enum: - critical - high - medium - low - unknown - info example: critical type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - UNKNOWN - INFO CIAppPipelineEventTypeName: description: Type of the event. enum: - cipipeline example: cipipeline type: string x-enum-varnames: - CIPIPELINE SingleAggregatedConnectionResponseData: description: Object describing an aggregated connection. properties: attributes: $ref: '#/components/schemas/SingleAggregatedConnectionResponseDataAttributes' id: description: A unique identifier for the aggregated connection based on the group by values. type: string example: abc-123-def type: $ref: '#/components/schemas/SingleAggregatedConnectionResponseDataType' type: object CIAppWarning: description: A warning message indicating something that went wrong with the query. properties: code: description: A unique code for this type of warning. example: unknown_index type: string detail: description: A detailed explanation of this specific warning. example: 'indexes: foo, bar' type: string title: description: A short human-readable summary of the warning. example: One or several indexes are missing or invalid, results hold data from the other indexes type: string type: object ActionQueryOnlyTriggerManually: description: Determines when this query is executed. If set to `false`, the query will run when the app loads and whenever any query arguments change. If set to `true`, the query will only run when manually triggered from elsewhere in the app. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string RoutingRuleAttributes: description: Defines the configurable attributes of a routing rule, such as actions, query, time restriction, and urgency. properties: actions: description: Specifies the list of actions to perform when the routing rule matches. items: $ref: '#/components/schemas/RoutingRuleAction' type: array query: description: Defines the query or condition that triggers this routing rule. type: string example: avg:system.cpu.user{*} time_restriction: $ref: '#/components/schemas/TimeRestrictions' nullable: true urgency: $ref: '#/components/schemas/Urgency' type: object SpansWarning: description: A warning message indicating something that went wrong with the query. properties: code: description: A unique code for this type of warning. example: unknown_index type: string detail: description: A detailed explanation of this specific warning. example: 'indexes: foo, bar' type: string title: description: A short human-readable summary of the warning. example: One or several indexes are missing or invalid, results hold data from the other indexes type: string type: object EscalationPolicyUserAttributes: description: Provides basic user information for an escalation policy, including a name and email address. properties: email: description: The user's email address. example: jane.doe@example.com type: string name: description: The user's name. example: Jane Doe type: string status: $ref: '#/components/schemas/UserAttributesStatus' type: object MicrosoftTeamsTenantBasedHandleResponse: description: Response of a tenant-based handle. properties: data: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleResponseData' required: - data type: object DowntimeMessage: description: 'A message to include with notifications for this downtime. Email notifications can be sent to specific users by using the same `@username` notation as events.' example: Message about the downtime nullable: true type: string CostByOrgResponse: description: Chargeback Summary response. properties: data: description: Response containing Chargeback Summary. items: $ref: '#/components/schemas/CostByOrg' type: array type: object ActionConnectionDataType: description: The definition of `ActionConnectionDataType` object. enum: - action_connection example: action_connection type: string x-enum-varnames: - ACTION_CONNECTION HistoricalJobQuery: description: Query for selecting logs analyzed by the historical job. properties: aggregation: $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation' dataSource: $ref: '#/components/schemas/SecurityMonitoringStandardDataSource' distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array hasOptionalGroupByFields: description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. example: false readOnly: true type: boolean metrics: description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. items: description: Field. type: string type: array name: description: Name of the query. type: string example: Example Monitor query: description: Query to run on logs. example: a > 3 type: string type: object EscalationPolicyIncluded: description: Represents included related resources when retrieving an escalation policy, such as teams, steps, or targets. oneOf: - $ref: '#/components/schemas/TeamReference' - $ref: '#/components/schemas/EscalationPolicyStep' - $ref: '#/components/schemas/EscalationPolicyUser' - $ref: '#/components/schemas/ScheduleData' CostAttributionAggregates: description: An array of available aggregates. items: $ref: '#/components/schemas/CostAttributionAggregatesBody' type: array ServiceDefinitionV2Version: default: v2 description: Schema version being used. enum: - v2 example: v2 type: string x-enum-varnames: - V2 DORAListDeploymentsRequestAttributes: description: Attributes to get a list of deployments. properties: from: description: Minimum timestamp for requested events. format: date-time type: string example: example_value limit: default: 10 description: Maximum number of events in the response. format: int32 maximum: 1000 type: integer example: 42 query: description: Search query with event platform syntax. type: string example: avg:system.cpu.user{*} sort: description: Sort order (prefixed with `-` for descending). type: string example: example_value to: description: Maximum timestamp for requested events. format: date-time type: string example: example_value type: object FullCustomFrameworkDataAttributes: description: Full Framework Data Attributes. properties: handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL example: https://example.com/icon.png type: string name: description: Framework Name example: security-framework type: string requirements: description: Framework Requirements items: $ref: '#/components/schemas/CustomFrameworkRequirement' type: array version: description: Framework Version example: '2' type: string required: - handle - version - name - requirements type: object OnDemandConcurrencyCapType: description: On-demand concurrency cap type. enum: - on_demand_concurrency_cap type: string x-enum-varnames: - ON_DEMAND_CONCURRENCY_CAP SecurityTriggerWrapper: description: Schema for a Security-based trigger. properties: securityTrigger: $ref: '#/components/schemas/SecurityTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - securityTrigger type: object CloudWorkloadSecurityAgentPoliciesListResponse: description: Response object that includes a list of Agent policies properties: data: description: A list of Agent policy objects items: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyData' type: array type: object CloudflareAccountResponseData: description: Data object of a Cloudflare account. properties: attributes: $ref: '#/components/schemas/CloudflareAccountResponseAttributes' id: description: The ID of the Cloudflare account, a hash of the account name. example: c1a8e059bfd1e911cf10b626340c9a54 type: string type: $ref: '#/components/schemas/CloudflareAccountType' required: - attributes - id - type type: object x-merge-override: required: false ScheduleDataRelationships: description: Groups the relationships for a schedule object, referencing layers and teams. properties: layers: $ref: '#/components/schemas/ScheduleDataRelationshipsLayers' teams: $ref: '#/components/schemas/DataRelationshipsTeams' type: object RestrictionQueryWithRelationships: description: Restriction query object returned by the API. properties: attributes: $ref: '#/components/schemas/RestrictionQueryAttributes' id: description: ID of the restriction query. example: 79a0e60a-644a-11ea-ad29-43329f7f58b5 type: string relationships: $ref: '#/components/schemas/RestrictionQueryRelationships' type: $ref: '#/components/schemas/LogsRestrictionQueriesType' type: object IPAllowlistResponse: description: Response containing information about the IP allowlist. properties: data: $ref: '#/components/schemas/IPAllowlistData' type: object NotificationRuleResponse: description: Response object which includes a notification rule. properties: data: $ref: '#/components/schemas/NotificationRule' type: object ServiceDefinitionsListResponse: description: Create service definitions response. properties: data: description: Data representing service definitions. items: $ref: '#/components/schemas/ServiceDefinitionData' type: array type: object TeamPermissionSettingValue: description: What type of user is allowed to perform the specified action enum: - admins - members - organization - user_access_manage - teams_manage type: string x-enum-varnames: - ADMINS - MEMBERS - ORGANIZATION - USER_ACCESS_MANAGE - TEAMS_MANAGE EntityResponseIncludedRelatedIncidentAttributes: description: Incident attributes. properties: createdAt: description: Incident creation time. format: date-time type: string example: example_value htmlURL: description: Incident URL. type: string example: https://app.datadoghq.com provider: description: Incident provider. type: string example: abc-123-def status: description: Incident status. type: string example: OK title: description: Incident title. type: string example: Example Monitor type: object RumRetentionFilterResponse: description: The RUM retention filter object. properties: data: $ref: '#/components/schemas/RumRetentionFilterData' type: object LogsRestrictionQueriesType: default: logs_restriction_queries description: Restriction query resource type. enum: - logs_restriction_queries example: logs_restriction_queries type: string x-enum-varnames: - LOGS_RESTRICTION_QUERIES EntityAttributes: description: Entity attributes. properties: apiVersion: description: The API version. type: string example: example_value description: description: The description. type: string example: example_value displayName: description: The display name. type: string example: Example Monitor kind: description: The kind. type: string example: example_value name: description: The name. type: string example: Example Monitor namespace: description: The namespace. type: string example: Example Monitor owner: description: The owner. type: string example: example_value tags: description: The tags. items: type: string type: array type: object LogsResponseMetadata: description: The metadata associated with a request properties: elapsed: description: The time elapsed in milliseconds example: 132 format: int64 type: integer page: $ref: '#/components/schemas/LogsResponseMetadataPage' request_id: description: The identifier of the request example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR type: string status: $ref: '#/components/schemas/LogsAggregateResponseStatus' warnings: description: 'A list of warnings (non fatal errors) encountered, partial results might be returned if warnings are present in the response.' items: $ref: '#/components/schemas/LogsWarning' type: array type: object RelationResponseMeta: description: Relation response metadata. properties: count: description: Total relations count. format: int64 type: integer example: 42 includeCount: description: Total included data count. format: int64 type: integer example: 42 type: object FindingEvaluationChangedAt: description: The date on which the evaluation for this finding changed (Unix ms). example: 1678721573794 format: int64 minimum: 1 type: integer ServiceDefinitionV2Dot1MSTeamsType: description: Contact type. enum: - microsoft-teams example: microsoft-teams type: string x-enum-varnames: - MICROSOFT_TEAMS Event: description: The metadata associated with a request. properties: id: description: Event ID. example: '6509751066204996294' type: string name: description: The event name. type: string example: Example Monitor source_id: description: Event source ID. example: 36 format: int64 type: integer type: description: Event type. example: error_tracking_alert type: string type: object APIErrorResponse: description: API error response. properties: errors: description: A list of errors. example: - Bad Request items: description: A list of items. example: Bad Request type: string type: array required: - errors type: object ObservabilityPipelineAmazonOpenSearchDestination: description: The `amazon_opensearch` destination writes logs to Amazon OpenSearch. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuth' bulk_index: description: The index to write logs to. example: logs-index type: string id: description: The unique identifier for this component. example: elasticsearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationType' required: - id - type - inputs - auth type: object LogsMetricID: description: The name of the log-based metric. example: logs.page.load.count type: string EventResponse: description: The object description of an event after being processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/EventResponseAttributes' id: description: the unique ID of the event. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/EventType' type: object ActionQueryRequiresConfirmation: description: Whether to prompt the user to confirm this query before it runs. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string ObservabilityPipelineEnrichmentTableGeoIp: description: Uses a GeoIP database to enrich logs based on an IP field. properties: key_field: description: Path to the IP field in the log. example: log.source.ip type: string locale: description: Locale used to resolve geographical names. example: en type: string path: description: Path to the GeoIP database file. example: /etc/geoip/GeoLite2-City.mmdb type: string required: - key_field - locale - path type: object LayerRelationshipsMembersDataItemsType: default: members description: Members resource type. enum: - members example: members type: string x-enum-varnames: - MEMBERS RunRetentionFilterName: description: The name of a RUM retention filter. example: Retention filter for session type: string IncidentResponseAttributes: description: The incident's attributes from a response. properties: archived: description: Timestamp of when the incident was archived. format: date-time nullable: true readOnly: true type: string example: example_value case_id: description: The incident case id. format: int64 nullable: true type: integer example: 42 created: description: Timestamp when the incident was created. format: date-time readOnly: true type: string example: example_value customer_impact_duration: description: 'Length of the incident''s customer impact in seconds. Equals the difference between `customer_impact_start` and `customer_impact_end`.' format: int64 readOnly: true type: integer example: 42 customer_impact_end: description: Timestamp when customers were no longer impacted by the incident. format: date-time nullable: true type: string example: example_value customer_impact_scope: description: A summary of the impact customers experienced during the incident. example: An example customer impact scope nullable: true type: string customer_impact_start: description: Timestamp when customers began being impacted by the incident. format: date-time nullable: true type: string example: example_value customer_impacted: description: A flag indicating whether the incident caused customer impact. example: false type: boolean detected: description: Timestamp when the incident was detected. format: date-time nullable: true type: string example: example_value fields: additionalProperties: $ref: '#/components/schemas/IncidentFieldAttributes' description: A condensed view of the user-defined fields attached to incidents. example: severity: type: dropdown value: SEV-5 type: object incident_type_uuid: description: A unique identifier that represents an incident type. example: 00000000-0000-0000-0000-000000000000 type: string modified: description: Timestamp when the incident was last modified. format: date-time readOnly: true type: string example: example_value non_datadog_creator: $ref: '#/components/schemas/IncidentNonDatadogCreator' notification_handles: description: Notification handles that will be notified of the incident during update. example: - display_name: Jane Doe handle: '@user@email.com' - display_name: Slack Channel handle: '@slack-channel' - display_name: Incident Workflow handle: '@workflow-from-incident' items: $ref: '#/components/schemas/IncidentNotificationHandle' nullable: true type: array public_id: description: The monotonically increasing integer ID for the incident. example: 1 format: int64 type: integer resolved: description: Timestamp when the incident's state was last changed from active or stable to resolved or completed. format: date-time nullable: true type: string example: example_value severity: $ref: '#/components/schemas/IncidentSeverity' state: description: The state incident. nullable: true type: string example: example_value time_to_detect: description: 'The amount of time in seconds to detect the incident. Equals the difference between `customer_impact_start` and `detected`.' format: int64 readOnly: true type: integer example: 42 time_to_internal_response: description: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`. format: int64 readOnly: true type: integer example: 42 time_to_repair: description: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`. format: int64 readOnly: true type: integer example: 42 time_to_resolve: description: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`. format: int64 readOnly: true type: integer example: 42 title: description: The title of the incident, which summarizes what happened. example: A test incident title type: string visibility: description: The incident visibility status. nullable: true type: string example: example_value required: - title type: object MicrosoftTeamsChannelInfoType: default: ms-teams-channel-info description: Channel info resource type. enum: - ms-teams-channel-info example: ms-teams-channel-info type: string x-enum-varnames: - MS_TEAMS_CHANNEL_INFO GetAppResponseData: description: The data object containing the app definition. properties: attributes: $ref: '#/components/schemas/GetAppResponseDataAttributes' id: description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: '#/components/schemas/AppDefinitionType' required: - id - type - attributes type: object SecurityMonitoringSuppressionsResponse: description: Response object containing the available suppression rules. properties: data: description: A list of suppressions objects. items: $ref: '#/components/schemas/SecurityMonitoringSuppression' type: array type: object BudgetWithEntries: description: The definition of the `BudgetWithEntries` object. properties: data: $ref: '#/components/schemas/BudgetWithEntriesData' type: object EntityV3MetadataAdditionalOwnersItems: description: The definition of Entity V3 Metadata Additional Owners Items object. properties: name: description: Team name. example: '' type: string type: description: Team type. type: string example: metric alert required: - name type: object ContainerImageVulnerabilities: description: Vulnerability counts associated with the Container Image. properties: asset_id: description: ID of the Container Image. type: string example: abc-123-def critical: description: Number of vulnerabilities with CVSS Critical severity. format: int64 type: integer example: 42 high: description: Number of vulnerabilities with CVSS High severity. format: int64 type: integer example: 42 low: description: Number of vulnerabilities with CVSS Low severity. format: int64 type: integer example: 42 medium: description: Number of vulnerabilities with CVSS Medium severity. format: int64 type: integer example: 42 none: description: Number of vulnerabilities with CVSS None severity. format: int64 type: integer example: 42 unknown: description: Number of vulnerabilities with an unknown CVSS severity. format: int64 type: integer example: 42 type: object ApplicationSecurityWafCustomRuleActionParameters: description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object. properties: location: description: The location to redirect to when the WAF custom rule triggers. example: /blocking type: string status_code: default: 403 description: The status code to return when the WAF custom rule triggers. example: 403 format: int64 type: integer type: object ServiceDefinitionV2Dot1MSTeams: description: Service owner's Microsoft Teams. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Microsoft Teams. example: My team channel type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1MSTeamsType' required: - type - contact type: object ContainerGroupType: default: container_group description: Type of container group. enum: - container_group example: container_group type: string x-enum-varnames: - CONTAINER_GROUP RelationshipToSAMLAssertionAttribute: description: AuthN Mapping relationship to SAML Assertion Attribute. properties: data: $ref: '#/components/schemas/RelationshipToSAMLAssertionAttributeData' required: - data type: object AuditLogsSort: description: Sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING SpansAttributes: description: JSON object containing all span attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from your span. example: customAttribute: 123 duration: 2345 type: object custom: additionalProperties: {} description: JSON object of custom spans data. type: object end_timestamp: description: End timestamp of your span. example: '2023-01-02T09:42:36.420Z' format: date-time type: string env: description: Name of the environment from where the spans are being sent. example: prod type: string host: description: Name of the machine from where the spans are being sent. example: i-0123 type: string ingestion_reason: description: The reason why the span was ingested. example: rule type: string parent_id: description: Id of the span that's parent of this span. example: '0' type: string resource_hash: description: Unique identifier of the resource. example: a12345678b91c23d type: string resource_name: description: The name of the resource. example: agent type: string retained_by: description: The reason why the span was indexed. example: retention_filter type: string service: description: 'The name of the application or service generating the span events. It is used to switch from APM to Logs, so make sure you define the same value when you use both products.' example: agent type: string single_span: description: Whether or not the span was collected as a stand-alone span. Always associated to "single_span" ingestion_reason if true. example: true type: boolean span_id: description: Id of the span. example: '1234567890987654321' type: string start_timestamp: description: Start timestamp of your span. example: '2023-01-02T09:42:36.320Z' format: date-time type: string tags: description: Array of tags associated with your span. example: - team:A items: description: Tag associated with your span. type: string type: array trace_id: description: Id of the trace to which the span belongs. example: '1234567890987654321' type: string type: description: The type of the span. example: web type: string type: object AWSNamespaceFilters: description: AWS Metrics namespace filters. Defaults to `exclude_only`. oneOf: - $ref: '#/components/schemas/AWSNamespaceFiltersExcludeOnly' - $ref: '#/components/schemas/AWSNamespaceFiltersIncludeOnly' EventsResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: '#/components/schemas/EventsResponseMetadataPage' request_id: description: The identifier of the request. example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR type: string status: description: The request status. example: done type: string warnings: description: 'A list of warnings (non-fatal errors) encountered. Partial results might be returned if warnings are present in the response.' items: $ref: '#/components/schemas/EventsWarning' type: array type: object ReadinessGate: description: Used to merge multiple branches into a single branch. properties: thresholdType: $ref: '#/components/schemas/ReadinessGateThresholdType' required: - thresholdType type: object EntityV3DatadogPipelines: additionalProperties: false description: CI Pipelines association. properties: fingerprints: description: A list of CI Fingerprints that associate CI Pipelines with the entity. items: type: string type: array type: object EntityV3System: additionalProperties: false description: Schema for system entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3SystemDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3SystemKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3SystemSpec' required: - apiVersion - kind - metadata type: object EscalationPolicyData: description: Represents the data for a single escalation policy, including its attributes, ID, relationships, and resource type. properties: attributes: $ref: '#/components/schemas/EscalationPolicyDataAttributes' id: description: Specifies the unique identifier of the escalation policy. example: ab000000-0000-0000-0000-000000000000 type: string relationships: $ref: '#/components/schemas/EscalationPolicyDataRelationships' type: $ref: '#/components/schemas/EscalationPolicyDataType' required: - type type: object EntityV3MetadataLinksItems: additionalProperties: false description: The definition of Entity V3 Metadata Links Items object. properties: name: description: Link name. example: mylink type: string provider: description: Link provider. type: string example: abc-123-def type: default: other description: Link type. example: link type: string url: description: Link URL. example: https://mylink type: string required: - name - type - url type: object RelationshipToOrganizations: description: Relationship to organizations. properties: data: description: Relationships to organization objects. example: [] items: $ref: '#/components/schemas/RelationshipToOrganizationData' type: array required: - data type: object UserTeamUserType: default: users description: User team user type enum: - users example: users type: string x-enum-varnames: - USERS LeakedKeyType: default: leaked_keys description: The definition of LeakedKeyType object. enum: - leaked_keys example: leaked_keys type: string x-enum-varnames: - LEAKED_KEYS WorkflowData: description: Data related to the workflow. properties: attributes: $ref: '#/components/schemas/WorkflowDataAttributes' id: description: The workflow identifier readOnly: true type: string example: abc-123-def relationships: $ref: '#/components/schemas/WorkflowDataRelationships' type: $ref: '#/components/schemas/WorkflowDataType' required: - type - attributes type: object SecurityFilterType: default: security_filters description: The type of the resource. The value should always be `security_filters`. enum: - security_filters example: security_filters type: string x-enum-varnames: - SECURITY_FILTERS WorkflowUserRelationshipData: description: The definition of `WorkflowUserRelationshipData` object. properties: id: description: The user identifier example: '' type: string type: $ref: '#/components/schemas/WorkflowUserRelationshipType' required: - type - id type: object NullableRelationshipToUser: description: Relationship to user. nullable: true properties: data: $ref: '#/components/schemas/NullableRelationshipToUserData' required: - data type: object IncidentTriggerWrapper: description: Schema for an Incident-based trigger. properties: incidentTrigger: $ref: '#/components/schemas/IncidentTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - incidentTrigger type: object DORAListFailuresRequestData: description: The JSON:API data. properties: attributes: $ref: '#/components/schemas/DORAListFailuresRequestAttributes' type: $ref: '#/components/schemas/DORAListFailuresRequestDataType' required: - attributes type: object SecurityMonitoringRuleNewValueOptions: description: Options on new value detection method. properties: forgetAfter: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter' learningDuration: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration' learningMethod: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod' learningThreshold: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold' type: object EventsListResponseLinks: description: Links attributes. properties: next: description: 'Link for the next set of results. Note that the request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/events?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object DowntimeScheduleOneTimeResponse: description: A one-time downtime definition. properties: end: description: ISO-8601 Datetime to end the downtime. example: '2020-01-02T03:04:00.000Z' format: date-time nullable: true type: string start: description: ISO-8601 Datetime to start the downtime. example: '2020-01-02T03:04:00.000Z' format: date-time type: string required: - start type: object ServiceDefinitionV1: deprecated: true description: Deprecated - Service definition V1 for providing additional service metadata and integrations. properties: contact: $ref: '#/components/schemas/ServiceDefinitionV1Contact' extensions: additionalProperties: {} description: Extensions to V1 schema. example: myorg/extension: extensionValue type: object external-resources: description: A list of external links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV1Resource' type: array info: $ref: '#/components/schemas/ServiceDefinitionV1Info' integrations: $ref: '#/components/schemas/ServiceDefinitionV1Integrations' org: $ref: '#/components/schemas/ServiceDefinitionV1Org' schema-version: $ref: '#/components/schemas/ServiceDefinitionV1Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array required: - schema-version - info type: object HTTPToken: description: The definition of `HTTPToken` object. properties: name: description: The `HTTPToken` `name`. example: MyToken pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string type: $ref: '#/components/schemas/TokenType' value: description: The `HTTPToken` `value`. example: Some Token Value type: string required: - name - value - type type: object ObservabilityPipelineSumoLogicDestinationEncoding: description: The output encoding format. enum: - json - raw_message - logfmt example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE - LOGFMT AWSAccountConfigID: description: 'Unique Datadog ID of the AWS Account Integration Config. To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations) endpoint and query by AWS Account ID.' example: 00000000-abcd-0001-0000-000000000000 type: string FastlyServiceAttributes: description: Attributes object for Fastly service requests. properties: tags: description: A list of tags for the Fastly service. example: - myTag - myTag2:myValue items: type: string type: array type: object ExternalUserGroupMeta: description: Metadata associated with a group. properties: created: description: The date and time the group was created. example: '2024-10-17T12:53:35.793Z' format: date-time type: string lastModified: description: The date and time the group was last changed. example: '2024-10-19T12:53:35.793Z' format: date-time type: string location: description: URL identifying the resource. example: https://app.datadoghq.com/api/scim/v2/Groups/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 type: string resourceType: description: Type of resource. example: Group type: string type: object Project: description: A Project properties: attributes: $ref: '#/components/schemas/ProjectAttributes' id: description: The Project's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: '#/components/schemas/ProjectRelationships' type: $ref: '#/components/schemas/ProjectResourceType' required: - id - type - attributes type: object DataTransformType: default: dataTransform description: The data transform type. enum: - dataTransform example: dataTransform type: string x-enum-varnames: - DATATRANSFORM ExternalUserGroupMembersItems: description: The definition of a member belonging to a group. properties: $ref: description: The URI corresponding to a SCIM resource that is a member of this group. example: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 type: string display: description: A human-readable name for the group member. example: John Doe type: string type: description: A label indicating the type of resource. example: User type: string value: description: The identifier of the member of this group. example: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 type: string type: object IPAllowlistEntryAttributes: description: Attributes of the IP allowlist entry. properties: cidr_block: description: The CIDR block describing the IP range of the entry. type: string example: abc-123-def created_at: description: Creation time of the entry. format: date-time readOnly: true type: string example: example_value modified_at: description: Time of last entry modification. format: date-time readOnly: true type: string example: example_value note: description: A note describing the IP allowlist entry. type: string example: example_value type: object IncidentAttachmentRelatedObject: description: The object related to an incident attachment. enum: - users type: string x-enum-varnames: - USERS JSONAPIErrorItem: description: API error response body properties: detail: description: A human-readable explanation specific to this occurrence of the error. example: Missing required attribute in body type: string meta: additionalProperties: {} description: Non-standard meta-information about the error type: object source: $ref: '#/components/schemas/JSONAPIErrorItemSource' status: description: Status code of the response. example: '400' type: string title: description: Short human-readable summary of the error. example: Bad Request type: string type: object CustomDestinationResponseHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string type: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeaderType' required: - type - header_name type: object DowntimeScheduleResponse: description: 'The schedule that defines when the monitor starts, stops, and recurs. There are two types of schedules: one-time and recurring. Recurring schedules may have up to five RRULE-based recurrences. If no schedules are provided, the downtime will begin immediately and never end.' oneOf: - $ref: '#/components/schemas/DowntimeScheduleRecurrencesResponse' - $ref: '#/components/schemas/DowntimeScheduleOneTimeResponse' MetricCustomAggregations: description: Deprecated. You no longer need to configure specific time and space aggregations for Metrics Without Limits. example: - space: sum time: sum - space: sum time: count items: $ref: '#/components/schemas/MetricCustomAggregation' type: array LeakedKeyAttributes: description: The definition of LeakedKeyAttributes object. properties: date: description: The LeakedKeyAttributes date. example: '2017-07-21T17:32:28Z' format: date-time type: string leak_source: description: The LeakedKeyAttributes leak_source. type: string example: example_value required: - date type: object EventResponseAttributes: description: The object description of an event response attribute. properties: attributes: $ref: '#/components/schemas/EventAttributes' message: description: The message of the event. type: string example: CPU usage is high on {{host.name}} tags: description: An array of tags associated with the event. example: - team:A items: description: The tag associated with the event. type: string type: array timestamp: description: The timestamp of the event. example: '2019-01-02T09:42:36.320Z' format: date-time type: string type: object AuthNMappingResponse: description: AuthN Mapping response from the API. properties: data: $ref: '#/components/schemas/AuthNMapping' included: description: Included data in the AuthN Mapping response. items: $ref: '#/components/schemas/AuthNMappingIncluded' type: array type: object FullCustomFrameworkData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: '#/components/schemas/FullCustomFrameworkDataAttributes' id: description: The ID of the custom framework. example: handle-version type: string type: $ref: '#/components/schemas/CustomFrameworkType' required: - id - type - attributes type: object ProjectedCostType: default: projected_cost description: Type of cost data. enum: - projected_cost example: projected_cost type: string x-enum-varnames: - PROJECt_COST SecurityMonitoringStandardRuleQuery: description: Query for matching rule. properties: aggregation: $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation' dataSource: $ref: '#/components/schemas/SecurityMonitoringStandardDataSource' distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array hasOptionalGroupByFields: description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. example: false readOnly: true type: boolean metric: deprecated: true description: '(Deprecated) The target field to aggregate over when using the sum or max aggregations. `metrics` field should be used instead.' type: string example: example_value metrics: description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. items: description: Field. type: string type: array name: description: Name of the query. type: string example: Example Monitor query: description: Query to run on logs. example: a > 3 type: string type: object DowntimeIncludedMonitorType: default: monitors description: Monitor resource type. enum: - monitors example: monitors type: string x-enum-varnames: - MONITORS ScheduleMemberRelationshipsUser: description: Wraps the user data reference for a schedule member. properties: data: $ref: '#/components/schemas/ScheduleMemberRelationshipsUserData' required: - data type: object SecurityMonitoringSignalListRequestPage: description: The paging attributes for listing security signals. properties: cursor: description: A list of results using the cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string limit: default: 10 description: The maximum number of security signals in the response. example: 25 format: int32 maximum: 1000 type: integer type: object MetricCustomSpaceAggregation: description: A space aggregation for use in query. enum: - avg - max - min - sum example: sum type: string x-enum-varnames: - AVG - MAX - MIN - SUM CustomCostsFileMetadataWithContent: description: Schema of a cost file's metadata. properties: billed_cost: description: Total cost in the cost file. example: 100.5 format: double type: number billing_currency: description: Currency used in the Custom Costs file. example: USD type: string charge_period: $ref: '#/components/schemas/CustomCostsFileUsageChargePeriod' content: description: Detail of the line items from the Custom Costs file. items: $ref: '#/components/schemas/CustomCostsFileLineItem' type: array name: description: Name of the Custom Costs file. example: my_file.json type: string provider_names: description: Providers contained in the Custom Costs file. items: description: Name of a provider. example: my_provider type: string type: array status: description: Status of the Custom Costs file. example: active type: string uploaded_at: description: Timestamp in millisecond of the upload time of the Custom Costs file. example: 1704067200000 format: double type: number uploaded_by: $ref: '#/components/schemas/CustomCostsUser' type: object DowntimeDisplayTimezone: default: UTC description: 'The timezone in which to display the downtime''s start and end times in Datadog applications. This is not used as an offset for scheduling.' example: America/New_York nullable: true type: string EntityV3MetadataContactsItems: additionalProperties: false description: The definition of Entity V3 Metadata Contacts Items object. properties: contact: description: Contact value. example: https://slack/ type: string name: description: Contact name. minLength: 2 type: string example: Example Monitor type: description: Contact type. example: slack type: string required: - type - contact type: object ObservabilityPipelineElasticsearchDestination: description: The `elasticsearch` destination writes logs to an Elasticsearch cluster. properties: api_version: $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationApiVersion' bulk_index: description: The index to write logs to in Elasticsearch. example: logs-index type: string id: description: The unique identifier for this component. example: elasticsearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationType' required: - id - type - inputs type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType: description: Indicates a custom regular expression is used for matching. enum: - custom example: custom type: string x-enum-varnames: - CUSTOM ObservabilityPipelineGcpAuth: description: 'GCP credentials used to authenticate with Google Cloud Storage. ' properties: credentials_file: description: Path to the GCP service account key file. example: /var/secrets/gcp-credentials.json type: string required: - credentials_file type: object ShiftDataType: default: shifts description: Indicates that the resource is of type 'shifts'. enum: - shifts example: shifts type: string x-enum-varnames: - SHIFTS ObservabilityPipelineRenameFieldsProcessor: description: The `rename_fields` processor changes field names. properties: fields: description: A list of rename rules specifying which fields to rename in the event, what to rename them to, and whether to preserve the original fields. items: $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorField' type: array id: description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: rename-fields-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorType' required: - id - type - include - fields - inputs type: object IncidentTeamIncludedItems: description: An object related to an incident team which is present in the included payload. oneOf: - $ref: '#/components/schemas/User' ProjectResponse: description: Project response properties: data: $ref: '#/components/schemas/Project' type: object TimeRestrictions: description: Holds time zone information and a list of time restrictions for a routing rule. properties: restrictions: description: Defines the list of time-based restrictions. items: $ref: '#/components/schemas/TimeRestriction' type: array time_zone: description: Specifies the time zone applicable to the restrictions. example: '' type: string required: - time_zone - restrictions type: object HistoricalJobResponseAttributes: description: Historical job attributes. properties: createdAt: description: Time when the job was created. type: string example: example_value createdByHandle: description: The handle of the user who created the job. type: string example: example_value createdByName: description: The name of the user who created the job. type: string example: Example Monitor createdFromRuleId: description: ID of the rule used to create the job (if it is created from a rule). type: string example: abc-123-def jobDefinition: $ref: '#/components/schemas/JobDefinition' jobName: description: Job name. type: string example: Example Monitor jobStatus: description: Job status. type: string example: OK modifiedAt: description: Last modification time of the job. type: string example: example_value type: object ObservabilityPipelineThrottleProcessorType: default: throttle description: The processor type. The value should always be `throttle`. enum: - throttle example: throttle type: string x-enum-varnames: - THROTTLE GetFindingResponse: description: The expected response schema when getting a finding. properties: data: $ref: '#/components/schemas/DetailedFinding' required: - data type: object ObservabilityPipelineSampleProcessorType: default: sample description: The processor type. The value should always be `sample`. enum: - sample example: sample type: string x-enum-varnames: - SAMPLE ObservabilityPipelineEnrichmentTableProcessorType: default: enrichment_table description: The processor type. The value should always be `enrichment_table`. enum: - enrichment_table example: enrichment_table type: string x-enum-varnames: - ENRICHMENT_TABLE SecurityMonitoringRuleSeverity: description: Severity of the Security Signal. enum: - info - low - medium - high - critical example: critical type: string x-enum-varnames: - INFO - LOW - MEDIUM - HIGH - CRITICAL RelationshipArray: description: Relationships. items: $ref: '#/components/schemas/RelationshipItem' type: array ObservabilityPipelineSyslogSourceMode: description: Protocol used by the syslog source to receive messages. enum: - tcp - udp example: tcp type: string x-enum-varnames: - TCP - UDP OpsgenieServiceResponseAttributes: description: The attributes from an Opsgenie service response. properties: custom_url: description: The custom URL for a custom region. example: null nullable: true type: string name: description: The name for the Opsgenie service. example: fake-opsgenie-service-name maxLength: 100 type: string region: $ref: '#/components/schemas/OpsgenieServiceRegionType' type: object x-merge-override: required: false MicrosoftTeamsTenantBasedHandlesResponse: description: Response with a list of tenant-based handles. properties: data: description: An array of tenant-based handles. example: - attributes: channelId: 19:b41k24b14bn1nwffkernfkwrnfneubgkr@thread.tacv2 channelName: General name: general-handle teamId: 00000000-0000-0000-0000-000000000000 teamName: Example Team tenantId: 00000000-0000-0000-0000-000000000001 tenantName: Company, Inc. id: 596da4af-0563-4097-90ff-07230c3f9db3 type: ms-teams-tenant-based-handle-info - attributes: channelId: 19:b41k24b14bn1nwffkernfkwrnfneubgk1@thread.tacv2 channelName: General2 name: general-handle-2 teamId: 00000000-0000-0000-0000-000000000002 teamName: Example Team 2 tenantId: 00000000-0000-0000-0000-000000000003 tenantName: Company, Inc. id: 596da4af-0563-4097-90ff-07230c3f9db4 type: ms-teams-tenant-based-handle-info items: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleInfoResponseData' type: array required: - data type: object ObservabilityPipelineSplunkHecDestinationType: default: splunk_hec description: The destination type. Always `splunk_hec`. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC AwsScanOptionsAttributes: description: Attributes for the AWS scan options. properties: lambda: description: Indicates if scanning of Lambda functions is enabled. example: true type: boolean sensitive_data: description: Indicates if scanning for sensitive data is enabled. example: false type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. example: true type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. example: true type: boolean type: object RumRetentionFilterQuery: description: The query string for a RUM retention filter. example: '@session.has_replay:true' type: string ServiceDefinitionV2Dot1Email: description: Service owner's email. properties: contact: description: Contact value. example: contact@datadoghq.com type: string name: description: Contact email. example: Team Email type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1EmailType' required: - type - contact type: object SecurityMonitoringSignalsListResponseLinks: description: Links attributes. properties: next: description: 'The link for the next set of results. **Note**: The request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/security_monitoring/signals?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object RelationToEntity: description: Relation to entity. properties: data: $ref: '#/components/schemas/RelationshipItem' meta: $ref: '#/components/schemas/EntityMeta' type: object RoleResponseRelationships: description: Relationships of the role object returned by the API. properties: permissions: $ref: '#/components/schemas/RelationshipToPermissions' type: object EntityV3ServiceSpec: additionalProperties: false description: The definition of Entity V3 Service Spec object. properties: componentOf: description: A list of components the service is a part of items: type: string type: array dependsOn: description: A list of components the service depends on. items: type: string type: array languages: description: The service's programming language. items: type: string type: array lifecycle: description: The lifecycle state of the component. minLength: 1 type: string example: example_value tier: description: The importance of the component. minLength: 1 type: string example: example_value type: description: The type of service. type: string example: metric alert type: object InputSchemaParameters: description: The definition of `InputSchemaParameters` object. properties: defaultValue: description: The `InputSchemaParameters` `defaultValue`. example: example_value description: description: The `InputSchemaParameters` `description`. type: string example: example_value label: description: The `InputSchemaParameters` `label`. type: string example: example_value name: description: The `InputSchemaParameters` `name`. example: '' type: string type: $ref: '#/components/schemas/InputSchemaParametersType' required: - name - type type: object ObservabilityPipelineAddEnvVarsProcessorVariable: description: Defines a mapping between an environment variable and a log field. properties: field: description: The target field in the log event. example: log.environment.region type: string name: description: The name of the environment variable to read. example: AWS_REGION type: string required: - field - name type: object MonitorNotificationRuleListResponse: description: Response for retrieving all monitor notification rules. properties: data: description: A list of monitor notification rules. items: $ref: '#/components/schemas/MonitorNotificationRuleData' type: array included: description: Array of objects related to the monitor notification rules. items: $ref: '#/components/schemas/MonitorNotificationRuleResponseIncludedItem' type: array type: object IncidentRespondersType: description: The incident responders type. enum: - incident_responders example: incident_responders type: string x-enum-varnames: - INCIDENT_RESPONDERS SecurityFilterExclusionFilterResponse: description: A single exclusion filter. properties: name: description: The exclusion filter name. example: Exclude staging type: string query: description: The exclusion filter query. example: source:staging type: string type: object UsageObservabilityPipelinesResponse: description: Observability Pipelines usage response. properties: data: description: Response containing Observability Pipelines usage. items: $ref: '#/components/schemas/UsageDataObject' type: array type: object EntityV3Queue: additionalProperties: false description: Schema for queue entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3QueueDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3QueueKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3QueueSpec' required: - apiVersion - kind - metadata type: object ApmRetentionFilterType: default: apm_retention_filter description: The type of the resource. enum: - apm_retention_filter example: apm_retention_filter type: string x-enum-varnames: - apm_retention_filter RelationshipToIncidentAttachmentData: description: The attachment relationship data. properties: id: description: A unique identifier that represents the attachment. example: 00000000-0000-abcd-1000-000000000000 type: string type: $ref: '#/components/schemas/IncidentAttachmentType' required: - id - type type: object x-merge-override: required: false ObservabilityPipelineQuotaProcessorType: default: quota description: The processor type. The value should always be `quota`. enum: - quota example: quota type: string x-enum-varnames: - QUOTA JiraIssue: description: Jira issue attached to case nullable: true properties: result: $ref: '#/components/schemas/JiraIssueResult' status: $ref: '#/components/schemas/Case3rdPartyTicketStatus' readOnly: true type: object ApplicationSecurityWafExclusionFilterType: default: exclusion_filter description: Type of the resource. The value should always be `exclusion_filter`. enum: - exclusion_filter example: exclusion_filter type: string x-enum-varnames: - EXCLUSION_FILTER ObservabilityPipelineReduceProcessorType: default: reduce description: The processor type. The value should always be `reduce`. enum: - reduce example: reduce type: string x-enum-varnames: - REDUCE DowntimeRelationshipsMonitor: description: The monitor identified by the downtime. properties: data: $ref: '#/components/schemas/DowntimeRelationshipsMonitorData' type: object APIKeysResponseMetaPage: description: Additional information related to the API keys response. properties: total_filtered_count: description: Total filtered application key count. format: int64 type: integer example: 42 type: object EscalationPolicyDataAttributes: description: Defines the main attributes of an escalation policy, such as its name and behavior on policy end. properties: name: description: Specifies the name of the escalation policy. example: On-Call Escalation Policy type: string resolve_page_on_policy_end: description: Indicates whether the page is automatically resolved when the policy ends. type: boolean example: true retries: description: Specifies how many times the escalation sequence is retried if there is no response. format: int64 type: integer example: 42 required: - name type: object ProcessSummary: description: Process summary object. properties: attributes: $ref: '#/components/schemas/ProcessSummaryAttributes' id: description: Process ID. type: string example: abc-123-def type: $ref: '#/components/schemas/ProcessSummaryType' type: object x-merge-override: required: false ObservabilityPipelineTls: description: Configuration for enabling TLS encryption between the pipeline component and external services. properties: ca_file: description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate. type: string example: example_value crt_file: description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services. example: /path/to/cert.crt type: string key_file: description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication. type: string example: example_value required: - crt_file type: object EntityRelationships: description: Entity relationships. properties: incidents: $ref: '#/components/schemas/EntityToIncidents' oncall: $ref: '#/components/schemas/EntityToOncalls' rawSchema: $ref: '#/components/schemas/EntityToRawSchema' relatedEntities: $ref: '#/components/schemas/EntityToRelatedEntities' schema: $ref: '#/components/schemas/EntityToSchema' type: object ServiceDefinitionV2Dot1Contact: description: Service owner's contacts information. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV2Dot1Email' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1Slack' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1MSTeams' FindingResource: description: The resource name of this finding. example: my_resource_name type: string LogsArchiveDestinationS3: description: The S3 archive destination. properties: bucket: description: The bucket where the archive will be stored. example: bucket-name type: string encryption: $ref: '#/components/schemas/LogsArchiveEncryptionS3' integration: $ref: '#/components/schemas/LogsArchiveIntegrationS3' path: description: The archive path. type: string example: example_value storage_class: $ref: '#/components/schemas/LogsArchiveStorageClassS3Type' type: $ref: '#/components/schemas/LogsArchiveDestinationS3Type' required: - bucket - integration - type type: object ObservabilityPipelineEnrichmentTableFileSchemaItemsType: description: Declares allowed data types for enrichment table columns. enum: - string - boolean - integer - float - date - timestamp example: string type: string x-enum-varnames: - STRING - BOOLEAN - INTEGER - FLOAT - DATE - TIMESTAMP ObservabilityPipelineRenameFieldsProcessorField: description: Defines how to rename a field in log events. properties: destination: description: The field name to assign the renamed value to. example: destination_field type: string preserve_source: description: Indicates whether the original field, that is received from the source, should be kept (`true`) or removed (`false`) after renaming. example: false type: boolean source: description: The original field name in the log event that should be renamed. example: source_field type: string required: - source - destination - preserve_source type: object MetricTagConfiguration: description: Object for a single metric tag configuration. example: attributes: aggregations: - space: avg time: avg created_at: '2020-03-25T09:48:37.463835Z' metric_type: gauge modified_at: '2020-04-25T09:48:37.463835Z' tags: - app - datacenter id: http.request.latency type: manage_tags properties: attributes: $ref: '#/components/schemas/MetricTagConfigurationAttributes' id: $ref: '#/components/schemas/MetricName' type: $ref: '#/components/schemas/MetricTagConfigurationType' type: object GetAppResponse: description: The full app definition response object. properties: data: $ref: '#/components/schemas/GetAppResponseData' included: description: Data on the version of the app that was published. items: $ref: '#/components/schemas/Deployment' type: array meta: $ref: '#/components/schemas/AppMeta' relationship: $ref: '#/components/schemas/AppRelationship' type: object IncidentServiceResponse: description: Response with an incident service payload. properties: data: $ref: '#/components/schemas/IncidentServiceResponseData' included: description: Included objects from relationships. items: $ref: '#/components/schemas/IncidentServiceIncludedItems' readOnly: true type: array required: - data type: object SecurityMonitoringRuleNewValueOptionsLearningMethod: default: duration description: The learning method used to determine when signals should be generated for values that weren't learned. enum: - duration - threshold type: string x-enum-varnames: - DURATION - THRESHOLD ServiceDefinitionV2Dot2Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string provider: description: Link provider. example: Github type: string type: description: 'Link type. Datadog recognizes the following types: `runbook`, `doc`, `repo`, `dashboard`, and `other`.' example: runbook type: string url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object Pagination: description: Pagination object. properties: total_count: description: Total count. format: int64 type: integer example: 42 total_filtered_count: description: Total count of elements matched by the filter. format: int64 type: integer example: 42 type: object SLOReportStatus: description: The status of the SLO report job. enum: - in_progress - completed - completed_with_errors - failed example: completed type: string x-enum-varnames: - IN_PROGRESS - COMPLETED - COMPLETED_WITH_ERRORS - FAILED LogsArchiveOrder: description: A ordered list of archive IDs. properties: data: $ref: '#/components/schemas/LogsArchiveOrderDefinition' type: object AssetType: description: The asset type enum: - Repository - Service - Host - HostImage - Image example: Repository type: string x-enum-varnames: - REPOSITORY - SERVICE - HOST - HOSTIMAGE - IMAGE ObservabilityPipelineOcsfMapperProcessor: description: The `ocsf_mapper` processor transforms logs into the OCSF schema using a predefined mapping configuration. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: ocsf-mapper-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this processor. example: - filter-processor items: type: string type: array mappings: description: A list of mapping rules to convert events to the OCSF format. items: $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMapping' type: array type: $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorType' required: - id - type - include - inputs - mappings type: object RumRetentionFilterData: description: The RUM retention filter. properties: attributes: $ref: '#/components/schemas/RumRetentionFilterAttributes' id: $ref: '#/components/schemas/RumRetentionFilterID' type: $ref: '#/components/schemas/RumRetentionFilterType' type: object EntityResponseIncludedRawSchemaAttributes: description: Included raw schema attributes. properties: rawSchema: description: Schema from user input in base64 encoding. type: string example: example_value type: object ChargebackBreakdown: description: Charges breakdown. properties: charge_type: description: The type of charge for a particular product. example: on_demand type: string cost: description: The cost for a particular product and charge type during a given month. format: double type: number example: 95.5 product_name: description: The product for which cost is being reported. example: infra_host type: string type: object RelationshipToPermissions: description: Relationship to multiple permissions objects. properties: data: description: Relationships to permission objects. items: $ref: '#/components/schemas/RelationshipToPermissionData' type: array type: object x-merge-override: required: false IncidentTeamRelationships: description: The incident team's relationships. properties: created_by: $ref: '#/components/schemas/RelationshipToUser' last_modified_by: $ref: '#/components/schemas/RelationshipToUser' readOnly: true type: object ObservabilityPipelineGoogleCloudStorageDestinationStorageClass: description: Storage class used for objects stored in GCS. enum: - STANDARD - NEARLINE - COLDLINE - ARCHIVE example: STANDARD type: string x-enum-varnames: - STANDARD - NEARLINE - COLDLINE - ARCHIVE IncidentTodoListResponse: description: Response with a list of incident todos. properties: data: description: An array of incident todos. items: $ref: '#/components/schemas/IncidentTodoResponseData' type: array included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentTodoResponseIncludedItem' readOnly: true type: array meta: $ref: '#/components/schemas/IncidentResponseMeta' required: - data type: object PowerpackRelationships: description: Powerpack relationship object. properties: author: $ref: '#/components/schemas/RelationshipToUser' type: object ObservabilityPipelineRemoveFieldsProcessorType: default: remove_fields description: The processor type. The value should always be `remove_fields`. enum: - remove_fields example: remove_fields type: string x-enum-varnames: - REMOVE_FIELDS LogsArchiveDestination: description: An archive's destination. nullable: true oneOf: - $ref: '#/components/schemas/LogsArchiveDestinationAzure' - $ref: '#/components/schemas/LogsArchiveDestinationGCS' - $ref: '#/components/schemas/LogsArchiveDestinationS3' type: object CasePriority: default: NOT_DEFINED description: Case priority enum: - NOT_DEFINED - P1 - P2 - P3 - P4 - P5 example: NOT_DEFINED type: string x-enum-varnames: - NOT_DEFINED - P1 - P2 - P3 - P4 - P5 ActionQueryShowToastOnError: description: Whether to display a toast to the user when the query returns an error. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string EntityV3DatadogEventItem: additionalProperties: false description: Events association item. properties: name: description: The name of the query. type: string example: Example Monitor query: description: The query to run. type: string example: avg:system.cpu.user{*} type: object EventsListResponse: description: The response object with all events matching the request and pagination information. properties: data: description: An array of events matching the request. items: $ref: '#/components/schemas/EventResponse' type: array links: $ref: '#/components/schemas/EventsListResponseLinks' meta: $ref: '#/components/schemas/EventsResponseMetadata' type: object IncidentAttachmentRelationships: description: The incident attachment's relationships. properties: last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' type: object RumMetricType: default: rum_metrics description: The type of the resource. The value should always be rum_metrics. enum: - rum_metrics example: rum_metrics type: string x-enum-varnames: - RUM_METRICS PartialApplicationKeyResponse: description: Response for retrieving a partial application key. properties: data: $ref: '#/components/schemas/PartialApplicationKey' included: description: Array of objects related to the application key. items: $ref: '#/components/schemas/ApplicationKeyResponseIncludedItem' type: array type: object SecurityMonitoringRuleThirdPartyOptions: description: Options on third party detection method. properties: defaultNotifications: description: Notification targets for the logs that do not correspond to any of the cases. items: description: Notification. type: string type: array defaultStatus: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' rootQueries: description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. items: $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery' type: array signalTitleTemplate: description: A template for the signal title; if omitted, the title is generated based on the case name. type: string example: Example Monitor type: object RestrictionPolicyAttributes: description: Restriction policy attributes. example: bindings: [] properties: bindings: description: An array of bindings. items: $ref: '#/components/schemas/RestrictionPolicyBinding' type: array required: - bindings type: object CaseAttributes: description: Case attributes properties: archived_at: description: Timestamp of when the case was archived format: date-time nullable: true readOnly: true type: string example: example_value closed_at: description: Timestamp of when the case was closed format: date-time nullable: true readOnly: true type: string example: example_value created_at: description: Timestamp of when the case was created format: date-time readOnly: true type: string example: example_value description: description: Description type: string example: example_value jira_issue: $ref: '#/components/schemas/JiraIssue' key: description: Key example: CASEM-4523 type: string modified_at: description: Timestamp of when the case was last modified format: date-time nullable: true readOnly: true type: string example: example_value priority: $ref: '#/components/schemas/CasePriority' service_now_ticket: $ref: '#/components/schemas/ServiceNowTicket' status: $ref: '#/components/schemas/CaseStatus' title: description: Title example: Memory leak investigation on API type: string type: $ref: '#/components/schemas/CaseType' type: object RumMetricComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION EntityV3ServiceDatadog: additionalProperties: false description: Datadog product integrations for the service entity. properties: codeLocations: $ref: '#/components/schemas/EntityV3DatadogCodeLocations' events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' pipelines: $ref: '#/components/schemas/EntityV3DatadogPipelines' type: object RelationshipToIncidentResponderData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the responder. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/IncidentRespondersType' required: - id - type type: object x-merge-override: required: false ApplicationSecurityWafCustomRuleConditionOperator: description: Operator to use for the WAF Condition. enum: - match_regex - '!match_regex' - phrase_match - '!phrase_match' - is_xss - is_sqli - exact_match - '!exact_match' - ip_match - '!ip_match' - capture_data example: match_regex type: string x-enum-varnames: - MATCH_REGEX - NOT_MATCH_REGEX - PHRASE_MATCH - NOT_PHRASE_MATCH - IS_XSS - IS_SQLI - EXACT_MATCH - NOT_EXACT_MATCH - IP_MATCH - NOT_IP_MATCH - CAPTURE_DATA TeamRoutingRulesData: description: Represents the top-level data object for team routing rules, containing the ID, relationships, and resource type. properties: id: description: Specifies the unique identifier of this team routing rules record. type: string example: abc-123-def relationships: $ref: '#/components/schemas/TeamRoutingRulesDataRelationships' type: $ref: '#/components/schemas/TeamRoutingRulesDataType' required: - type type: object ScheduleMemberRelationships: description: Defines relationships for a schedule member, primarily referencing a single user. properties: user: $ref: '#/components/schemas/ScheduleMemberRelationshipsUser' type: object AwsOnDemandType: default: aws_resource description: The type of the on demand task. The value should always be `aws_resource`. enum: - aws_resource example: aws_resource type: string x-enum-varnames: - AWS_RESOURCE ListEntityCatalogResponseIncludedItem: description: List entity response included item. oneOf: - $ref: '#/components/schemas/EntityResponseIncludedSchema' - $ref: '#/components/schemas/EntityResponseIncludedRawSchema' - $ref: '#/components/schemas/EntityResponseIncludedRelatedEntity' - $ref: '#/components/schemas/EntityResponseIncludedOncall' - $ref: '#/components/schemas/EntityResponseIncludedIncident' CustomDestinationResponseHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasic' - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeader' FastlyService: description: The schema representation of a Fastly service. properties: id: description: The ID of the Fastly service example: 6abc7de6893AbcDe9fghIj type: string tags: description: A list of tags for the Fastly service. example: - myTag - myTag2:myValue items: type: string type: array required: - id type: object OrgConfigType: description: Data type of an Org Config. enum: - org_configs example: org_configs type: string x-enum-varnames: - ORG_CONFIGS ServiceDefinitionMeta: description: Metadata about a service definition. properties: github-html-url: description: GitHub HTML URL. type: string example: https://app.datadoghq.com ingested-schema-version: description: Ingestion schema version. type: string example: example_value ingestion-source: description: Ingestion source of the service definition. type: string example: example_value last-modified-time: description: Last modified time of the service definition. type: string example: '2026-04-17T12:00:00Z' origin: description: User defined origin of the service definition. type: string example: example_value origin-detail: description: User defined origin's detail of the service definition. type: string example: example_value warnings: description: A list of schema validation warnings. items: $ref: '#/components/schemas/ServiceDefinitionMetaWarnings' type: array type: object ContainerImageGroup: description: Container Image Group object. properties: attributes: $ref: '#/components/schemas/ContainerImageGroupAttributes' id: description: Container Image Group ID. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ContainerImageGroupRelationships' type: $ref: '#/components/schemas/ContainerImageGroupType' type: object SecurityMonitoringUser: description: A user. properties: handle: description: The handle of the user. example: john.doe@datadoghq.com type: string name: description: The name of the user. example: John Doe nullable: true type: string type: object RelationshipToRole: description: Relationship to role. properties: data: $ref: '#/components/schemas/RelationshipToRoleData' type: object x-merge-override: required: false EscalationPolicyDataRelationshipsStepsDataItemsType: default: steps description: Indicates that the resource is of type `steps`. enum: - steps example: steps type: string x-enum-varnames: - STEPS SecurityMonitoringSignalsListResponseMeta: description: Meta attributes. properties: page: $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMetaPage' type: object OktaAccount: description: Schema for an Okta account. properties: attributes: $ref: '#/components/schemas/OktaAccountAttributes' id: description: The ID of the Okta account, a UUID hash of the account name. example: f749daaf-682e-4208-a38d-c9b43162c609 type: string type: $ref: '#/components/schemas/OktaAccountType' required: - attributes - type type: object MetricTagConfigurationAttributes: description: Object containing the definition of a metric tag configuration attributes. properties: aggregations: $ref: '#/components/schemas/MetricCustomAggregations' created_at: description: Timestamp when the tag configuration was created. example: '2020-03-25T09:48:37.463835Z' format: date-time type: string exclude_tags_mode: description: 'When set to true, the configuration will exclude the configured tags and include any other submitted tags. When set to false, the configuration will include the configured tags and exclude any other submitted tags. Defaults to false. Requires `tags` property.' type: boolean example: true include_percentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `metric_type` is `distribution`.' example: true type: boolean metric_type: $ref: '#/components/schemas/MetricTagConfigurationMetricTypes' modified_at: description: Timestamp when the tag configuration was last modified. example: '2020-03-25T09:48:37.463835Z' format: date-time type: string tags: description: List of tag keys on which to group. example: - app - datacenter items: description: Tag keys to group by. type: string type: array type: object ApplicationKeyResponse: description: Response for retrieving an application key. properties: data: $ref: '#/components/schemas/FullApplicationKey' included: description: Array of objects related to the application key. items: $ref: '#/components/schemas/ApplicationKeyResponseIncludedItem' type: array type: object UserTeamType: default: team_memberships description: Team membership type enum: - team_memberships example: team_memberships type: string x-enum-varnames: - TEAM_MEMBERSHIPS ScheduleTarget: description: Represents a schedule target for an escalation policy step, including its ID and resource type. properties: id: description: Specifies the unique identifier of the schedule resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/ScheduleTargetType' required: - type - id type: object LogsArchiveOrderDefinition: description: The definition of an archive order. properties: attributes: $ref: '#/components/schemas/LogsArchiveOrderAttributes' type: $ref: '#/components/schemas/LogsArchiveOrderDefinitionType' required: - type - attributes type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget: description: Excludes specific fields from processing. enum: - exclude example: exclude type: string x-enum-varnames: - EXCLUDE ServiceDefinitionV2Email: description: Service owner's email. properties: contact: description: Contact value. example: contact@datadoghq.com type: string name: description: Contact email. example: Team Email type: string type: $ref: '#/components/schemas/ServiceDefinitionV2EmailType' required: - type - contact type: object SecurityMonitoringSignal: description: Object description of a security signal. properties: attributes: $ref: '#/components/schemas/SecurityMonitoringSignalAttributes' id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/SecurityMonitoringSignalType' type: object IncidentFieldAttributesSingleValue: description: A field with a single value selected. properties: type: $ref: '#/components/schemas/IncidentFieldAttributesSingleValueType' value: description: The single value selected for this field. example: SEV-1 nullable: true type: string type: object EscalationTargets: description: A list of escalation targets for a step properties: data: description: The `EscalationTargets` `data`. items: $ref: '#/components/schemas/EscalationTarget' type: array type: object RumRetentionFiltersResponse: description: All RUM retention filters for a RUM application. properties: data: description: A list of RUM retention filters. items: $ref: '#/components/schemas/RumRetentionFilterData' type: array type: object DowntimeMonitorIncludedAttributes: description: Attributes of the monitor identified by the downtime. properties: name: description: The name of the monitor identified by the downtime. example: A monitor name type: string type: object ListPowerpacksResponse: description: Response object which includes all powerpack configurations. properties: data: description: List of powerpack definitions. items: $ref: '#/components/schemas/PowerpackData' type: array included: description: Array of objects related to the users. items: $ref: '#/components/schemas/User' type: array links: $ref: '#/components/schemas/PowerpackResponseLinks' meta: $ref: '#/components/schemas/PowerpacksResponseMeta' type: object AuthNMappingTeam: description: Team. properties: attributes: $ref: '#/components/schemas/AuthNMappingTeamAttributes' id: description: The ID of the Team. example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamType' type: object ProcessSummaryAttributes: description: Attributes for a process summary. properties: cmdline: description: Process command line. type: string example: example_value host: description: Host running the process. type: string example: example_value pid: description: Process ID. format: int64 type: integer example: 42 ppid: description: Parent process ID. format: int64 type: integer example: 42 start: description: Time the process was started. type: string example: example_value tags: description: List of tags associated with the process. items: description: A tag associated with the process. type: string type: array timestamp: description: Time the process was seen. type: string example: '2026-04-17T12:00:00Z' user: description: Process owner. type: string example: example_value type: object WorkflowDataRelationships: description: The definition of `WorkflowDataRelationships` object. properties: creator: $ref: '#/components/schemas/WorkflowUserRelationship' owner: $ref: '#/components/schemas/WorkflowUserRelationship' readOnly: true type: object ApplicationSecurityWafCustomRuleMetadata: description: Metadata associated with the WAF Custom Rule. properties: added_at: description: The date and time the WAF custom rule was created. example: '2021-01-01T00:00:00Z' format: date-time type: string added_by: description: The handle of the user who created the WAF custom rule. example: john.doe@datadoghq.com type: string added_by_name: description: The name of the user who created the WAF custom rule. example: John Doe type: string modified_at: description: The date and time the WAF custom rule was last updated. example: '2021-01-01T00:00:00Z' format: date-time type: string modified_by: description: The handle of the user who last updated the WAF custom rule. example: john.doe@datadoghq.com type: string modified_by_name: description: The name of the user who last updated the WAF custom rule. example: John Doe type: string readOnly: true type: object SecurityMonitoringSignalsListResponse: description: 'The response object with all security signals matching the request and pagination information.' properties: data: description: An array of security signals matching the request. items: $ref: '#/components/schemas/SecurityMonitoringSignal' type: array links: $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseLinks' meta: $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMeta' type: object UserResponseRelationships: description: Relationships of the user object returned by the API. properties: org: $ref: '#/components/schemas/RelationshipToOrganization' other_orgs: $ref: '#/components/schemas/RelationshipToOrganizations' other_users: $ref: '#/components/schemas/RelationshipToUsers' roles: $ref: '#/components/schemas/RelationshipToRoles' type: object x-merge-override: properties: false PowerpackResponseLinks: description: Links attributes. properties: first: description: Link to last page. type: string example: example_value last: description: Link to first page. example: https://app.datadoghq.com/api/v2/powerpacks?page[offset]=0&page[limit]=25 nullable: true type: string next: description: Link for the next set of results. example: https://app.datadoghq.com/api/v2/powerpacks?page[offset]=25&page[limit]=25 type: string prev: description: Link for the previous set of results. nullable: true type: string example: example_value self: description: Link to current page. example: https://app.datadoghq.com/api/v2/powerpacks type: string type: object SpansListResponseLinks: description: Links attributes. properties: next: description: 'Link for the next set of results. Note that the request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/spans/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object ConfluentResourceResponse: description: Response schema when interacting with a Confluent resource. properties: data: $ref: '#/components/schemas/ConfluentResourceResponseData' type: object MonitorDowntimeMatchResourceType: default: downtime_match description: Monitor Downtime Match resource type. enum: - downtime_match example: downtime_match type: string x-enum-varnames: - DOWNTIME_MATCH MonitorNotificationRuleFilterTags: additionalProperties: false description: Filter monitors by tags. Monitors must match all tags. properties: tags: description: A list of monitor tags. example: - team:product - host:abc items: maxLength: 255 type: string maxItems: 20 minItems: 1 type: array uniqueItems: true required: - tags type: object Parameter: description: The definition of `Parameter` object. properties: name: description: The `Parameter` `name`. example: '' type: string value: description: The `Parameter` `value`. example: example_value required: - name - value type: object ActionConnectionData: description: Data related to the connection. properties: attributes: $ref: '#/components/schemas/ActionConnectionAttributes' id: description: The connection identifier readOnly: true type: string example: abc-123-def type: $ref: '#/components/schemas/ActionConnectionDataType' required: - type - attributes type: object ObservabilityPipelineSyslogNgDestination: description: The `syslog_ng` destination forwards logs to an external `syslog-ng` server over TCP or UDP using the syslog protocol. properties: id: description: The unique identifier for this component. example: syslog-ng-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array keepalive: description: Optional socket keepalive duration in milliseconds. example: 60000 format: int64 minimum: 0 type: integer tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestinationType' required: - id - type - inputs type: object ObservabilityPipelineEnrichmentTableFileKeyItems: description: Defines how to map log fields to enrichment table columns during lookups. properties: column: description: The `items` `column`. example: user_id type: string comparison: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison' field: description: The `items` `field`. example: log.user.id type: string required: - column - comparison - field type: object EntityV3APISpecInterface: additionalProperties: false description: The API definition. oneOf: - $ref: '#/components/schemas/EntityV3APISpecInterfaceFileRef' - $ref: '#/components/schemas/EntityV3APISpecInterfaceDefinition' TeamsResponseMetaPagination: description: Teams response metadata. properties: first_offset: description: The first offset. format: int64 type: integer example: 42 last_offset: description: The last offset. format: int64 type: integer example: 42 limit: description: Pagination limit. format: int64 type: integer example: 42 next_offset: description: The next offset. format: int64 type: integer example: 42 offset: description: The offset. format: int64 type: integer example: 42 prev_offset: description: The previous offset. format: int64 type: integer example: 42 total: description: Total results. format: int64 type: integer example: 42 type: description: Offset type. type: string example: metric alert type: object ContainerImageGroupRelationshipsData: description: Links data. items: description: A link data. type: string type: array CustomDestinationResponseHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC ContainerImageGroupRelationships: description: Relationships inside a Container Image Group. properties: container_images: $ref: '#/components/schemas/ContainerImageGroupImagesRelationshipsLink' type: object SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations: description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.' example: true type: boolean ObservabilityPipelineDatadogAgentSource: description: The `datadog_agent` source collects logs from the Datadog Agent. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: datadog-agent-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSourceType' required: - id - type type: object RelationshipToUsers: description: Relationship to users. properties: data: description: Relationships to user objects. example: [] items: $ref: '#/components/schemas/RelationshipToUserData' type: array required: - data type: object ActionConnectionIntegration: description: The definition of `ActionConnectionIntegration` object. oneOf: - $ref: '#/components/schemas/AWSIntegration' - $ref: '#/components/schemas/HTTPIntegration' ChangeEventTriggerWrapper: description: Schema for a Change Event-based trigger. properties: changeEventTrigger: description: Trigger a workflow from a Change Event. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - changeEventTrigger type: object CloudWorkloadSecurityAgentRuleResponse: description: Response object that includes an Agent rule properties: data: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData' type: object AppMeta: description: Metadata of an app. properties: created_at: description: Timestamp of when the app was created. format: date-time type: string example: example_value deleted_at: description: Timestamp of when the app was deleted. format: date-time type: string example: example_value org_id: description: The Datadog organization ID that owns the app. format: int64 type: integer example: 42 updated_at: description: Timestamp of when the app was last updated. format: date-time type: string example: '2026-04-17T12:00:00Z' updated_since_deployment: description: Whether the app was updated since it was last published. Published apps are pinned to a specific version and do not automatically update when the app is updated. type: boolean example: true user_id: description: The ID of the user who created the app. format: int64 type: integer example: 42 user_name: description: The name (or email address) of the user who created the app. type: string example: Example Monitor user_uuid: description: The UUID of the user who created the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string version: description: The version number of the app. This starts at 1 and increments with each update. format: int64 type: integer example: 42 type: object PermissionsType: default: permissions description: Permissions resource type. enum: - permissions example: permissions type: string x-enum-varnames: - PERMISSIONS ApplicationKeyResponseMetaPage: description: Additional information related to the application key response. properties: total_filtered_count: description: Total filtered application key count. format: int64 type: integer example: 42 type: object RelationshipItem: description: Relationship entry. properties: id: description: Associated data ID. type: string example: abc-123-def type: description: Relationship type. type: string example: metric alert type: object ComponentGridType: default: grid description: The grid component type. enum: - grid example: grid type: string x-enum-varnames: - GRID CustomFrameworkRequirement: description: Framework Requirement. properties: controls: description: Requirement Controls. items: $ref: '#/components/schemas/CustomFrameworkControl' type: array name: description: Requirement Name. example: criteria type: string required: - name - controls type: object Escalation: description: Represents an escalation policy step. properties: id: description: Unique identifier of the escalation step. type: string example: abc-123-def relationships: $ref: '#/components/schemas/EscalationRelationships' type: $ref: '#/components/schemas/EscalationType' required: - type type: object RUMWarning: description: A warning message indicating something that went wrong with the query. properties: code: description: A unique code for this type of warning. example: unknown_index type: string detail: description: A detailed explanation of this specific warning. example: 'indexes: foo, bar' type: string title: description: A short human-readable summary of the warning. example: One or several indexes are missing or invalid, results hold data from the other indexes type: string type: object GetSBOMResponse: description: The expected response schema when getting an SBOM. properties: data: $ref: '#/components/schemas/SBOM' required: - data type: object ShiftDataRelationshipsUser: description: Defines the relationship between a shift and the user who is working that shift. properties: data: $ref: '#/components/schemas/ShiftDataRelationshipsUserData' required: - data type: object IncidentServiceResponseData: description: Incident Service data from responses. properties: attributes: $ref: '#/components/schemas/IncidentServiceResponseAttributes' id: description: The incident service's ID. example: 00000000-0000-0000-0000-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentServiceRelationships' type: $ref: '#/components/schemas/IncidentServiceType' required: - id - type type: object GetRuleVersionHistoryResponse: description: Response for getting the rule version history. properties: data: $ref: '#/components/schemas/GetRuleVersionHistoryData' type: object APIKeysResponseMeta: description: Additional information related to api keys response. properties: max_allowed: description: Max allowed number of API keys. format: int64 type: integer example: 42 page: $ref: '#/components/schemas/APIKeysResponseMetaPage' type: object RoutingRule: description: Represents a routing rule, including its attributes, relationships, and unique identifier. properties: attributes: $ref: '#/components/schemas/RoutingRuleAttributes' id: description: Specifies the unique identifier of this routing rule. type: string example: abc-123-def relationships: $ref: '#/components/schemas/RoutingRuleRelationships' type: $ref: '#/components/schemas/RoutingRuleType' required: - type type: object StateVariable: description: A variable, which can be set and read by other components in the app. properties: id: description: The ID of the state variable. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this state variable. This name is also used to access the variable's value throughout the app. example: ordersToSubmit type: string properties: $ref: '#/components/schemas/StateVariableProperties' type: $ref: '#/components/schemas/StateVariableType' required: - id - name - type - properties type: object RestrictionQueryRole: description: Partial role object. properties: attributes: $ref: '#/components/schemas/RestrictionQueryRoleAttribute' id: description: ID of the role. example: type: string type: default: roles description: Role resource type. example: roles readOnly: true type: string type: object SpansMetricComputeIncludePercentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `aggregation_type` is `distribution`.' example: false type: boolean AWSLogsConfig: description: AWS Logs Collection config. properties: lambda_forwarder: $ref: '#/components/schemas/AWSLambdaForwarderConfig' type: object RelationshipToSAMLAssertionAttributeData: description: Data of AuthN Mapping relationship to SAML Assertion Attribute. properties: id: description: The ID of the SAML assertion attribute. example: '0' type: string type: $ref: '#/components/schemas/SAMLAssertionAttributesType' required: - id - type type: object x-merge-override: required: false LogsMetricResponseAttributes: description: The object describing a Datadog log-based metric. properties: compute: $ref: '#/components/schemas/LogsMetricResponseCompute' filter: $ref: '#/components/schemas/LogsMetricResponseFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/LogsMetricResponseGroupBy' type: array type: object GetCustomFrameworkResponse: description: Response object to get a custom framework. properties: data: $ref: '#/components/schemas/FullCustomFrameworkData' required: - data type: object DomainAllowlistType: default: domain_allowlist description: Email domain allowlist allowlist type. enum: - domain_allowlist example: domain_allowlist type: string x-enum-varnames: - DOMAIN_ALLOWLIST NotificationRuleAttributes: description: Attributes of the notification rule. properties: created_at: $ref: '#/components/schemas/Date' created_by: $ref: '#/components/schemas/RuleUser' enabled: $ref: '#/components/schemas/Enabled' modified_at: $ref: '#/components/schemas/Date' modified_by: $ref: '#/components/schemas/RuleUser' name: $ref: '#/components/schemas/RuleName' selectors: $ref: '#/components/schemas/Selectors' targets: $ref: '#/components/schemas/Targets' time_aggregation: $ref: '#/components/schemas/TimeAggregation' version: $ref: '#/components/schemas/Version' required: - created_at - created_by - enabled - modified_at - modified_by - name - selectors - targets - version type: object EntityResponseIncludedRelatedOncallEscalations: description: Oncall escalations. items: $ref: '#/components/schemas/EntityResponseIncludedRelatedOncallEscalationItem' type: array IPAllowlistType: default: ip_allowlist description: IP allowlist type. enum: - ip_allowlist example: ip_allowlist type: string x-enum-varnames: - IP_ALLOWLIST EscalationTarget: description: Represents an escalation target, which can be a team, user, or schedule. oneOf: - $ref: '#/components/schemas/TeamTarget' - $ref: '#/components/schemas/UserTarget' - $ref: '#/components/schemas/ScheduleTarget' MonthlyCostAttributionMeta: description: The object containing document metadata. properties: aggregates: $ref: '#/components/schemas/CostAttributionAggregates' pagination: $ref: '#/components/schemas/MonthlyCostAttributionPagination' type: object SpansSort: description: Sort parameters when querying spans. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING ApplicationSecurityWafCustomRuleCondition: description: One condition of the WAF Custom Rule. properties: operator: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator' parameters: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters' required: - operator - parameters type: object TeamOnCallRespondersDataRelationshipsRespondersDataItems: description: Represents a user responder associated with the on-call team. properties: id: description: Unique identifier of the responder. example: '' type: string type: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationshipsRespondersDataItemsType' required: - type - id type: object ObservabilityPipelineOpenSearchDestinationType: default: opensearch description: The destination type. The value should always be `opensearch`. enum: - opensearch example: opensearch type: string x-enum-varnames: - OPENSEARCH DashboardListItem: description: A dashboard within a list. properties: author: $ref: '#/components/schemas/Creator' created: description: Date of creation of the dashboard. format: date-time readOnly: true type: string example: example_value icon: description: URL to the icon of the dashboard. nullable: true readOnly: true type: string example: example_value id: description: ID of the dashboard. example: q5j-nti-fv6 type: string integration_id: description: The short name of the integration. nullable: true readOnly: true type: string example: abc-123-def is_favorite: description: Whether or not the dashboard is in the favorites. readOnly: true type: boolean example: true is_read_only: description: Whether or not the dashboard is read only. readOnly: true type: boolean example: true is_shared: description: Whether the dashboard is publicly shared or not. readOnly: true type: boolean example: true modified: description: Date of last edition of the dashboard. format: date-time readOnly: true type: string example: example_value popularity: description: Popularity of the dashboard. format: int32 maximum: 5 readOnly: true type: integer example: 42 tags: description: List of team names representing ownership of a dashboard. items: description: The name of a Datadog team, formatted as `team:` type: string maxItems: 5 nullable: true readOnly: true type: array title: description: Title of the dashboard. readOnly: true type: string example: Example Monitor type: $ref: '#/components/schemas/DashboardType' url: description: URL path to the dashboard. readOnly: true type: string example: https://app.datadoghq.com required: - type - id type: object AuthNMapping: description: The AuthN Mapping object returned by API. properties: attributes: $ref: '#/components/schemas/AuthNMappingAttributes' id: description: ID of the AuthN Mapping. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string relationships: $ref: '#/components/schemas/AuthNMappingRelationships' type: $ref: '#/components/schemas/AuthNMappingsType' required: - id - type type: object x-merge-override: required: false UsageLambdaTracedInvocationsResponse: description: Lambda Traced Invocations usage response. properties: data: description: Response containing Lambda Traced Invocations usage. items: $ref: '#/components/schemas/UsageDataObject' type: array type: object CustomCostsUser: description: Metadata of the user that has uploaded the Custom Costs file. properties: email: description: The name of the Custom Costs file. example: email.test@datadohq.com type: string icon: description: The name of the Custom Costs file. example: icon.png type: string name: description: Name of the user. example: Test User type: string type: object CustomConnection: description: A custom connection used by an app. properties: attributes: $ref: '#/components/schemas/CustomConnectionAttributes' id: description: The ID of the custom connection. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: '#/components/schemas/CustomConnectionType' type: object CsmServerlessCoverageAnalysisData: description: CSM Serverless Resources Coverage Analysis data. properties: attributes: $ref: '#/components/schemas/CsmServerlessCoverageAnalysisAttributes' id: description: The ID of your organization. example: 66b3c6b5-5c9a-457e-b1c3-f247ca23afa3 type: string type: default: get_serverless_coverage_analysis_response_public_v0 description: The type of the resource. The value should always be `get_serverless_coverage_analysis_response_public_v0`. example: get_serverless_coverage_analysis_response_public_v0 type: string type: object AppDefinitionType: default: appDefinitions description: The app definition type. enum: - appDefinitions example: appDefinitions type: string x-enum-varnames: - APPDEFINITIONS CustomCostsFileUsageChargePeriod: description: Usage charge period of a Custom Costs file. properties: end: description: End of the usage of the Custom Costs file. example: 1706745600000 format: double type: number start: description: Start of the usage of the Custom Costs file. example: 1704067200000 format: double type: number type: object IncidentTodoAssignee: description: A todo assignee. example: '@test.user@test.com' oneOf: - $ref: '#/components/schemas/IncidentTodoAssigneeHandle' - $ref: '#/components/schemas/IncidentTodoAnonymousAssignee' IncidentTodoAssigneeArray: description: Array of todo assignees. example: - '@test.user@test.com' items: $ref: '#/components/schemas/IncidentTodoAssignee' type: array MicrosoftTeamsWorkflowsWebhookHandleResponseData: description: Workflows Webhook handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookResponseAttributes' id: description: The ID of the Workflows webhook handle. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType' type: object SpansResponseMetadataPage: description: Paging attributes. properties: after: description: 'The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.' example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object CustomDestinationResponseHttpDestinationAuthBasic: description: Basic access authentication. properties: type: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasicType' required: - type type: object DatabaseMonitoringTriggerWrapper: description: Schema for a Database Monitoring-based trigger. properties: databaseMonitoringTrigger: description: Trigger a workflow from Database Monitoring. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - databaseMonitoringTrigger type: object RUMApplicationResponse: description: RUM application response. properties: data: $ref: '#/components/schemas/RUMApplication' type: object ActionQueryMockedOutputsEnabled: description: Whether to enable the mocked outputs for testing. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string ObservabilityPipelineSumoLogicDestination: description: The `sumo_logic` destination forwards logs to Sumo Logic. properties: encoding: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationEncoding' header_custom_fields: description: A list of custom headers to include in the request to Sumo Logic. items: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem' type: array header_host_name: description: Optional override for the host name header. example: host-123 type: string header_source_category: description: Optional override for the source category header. example: source-category type: string header_source_name: description: Optional override for the source name header. example: source-name type: string id: description: The unique identifier for this component. example: sumo-logic-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationType' required: - id - type - inputs type: object EntityResponseIncludedSchemaAttributes: description: Included schema. properties: schema: $ref: '#/components/schemas/EntityV3' type: object TeamOnCallRespondersDataRelationshipsEscalationsDataItemsType: default: escalation_policy_steps description: Identifies the resource type for escalation policy steps linked to a team's on-call configuration. enum: - escalation_policy_steps example: escalation_policy_steps type: string x-enum-varnames: - ESCALATION_POLICY_STEPS TeamsField: description: Supported teams field. enum: - id - name - handle - summary - description - avatar - banner - visible_modules - hidden_modules - created_at - modified_at - user_count - link_count - team_links - user_team_permissions type: string x-enum-varnames: - ID - NAME - HANDLE - SUMMARY - DESCRIPTION - AVATAR - BANNER - VISIBLE_MODULES - HIDDEN_MODULES - CREATED_AT - MODIFIED_AT - USER_COUNT - LINK_COUNT - TEAM_LINKS - USER_TEAM_PERMISSIONS MonitorNotificationRuleResponse: description: A monitor notification rule. properties: data: $ref: '#/components/schemas/MonitorNotificationRuleData' included: description: Array of objects related to the monitor notification rule that the user requested. items: $ref: '#/components/schemas/MonitorNotificationRuleResponseIncludedItem' type: array type: object CaseRelationships: description: Resources related to a case properties: assignee: $ref: '#/components/schemas/NullableUserRelationship' created_by: $ref: '#/components/schemas/NullableUserRelationship' modified_by: $ref: '#/components/schemas/NullableUserRelationship' project: $ref: '#/components/schemas/ProjectRelationship' type: object Schedule: description: Top-level container for a schedule object, including both the `data` payload and any related `included` resources (such as teams, layers, or members). example: data: attributes: name: On-Call Schedule time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: layers: data: - id: 00000000-0000-0000-0000-000000000001 type: layers teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules included: - attributes: avatar: '' description: Team 1 description handle: team1 name: Team 1 id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: effective_date: '2025-02-03T05:00:00Z' end_date: '2025-12-31T00:00:00Z' interval: days: 1 name: Layer 1 restrictions: - end_day: friday end_time: '17:00:00' start_day: monday start_time: 09:00:00 rotation_start: '2025-02-01T00:00:00Z' id: 00000000-0000-0000-0000-000000000001 relationships: members: data: - id: 00000000-0000-0000-0000-000000000002 type: members type: layers - id: 00000000-0000-0000-0000-000000000002 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: members - attributes: email: foo@bar.com name: User 1 id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: $ref: '#/components/schemas/ScheduleData' included: description: Any additional resources related to this schedule, such as teams and layers. items: $ref: '#/components/schemas/ScheduleDataIncludedItem' type: array type: object EntityToIncidents: description: Entity to incidents relationship. properties: data: $ref: '#/components/schemas/RelationshipArray' type: object ObservabilityPipelineRemoveFieldsProcessor: description: The `remove_fields` processor deletes specified fields from logs. properties: fields: description: A list of field names to be removed from each log event. example: - field1 - field2 items: type: string type: array id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: remove-fields-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: The `PipelineRemoveFieldsProcessor` `inputs`. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessorType' required: - id - type - include - fields - inputs type: object WorkflowDataAttributes: description: The definition of `WorkflowDataAttributes` object. properties: createdAt: description: When the workflow was created. format: date-time readOnly: true type: string example: example_value description: description: Description of the workflow. type: string example: example_value name: description: Name of the workflow. example: '' type: string published: description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published. type: boolean example: true spec: $ref: '#/components/schemas/Spec' tags: description: Tags of the workflow. items: type: string type: array updatedAt: description: When the workflow was last updated. format: date-time readOnly: true type: string example: '2026-04-17T12:00:00Z' webhookSecret: description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here. type: string writeOnly: true example: example_value required: - name - spec type: object DowntimeScheduleRecurrenceDuration: description: The length of the downtime. Must begin with an integer and end with one of 'm', 'h', d', or 'w'. example: 123d type: string IncidentTeamsResponse: description: Response with a list of incident team payloads. properties: data: description: An array of incident teams. example: - attributes: name: team name id: 00000000-7ea3-0000-0000-000000000000 type: teams items: $ref: '#/components/schemas/IncidentTeamResponseData' type: array included: description: Included related resources which the user requested. items: $ref: '#/components/schemas/IncidentTeamIncludedItems' readOnly: true type: array meta: $ref: '#/components/schemas/IncidentResponseMeta' required: - data type: object AnnotationMarkdownTextAnnotation: description: The definition of `AnnotationMarkdownTextAnnotation` object. properties: text: description: The `markdownTextAnnotation` `text`. type: string example: example_value type: object BillingDimensionsMappingBody: description: Billing dimensions mapping data. items: $ref: '#/components/schemas/BillingDimensionsMappingBodyItem' type: array TeamOnCallResponders: description: Root object representing a team's on-call responder configuration. example: data: id: 111ee23r-aaaaa-aaaa-aaww-1234wertsd23 relationships: escalations: data: - id: 111ee23r-aaaaa-aaaa-aaww-1234wertsd23 type: escalation_policy_steps responders: data: - id: 111ee23r-aaaaa-aaaa-aaww-1234wertsd23 type: users type: team_oncall_responders included: - attributes: email: test@test.com name: Test User status: active id: 111ee23r-aaaaa-aaaa-aaww-1234wertsd23 type: users - id: 111ee23r-aaaaa-aaaa-aaww-1234wertsd23 relationships: responders: data: - id: 111ee23r-aaaaa-aaaa-aaww-1234wertsd23 type: users type: escalation_policy_steps properties: data: $ref: '#/components/schemas/TeamOnCallRespondersData' included: description: The `TeamOnCallResponders` `included`. items: $ref: '#/components/schemas/TeamOnCallRespondersIncluded' type: array type: object OutputSchemaParameters: description: The definition of `OutputSchemaParameters` object. properties: defaultValue: description: The `OutputSchemaParameters` `defaultValue`. example: example_value description: description: The `OutputSchemaParameters` `description`. type: string example: example_value label: description: The `OutputSchemaParameters` `label`. type: string example: example_value name: description: The `OutputSchemaParameters` `name`. example: '' type: string type: $ref: '#/components/schemas/OutputSchemaParametersType' value: description: The `OutputSchemaParameters` `value`. example: example_value required: - name - type type: object RumMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the rum-based metric will be aggregated over. example: '@http.status_code' type: string tag_name: description: Eventual name of the tag that gets created. By default, `path` is used as the tag name. example: status_code type: string type: object EntityV3QueueSpec: additionalProperties: false description: The definition of Entity V3 Queue Spec object. properties: componentOf: description: A list of components the queue is a part of items: type: string type: array lifecycle: description: The lifecycle state of the queue. minLength: 1 type: string example: example_value tier: description: The importance of the queue. minLength: 1 type: string example: example_value type: description: The type of queue. type: string example: metric alert type: object UserTeamAttributes: description: Team membership attributes properties: provisioned_by: description: 'The mechanism responsible for provisioning the team relationship. Possible values: null for added by a user, "service_account" if added by a service account, and "saml_mapping" if provisioned via SAML mapping.' nullable: true readOnly: true type: string example: example_value provisioned_by_id: description: UUID of the User or Service Account who provisioned this team membership, or null if provisioned via SAML mapping. nullable: true readOnly: true type: string example: abc-123-def role: $ref: '#/components/schemas/UserTeamRole' type: object ServiceDefinitionV1Pagerduty: description: PagerDuty service URL for the service. example: https://my-org.pagerduty.com/service-directory/PMyService type: string RoutingRuleAction: description: Defines an action that is executed when a routing rule matches certain criteria. oneOf: - $ref: '#/components/schemas/SendSlackMessageAction' - $ref: '#/components/schemas/SendTeamsMessageAction' UserTeam: description: A user's relationship with a team properties: attributes: $ref: '#/components/schemas/UserTeamAttributes' id: description: The ID of a user's relationship with a team example: TeamMembership-aeadc05e-98a8-11ec-ac2c-da7ad0900001-38835 type: string relationships: $ref: '#/components/schemas/UserTeamRelationships' type: $ref: '#/components/schemas/UserTeamType' required: - id - type type: object x-merge-override: required: false ObservabilityPipelineAddFieldsProcessor: description: The `add_fields` processor adds static key-value fields to logs. properties: fields: description: A list of static fields (key-value pairs) that is added to each log event processed by this component. items: $ref: '#/components/schemas/ObservabilityPipelineFieldValue' type: array id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: add-fields-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessorType' required: - id - type - include - fields - inputs type: object ObservabilityPipelineLogstashSource: description: The `logstash` source ingests logs from a Logstash forwarder. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: logstash-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineLogstashSourceType' required: - id - type type: object LogsAggregateResponseStatus: description: The status of the response enum: - done - timeout example: done type: string x-enum-varnames: - DONE - TIMEOUT CIAppPipelineEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from CI Visibility pipeline events. example: customAttribute: 123 duration: 2345 type: object ci_level: $ref: '#/components/schemas/CIAppPipelineLevel' tags: $ref: '#/components/schemas/TagsEventAttribute' type: object CloudWorkloadSecurityAgentPolicyResponse: description: Response object that includes an Agent policy properties: data: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyData' type: object CustomFrameworkControl: description: Framework Control. properties: name: description: Control Name. example: A1.2 type: string rules_id: description: Rule IDs. example: - '["def-000-abc"]' items: type: string type: array required: - name - rules_id type: object ScheduleUserType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS ObservabilityPipelineAddFieldsProcessorType: default: add_fields description: The processor type. The value should always be `add_fields`. enum: - add_fields example: add_fields type: string x-enum-varnames: - ADD_FIELDS TeamRoutingRulesDataRelationshipsRulesDataItems: description: Defines a relationship item to link a routing rule by its ID and type. properties: id: description: Specifies the unique identifier for the related routing rule. example: '' type: string type: $ref: '#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItemsType' required: - type - id type: object SpansListResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: '#/components/schemas/SpansResponseMetadataPage' request_id: description: The identifier of the request. example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR type: string status: $ref: '#/components/schemas/SpansAggregateResponseStatus' warnings: description: 'A list of warnings (non fatal errors) encountered, partial results might be returned if warnings are present in the response.' items: $ref: '#/components/schemas/SpansWarning' type: array type: object AppRelationship: description: The app's publication relationship and custom connections. properties: connections: description: Array of custom connections used by the app. items: $ref: '#/components/schemas/CustomConnection' type: array deployment: $ref: '#/components/schemas/DeploymentRelationship' type: object ServiceDefinitionV2Doc: description: Service documents. properties: name: description: Document name. example: Architecture type: string provider: description: Document provider. example: google drive type: string url: description: Document URL. example: https://gdrive/mydoc type: string required: - name - url type: object MicrosoftTeamsTenantBasedHandleResponseData: description: Tenant-based handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleAttributes' id: description: The ID of the tenant-based handle. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleType' type: object x-merge-override: required: false DORAListFailuresRequest: description: Request to get a list of failures. properties: data: $ref: '#/components/schemas/DORAListFailuresRequestData' required: - data type: object ObservabilityPipelineEnrichmentTableProcessor: description: The `enrichment_table` processor enriches logs using a static CSV file or GeoIP database. properties: file: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFile' geoip: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableGeoIp' id: description: The unique identifier for this processor. example: enrichment-table-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: source:my-source type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - add-fields-processor items: type: string type: array target: description: Path where enrichment results should be stored in the log. example: enriched.geoip type: string type: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType' required: - id - type - include - inputs - target type: object SpansMetricID: description: The name of the span-based metric. example: my.metric type: string GetDeviceResponse: description: The `GetDevice` operation's response. properties: data: $ref: '#/components/schemas/GetDeviceData' type: object ServiceDefinitionV2Repo: description: Service code repositories. properties: name: description: Repository name. example: Source Code type: string provider: description: Repository provider. example: GitHub type: string url: description: Repository URL. example: https://github.com/DataDog/schema type: string required: - name - url type: object ServiceDefinitionV1Resource: description: Service's external links. properties: name: description: Link name. example: Runbook type: string type: $ref: '#/components/schemas/ServiceDefinitionV1ResourceType' url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object IncidentImpactsType: description: The incident impacts type. enum: - incident_impacts example: incident_impacts type: string x-enum-varnames: - INCIDENT_IMPACTS RelationshipToRoleData: description: Relationship to role object. properties: id: description: The unique identifier of the role. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string type: $ref: '#/components/schemas/RolesType' type: object x-merge-override: required: false PartialApplicationKeyAttributes: description: Attributes of a partial application key. properties: created_at: description: Creation date of the application key. example: '2020-11-23T10:00:00.000Z' readOnly: true type: string x-merge-override: format: false last4: description: The last four characters of the application key. example: abcd maxLength: 4 minLength: 4 readOnly: true type: string x-secret: true name: description: Name of the application key. example: Application Key for managing dashboards type: string scopes: description: Array of scopes to grant the application key. example: - dashboards_read - dashboards_write - dashboards_public_share items: description: Name of scope. type: string nullable: true type: array type: object EntityV3SystemDatadog: additionalProperties: false description: Datadog product integrations for the service entity. properties: events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' pipelines: $ref: '#/components/schemas/EntityV3DatadogPipelines' type: object ConfluentAccountType: default: confluent-cloud-accounts description: The JSON:API type for this API. Should always be `confluent-cloud-accounts`. enum: - confluent-cloud-accounts example: confluent-cloud-accounts type: string x-enum-varnames: - CONFLUENT_CLOUD_ACCOUNTS ExternalUser: description: Definition of a user. properties: active: description: A Boolean value indicating the User's administrative status. type: boolean example: true emails: description: Email addresses for the user. items: $ref: '#/components/schemas/ExternalUserEmailType' type: array id: description: The identifier of the resource. Not required when creating a user. type: string example: abc-123-def meta: $ref: '#/components/schemas/ExternalUserMeta' name: $ref: '#/components/schemas/ExternalUserNameType' schemas: description: User JSON Schemas. example: - urn:ietf:params:scim:schemas:core:2.0:User items: type: string type: array title: description: The user's title. type: string example: Example Monitor userName: description: Unique identifier for the User. type: string example: Example Monitor type: object FastlyAccountType: default: fastly-accounts description: The JSON:API type for this API. Should always be `fastly-accounts`. enum: - fastly-accounts example: fastly-accounts type: string x-enum-varnames: - FASTLY_ACCOUNTS ObservabilityPipelineAmazonOpenSearchDestinationAuth: description: 'Authentication settings for the Amazon OpenSearch destination. The `strategy` field determines whether basic or AWS-based authentication is used. ' properties: assume_role: description: The ARN of the role to assume (used with `aws` strategy). type: string example: example_value aws_region: description: AWS region type: string example: example_value external_id: description: External ID for the assumed role (used with `aws` strategy). type: string example: abc-123-def session_name: description: Session name for the assumed role (used with `aws` strategy). type: string example: Example Monitor strategy: $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy' required: - strategy type: object SpansMetricResponseData: description: The span-based metric properties. properties: attributes: $ref: '#/components/schemas/SpansMetricResponseAttributes' id: $ref: '#/components/schemas/SpansMetricID' type: $ref: '#/components/schemas/SpansMetricType' type: object EntityResponseIncludedRelatedEntityType: description: Related entity. enum: - relatedEntity type: string x-enum-varnames: - RELATED_ENTITY AWSTracesConfig: description: AWS Traces Collection config. properties: xray_services: $ref: '#/components/schemas/XRayServicesList' type: object CloudWorkloadSecurityAgentPolicyUpdaterAttributes: description: The attributes of the user who last updated the policy properties: handle: description: The handle of the user example: datadog.user@example.com type: string name: description: The name of the user example: Datadog User nullable: true type: string type: object MonitorDowntimeMatchResponse: description: Response for retrieving all downtime matches for a monitor. properties: data: description: An array of downtime matches. items: $ref: '#/components/schemas/MonitorDowntimeMatchResponseData' type: array meta: $ref: '#/components/schemas/DowntimeMeta' type: object MetricPaginationMeta: description: Response metadata object. properties: pagination: $ref: '#/components/schemas/MetricMetaPage' type: object AWSRegionsIncludeOnly: description: Include only these regions. properties: include_only: description: Include only these regions. example: - us-east-1 items: example: us-east-1 type: string type: array required: - include_only type: object CIAppTestEventTypeName: description: Type of the event. enum: - citest example: citest type: string x-enum-varnames: - CITEST APIKeysResponse: description: Response for a list of API keys. properties: data: description: Array of API keys. items: $ref: '#/components/schemas/PartialAPIKey' type: array included: description: Array of objects related to the API key. items: $ref: '#/components/schemas/APIKeyResponseIncludedItem' type: array x-merge-override: items: false meta: $ref: '#/components/schemas/APIKeysResponseMeta' type: object EntityResponseIncludedIncidentType: description: Incident description. enum: - incident type: string x-enum-varnames: - INCIDENT CustomDestinationResponseForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType' required: - type - endpoint type: object TokenName: description: Name for tokens. example: MyTokenName pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string ID: description: The ID of a notification rule. example: aaa-bbb-ccc type: string PowerpackResponse: description: Response object which includes a single powerpack configuration. properties: data: $ref: '#/components/schemas/PowerpackData' included: description: Array of objects related to the users. items: $ref: '#/components/schemas/User' type: array readOnly: true type: object LogsWarning: description: A warning message indicating something that went wrong with the query properties: code: description: A unique code for this type of warning example: unknown_index type: string detail: description: A detailed explanation of this specific warning example: 'indexes: foo, bar' type: string title: description: A short human-readable summary of the warning example: One or several indexes are missing or invalid, results hold data from the other indexes type: string type: object DowntimeResponse: description: 'Downtiming gives you greater control over monitor notifications by allowing you to globally exclude scopes from alerting. Downtime settings, which can be scheduled with start and end times, prevent all alerting related to specified Datadog tags.' properties: data: $ref: '#/components/schemas/DowntimeResponseData' included: description: Array of objects related to the downtime that the user requested. items: $ref: '#/components/schemas/DowntimeResponseIncludedItem' type: array type: object RelationshipToUserTeamUserData: description: A user's relationship with a team properties: id: description: The ID of the user associated with the team example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string type: $ref: '#/components/schemas/UserTeamUserType' required: - id - type type: object x-merge-override: required: false ServiceDefinitionV2Dot1Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: '#/components/schemas/ServiceDefinitionV2Dot1OpsgenieRegion' service-url: description: Opsgenie service url. example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 type: string required: - service-url type: object ActionQueryProperties: description: The properties of the action query. properties: condition: $ref: '#/components/schemas/ActionQueryCondition' debounceInMs: $ref: '#/components/schemas/ActionQueryDebounceInMs' mockedOutputs: $ref: '#/components/schemas/ActionQueryMockedOutputs' onlyTriggerManually: $ref: '#/components/schemas/ActionQueryOnlyTriggerManually' outputs: description: The post-query transformation function, which is a JavaScript function that changes the query's `.outputs` property after the query's execution. example: ${((outputs) => {return outputs.body.data})(self.rawOutputs)} type: string pollingIntervalInMs: $ref: '#/components/schemas/ActionQueryPollingIntervalInMs' requiresConfirmation: $ref: '#/components/schemas/ActionQueryRequiresConfirmation' showToastOnError: $ref: '#/components/schemas/ActionQueryShowToastOnError' spec: $ref: '#/components/schemas/ActionQuerySpec' required: - spec type: object AppDeploymentType: default: deployment description: The deployment type. enum: - deployment example: deployment type: string x-enum-varnames: - DEPLOYMENT SecurityMonitoringStandardRuleResponse: description: Rule. properties: cases: description: Cases for generating signals. items: $ref: '#/components/schemas/SecurityMonitoringRuleCase' type: array complianceSignalOptions: $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions' createdAt: description: When the rule was created, timestamp in milliseconds. format: int64 type: integer example: 42 creationAuthorId: description: User ID of the user who created the rule. format: int64 type: integer example: 42 defaultTags: description: Default Tags for default rules (included in tags) example: - security:attacks items: description: Default Tag. type: string type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 type: integer example: 42 filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. type: boolean example: true id: description: The ID of the rule. type: string example: abc-123-def isDefault: description: Whether the rule is included by default. type: boolean example: true isDeleted: description: Whether the rule has been deleted. type: boolean example: true isEnabled: description: Whether the rule is enabled. type: boolean example: true message: description: Message for generated signals. type: string example: CPU usage is high on {{host.name}} name: description: The name of the rule. type: string example: Example Monitor options: $ref: '#/components/schemas/SecurityMonitoringRuleOptions' queries: description: Queries for selecting logs which are part of the rule. items: $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery' type: array referenceTables: description: Reference tables for the rule. items: $ref: '#/components/schemas/SecurityMonitoringReferenceTable' type: array tags: description: Tags for generated signals. items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase' type: array type: $ref: '#/components/schemas/SecurityMonitoringRuleTypeRead' updateAuthorId: description: User ID of the user who updated the rule. format: int64 type: integer example: 42 updatedAt: description: The date the rule was last updated, in milliseconds. format: int64 type: integer example: 42 version: description: The version of the rule. format: int64 type: integer example: 42 type: object PowerpackInnerWidgets: description: Powerpack group widget definition of individual widgets. properties: definition: additionalProperties: {} description: Information about widget. example: definition: content: example type: note type: object layout: $ref: '#/components/schemas/PowerpackInnerWidgetLayout' required: - definition type: object SecurityMonitoringRuleDetectionMethod: description: The detection method. enum: - threshold - new_value - anomaly_detection - impossible_travel - hardcoded - third_party - anomaly_threshold type: string x-enum-varnames: - THRESHOLD - NEW_VALUE - ANOMALY_DETECTION - IMPOSSIBLE_TRAVEL - HARDCODED - THIRD_PARTY - ANOMALY_THRESHOLD UserTargetType: default: users description: Indicates that the resource is of type `users`. enum: - users example: users type: string x-enum-varnames: - USERS ObservabilityPipelineQuotaProcessor: description: The Quota Processor measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert. properties: drop_events: description: If set to `true`, logs that matched the quota filter and sent after the quota has been met are dropped; only logs that did not match the filter query continue through the pipeline. example: false type: boolean id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: quota-processor type: string ignore_when_missing_partitions: description: If `true`, the processor skips quota checks when partition fields are missing from the logs. type: boolean example: true include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array limit: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit' name: description: Name of the quota. example: MyQuota type: string overflow_action: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction' overrides: description: A list of alternate quota rules that apply to specific sets of events, identified by matching field values. Each override can define a custom limit. items: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverride' type: array partition_fields: description: A list of fields used to segment log traffic for quota enforcement. Quotas are tracked independently by unique combinations of these field values. items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorType' required: - id - type - include - name - drop_events - limit - inputs type: object Annotation: description: A list of annotations used in the workflow. These are like sticky notes for your workflow! properties: display: $ref: '#/components/schemas/AnnotationDisplay' id: description: The `Annotation` `id`. example: '' type: string markdownTextAnnotation: $ref: '#/components/schemas/AnnotationMarkdownTextAnnotation' required: - id - display - markdownTextAnnotation type: object CostByOrgType: default: cost_by_org description: Type of cost data. enum: - cost_by_org example: cost_by_org type: string x-enum-varnames: - COST_BY_ORG SecurityMonitoringRuleNewValueOptionsLearningThreshold: default: 0 description: A number of occurrences after which signals will be generated for values that weren't learned. enum: - 0 - 1 format: int32 type: integer x-enum-varnames: - ZERO_OCCURRENCES - ONE_OCCURRENCE ComponentType: description: The UI component type. enum: - table - textInput - textArea - button - text - select - modal - schemaForm - checkbox - tabs - vegaChart - radioButtons - numberInput - fileInput - jsonInput - gridCell - dateRangePicker - search - container - calloutValue example: text type: string x-enum-varnames: - TABLE - TEXTINPUT - TEXTAREA - BUTTON - TEXT - SELECT - MODAL - SCHEMAFORM - CHECKBOX - TABS - VEGACHART - RADIOBUTTONS - NUMBERINPUT - FILEINPUT - JSONINPUT - GRIDCELL - DATERANGEPICKER - SEARCH - CONTAINER - CALLOUTVALUE EntityV3: description: Entity schema v3. oneOf: - $ref: '#/components/schemas/EntityV3Service' - $ref: '#/components/schemas/EntityV3Datastore' - $ref: '#/components/schemas/EntityV3Queue' - $ref: '#/components/schemas/EntityV3System' - $ref: '#/components/schemas/EntityV3API' GithubWebhookTrigger: description: Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a `webhookSecret`. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object APIKeyResponse: description: Response for retrieving an API key. properties: data: $ref: '#/components/schemas/FullAPIKey' included: description: Array of objects related to the API key. items: $ref: '#/components/schemas/APIKeyResponseIncludedItem' type: array x-merge-override: items: false type: object IncidentIntegrationMetadataType: default: incident_integrations description: Integration metadata resource type. enum: - incident_integrations example: incident_integrations type: string x-enum-varnames: - INCIDENT_INTEGRATIONS TeamLink: description: Team link properties: attributes: $ref: '#/components/schemas/TeamLinkAttributes' id: description: The team link's identifier example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamLinkType' required: - attributes - id - type type: object x-merge-override: required: false DeploymentAttributes: description: The attributes object containing the version ID of the published app. properties: app_version_id: description: The version ID of the app that was published. For an unpublished app, this is always the nil UUID (`00000000-0000-0000-0000-000000000000`). example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: object MicrosoftTeamsWorkflowsWebhookHandlesResponse: description: Response with a list of Workflows webhook handles. properties: data: description: An array of Workflows webhook handles. example: - attributes: name: general-handle id: 596da4af-0563-4097-90ff-07230c3f9db3 type: workflows-webhook-handle - attributes: name: general-handle-2 id: 596da4af-0563-4097-90ff-07230c3f9db4 type: workflows-webhook-handle items: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponseData' type: array required: - data type: object FullAPIKey: description: Datadog API key. properties: attributes: $ref: '#/components/schemas/FullAPIKeyAttributes' id: description: ID of the API key. type: string example: abc-123-def relationships: $ref: '#/components/schemas/APIKeyRelationships' type: $ref: '#/components/schemas/APIKeysType' type: object x-merge-override: required: false ObservabilityPipelineSensitiveDataScannerProcessorRule: description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take. properties: keyword_options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions' name: description: A name identifying the rule. example: Redact Credit Card Numbers type: string on_match: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction' pattern: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern' scope: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope' tags: description: Tags assigned to this rule for filtering and classification. example: - pii - ccn items: type: string type: array required: - name - tags - pattern - scope - on_match type: object DeploymentRelationship: description: Information pointing to the app's publication status. properties: data: $ref: '#/components/schemas/DeploymentRelationshipData' meta: $ref: '#/components/schemas/DeploymentMetadata' type: object DowntimeScheduleRecurrenceRrule: description: 'The `RRULE` standard for defining recurring events. For example, to have a recurring event on the first day of each month, set the type to `rrule` and set the `FREQ` to `MONTHLY` and `BYMONTHDAY` to `1`. Most common `rrule` options from the [iCalendar Spec](https://tools.ietf.org/html/rfc5545) are supported. **Note**: Attributes specifying the duration in `RRULE` are not supported (for example, `DTSTART`, `DTEND`, `DURATION`). More examples available in this [downtime guide](https://docs.datadoghq.com/monitors/guide/suppress-alert-with-downtimes/?tab=api).' example: FREQ=MONTHLY;BYSETPOS=3;BYDAY=WE;INTERVAL=1 type: string UserAttributesStatus: description: The user's status. enum: - active - deactivated - pending type: string x-enum-varnames: - ACTIVE - DEACTIVATED - PENDING WidgetLiveSpan: description: The available timeframes depend on the widget you are using. enum: - 1m - 5m - 10m - 15m - 30m - 1h - 4h - 1d - 2d - 1w - 1mo - 3mo - 6mo - 1y - alert example: 5m type: string x-enum-varnames: - PAST_ONE_MINUTE - PAST_FIVE_MINUTES - PAST_TEN_MINUTES - PAST_FIFTEEN_MINUTES - PAST_THIRTY_MINUTES - PAST_ONE_HOUR - PAST_FOUR_HOURS - PAST_ONE_DAY - PAST_TWO_DAYS - PAST_ONE_WEEK - PAST_ONE_MONTH - PAST_THREE_MONTHS - PAST_SIX_MONTHS - PAST_ONE_YEAR - ALERT EscalationPolicyStepAttributesAssignment: description: Specifies how this escalation step will assign targets (example `default` or `round-robin`). enum: - default - round-robin type: string x-enum-varnames: - DEFAULT - ROUND_ROBIN SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv: description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`. The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.' example: false type: boolean JiraIntegrationMetadataIssuesItem: description: Item in the Jira integration metadata issue array. properties: account: description: URL of issue's Jira account. example: https://example.atlassian.net type: string issue_key: description: Jira issue's issue key. example: PROJ-123 type: string issuetype_id: description: Jira issue's issue type. example: '1000' type: string project_key: description: Jira issue's project keys. example: PROJ type: string redirect_url: description: URL redirecting to the Jira issue. example: https://example.atlassian.net/browse/PROJ-123 type: string required: - project_key - account type: object ApplicationSecurityWafCustomRuleConditionInputAddress: description: Input from the request on which the condition should apply. enum: - server.db.statement - server.io.fs.file - server.io.net.url - server.sys.shell.cmd - server.request.method - server.request.uri.raw - server.request.path_params - server.request.query - server.request.headers.no_cookies - server.request.cookies - server.request.trailers - server.request.body - server.response.status - server.response.headers.no_cookies - server.response.trailers - grpc.server.request.metadata - grpc.server.request.message - grpc.server.method - graphql.server.all_resolvers - usr.id - http.client_ip example: server.db.statement type: string x-enum-varnames: - SERVER_DB_STATEMENT - SERVER_IO_FS_FILE - SERVER_IO_NET_URL - SERVER_SYS_SHELL_CMD - SERVER_REQUEST_METHOD - SERVER_REQUEST_URI_RAW - SERVER_REQUEST_PATH_PARAMS - SERVER_REQUEST_QUERY - SERVER_REQUEST_HEADERS_NO_COOKIES - SERVER_REQUEST_COOKIES - SERVER_REQUEST_TRAILERS - SERVER_REQUEST_BODY - SERVER_RESPONSE_STATUS - SERVER_RESPONSE_HEADERS_NO_COOKIES - SERVER_RESPONSE_TRAILERS - GRPC_SERVER_REQUEST_METADATA - GRPC_SERVER_REQUEST_MESSAGE - GRPC_SERVER_METHOD - GRAPHQL_SERVER_ALL_RESOLVERS - USR_ID - HTTP_CLIENT_IP EscalationPolicyUserType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS ContainerAttributes: description: Attributes for a container. properties: container_id: description: The ID of the container. type: string example: abc-123-def created_at: description: Time the container was created. type: string example: example_value host: description: Hostname of the host running the container. type: string example: example_value image_digest: description: Digest of the compressed image manifest. nullable: true type: string example: example_value image_name: description: Name of the associated container image. type: string example: Example Monitor image_tags: description: List of image tags associated with the container image. items: type: string nullable: true type: array name: description: Name of the container. type: string example: Example Monitor started_at: description: Time the container was started. type: string example: example_value state: description: State of the container. This depends on the container runtime. type: string example: example_value tags: description: List of tags associated with the container. items: type: string type: array type: object RelationshipToUser: description: Relationship to user. properties: data: $ref: '#/components/schemas/RelationshipToUserData' required: - data type: object RelationshipToTeamData: description: Relationship to Team object. properties: id: description: The unique identifier of the team. example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamType' type: object x-merge-override: required: false AWSAccountID: description: AWS Account ID. example: '123456789012' type: string DeviceAttributesInterfaceStatuses: description: Count of the device interfaces by status example: down: 1 'off': 2 up: 12 warning: 5 properties: down: description: The number of interfaces that are down format: int64 type: integer example: 42 'off': description: The number of interfaces that are off format: int64 type: integer example: 42 up: description: The number of interfaces that are up format: int64 type: integer example: 42 warning: description: The number of interfaces that are in a warning state format: int64 type: integer example: 42 type: object ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy: description: Uses a numeric field in the log event as the metric increment. enum: - increment_by_field example: increment_by_field type: string x-enum-varnames: - INCREMENT_BY_FIELD IncidentFieldAttributesSingleValueType: default: dropdown description: Type of the single value field definitions. enum: - dropdown - textbox example: dropdown type: string x-enum-varnames: - DROPDOWN - TEXTBOX AwsScanOptionsType: default: aws_scan_options description: The type of the resource. The value should always be `aws_scan_options`. enum: - aws_scan_options example: aws_scan_options type: string x-enum-varnames: - AWS_SCAN_OPTIONS ComponentGridProperties: description: Properties of a grid component. properties: backgroundColor: default: default description: The background color of the grid. type: string example: example_value children: description: The child components of the grid. items: $ref: '#/components/schemas/Component' type: array isVisible: $ref: '#/components/schemas/ComponentGridPropertiesIsVisible' type: object TriggerRateLimit: description: Defines a rate limit for a trigger. properties: count: description: The `TriggerRateLimit` `count`. format: int64 type: integer example: 42 interval: description: The `TriggerRateLimit` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s type: string example: example_value type: object ShiftDataRelationships: description: The definition of `ShiftDataRelationships` object. properties: user: $ref: '#/components/schemas/ShiftDataRelationshipsUser' type: object ObservabilityPipelineAmazonDataFirehoseSource: description: The `amazon_data_firehose` source ingests logs from AWS Data Firehose. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAwsAuth' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: amazon-firehose-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSourceType' required: - id - type type: object HistoricalJobOptions: description: Job options. properties: detectionMethod: $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod' evaluationWindow: $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow' impossibleTravelOptions: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions' keepAlive: $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive' maxSignalDuration: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object ListDevicesResponseMetadata: description: Object describing meta attributes of response. properties: page: $ref: '#/components/schemas/ListDevicesResponseMetadataPage' type: object UsersResponse: description: Response containing information about multiple users. properties: data: description: Array of returned users. items: $ref: '#/components/schemas/User' type: array included: description: Array of objects related to the users. items: $ref: '#/components/schemas/UserResponseIncludedItem' type: array meta: $ref: '#/components/schemas/ResponseMetaAttributes' readOnly: true type: object CIAppResponseStatus: description: The status of the response. enum: - done - timeout example: done type: string x-enum-varnames: - DONE - TIMEOUT SpansMetricResponseCompute: description: The compute rule to compute the span-based metric. properties: aggregation_type: $ref: '#/components/schemas/SpansMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/SpansMetricComputeIncludePercentiles' path: description: The path to the value the span-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: '@duration' type: string type: object RoutingRuleRelationships: description: Specifies relationships for a routing rule, linking to associated policy resources. properties: policy: $ref: '#/components/schemas/RoutingRuleRelationshipsPolicy' type: object RelationResponse: description: Relation response data. properties: attributes: $ref: '#/components/schemas/RelationAttributes' id: description: Relation ID. type: string example: abc-123-def meta: $ref: '#/components/schemas/RelationMeta' relationships: $ref: '#/components/schemas/RelationRelationships' subtype: description: Relation subtype. type: string example: metric alert type: $ref: '#/components/schemas/RelationResponseType' type: object ObservabilityPipelineRsyslogDestination: description: The `rsyslog` destination forwards logs to an external `rsyslog` server over TCP or UDP using the syslog protocol. properties: id: description: The unique identifier for this component. example: rsyslog-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array keepalive: description: Optional socket keepalive duration in milliseconds. example: 60000 format: int64 minimum: 0 type: integer tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestinationType' required: - id - type - inputs type: object Targets: description: 'List of recipients to notify when a notification rule is triggered. Many different target types are supported, such as email addresses, Slack channels, and PagerDuty services. The appropriate integrations need to be properly configured to send notifications to the specified targets.' example: - '@john.doe@email.com' items: description: Recipients to notify. type: string type: array CsmServerlessCoverageAnalysisResponse: description: CSM Serverless Resources Coverage Analysis response. properties: data: $ref: '#/components/schemas/CsmServerlessCoverageAnalysisData' type: object ObservabilityPipelineSensitiveDataScannerProcessorActionHash: description: Configuration for hashing matched sensitive values. properties: action: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction' options: description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionHash` `options`. type: object required: - action type: object EntityResponseIncludedRelatedOncallAttributes: description: Included related oncall attributes. properties: escalations: $ref: '#/components/schemas/EntityResponseIncludedRelatedOncallEscalations' provider: description: Oncall provider. type: string example: abc-123-def type: object ServiceDefinitionV2Dot2Version: default: v2.2 description: Schema version being used. enum: - v2.2 example: v2.2 type: string x-enum-varnames: - V2_2 EscalationPolicy: description: Represents a complete escalation policy response, including policy data and optionally included related resources. example: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies included: - attributes: avatar: '' description: Team 1 description handle: team1 name: Team 1 id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: assignment: default escalate_after_seconds: 3600 id: 00000000-aba1-0000-0000-000000000000 relationships: targets: data: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams type: steps - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams properties: data: $ref: '#/components/schemas/EscalationPolicyData' included: description: Provides any included related resources, such as steps or targets, returned with the policy. items: $ref: '#/components/schemas/EscalationPolicyIncluded' type: array type: object ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions: description: Configuration for keywords used to reinforce sensitive data pattern detection. properties: keywords: description: A list of keywords to match near the sensitive pattern. example: - ssn - card - account items: type: string type: array proximity: description: Maximum number of tokens between a keyword and a sensitive value match. example: 5 format: int64 type: integer required: - keywords - proximity type: object ObservabilityPipelineSumoLogicSourceType: default: sumo_logic description: The source type. The value should always be `sumo_logic`. enum: - sumo_logic example: sumo_logic type: string x-enum-varnames: - SUMO_LOGIC SpansMetricResponseFilter: description: The span-based metric filter. Spans matching this filter will be aggregated in this metric. properties: query: description: The search query - following the span search syntax. example: '@http.status_code:200 service:my-service' type: string type: object ProjectedCostResponse: description: Projected Cost response. properties: data: description: Response containing Projected Cost. items: $ref: '#/components/schemas/ProjectedCost' type: array type: object PowerpacksResponseMeta: description: Powerpack response metadata. properties: pagination: $ref: '#/components/schemas/PowerpacksResponseMetaPagination' type: object ApplicationSecurityWafCustomRuleConditionInput: description: Input from the request on which the condition should apply. properties: address: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress' key_path: description: Specific path for the input. items: type: string type: array required: - address type: object FastlyAccounResponseAttributes: description: Attributes object of a Fastly account. properties: name: description: The name of the Fastly account. example: test-name type: string services: description: A list of services belonging to the parent account. items: $ref: '#/components/schemas/FastlyService' type: array required: - name type: object SecurityMonitoringSignalResponse: description: Security Signal response data object. properties: data: $ref: '#/components/schemas/SecurityMonitoringSignal' type: object ObservabilityPipelineSentinelOneDestinationType: default: sentinel_one description: The destination type. The value should always be `sentinel_one`. enum: - sentinel_one example: sentinel_one type: string x-enum-varnames: - SENTINEL_ONE ApplicationSecurityWafCustomRuleScope: description: The scope of the WAF custom rule. properties: env: description: The environment scope for the WAF custom rule. example: prod type: string service: description: The service scope for the WAF custom rule. example: billing-service type: string required: - service - env type: object SecurityMonitoringThirdPartyRuleCase: description: Case when signal is generated by a third party rule. properties: name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array query: description: A query to map a third party event to this case. type: string example: avg:system.cpu.user{*} status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' type: object ActionQuerySpecConnectionGroup: description: The connection group to use for an action query. properties: id: description: The ID of the connection group. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string tags: description: The tags of the connection group. items: type: string type: array type: object MonitorNotificationRuleResponseIncludedItem: description: An object related to a monitor notification rule. oneOf: - $ref: '#/components/schemas/User' AWSAuthConfigKeys: description: AWS Authentication config to integrate your account using an access key pair. properties: access_key_id: description: AWS Access Key ID. example: AKIAIOSFODNN7EXAMPLE type: string secret_access_key: description: AWS Secret Access Key. example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY minLength: 1 type: string writeOnly: true required: - access_key_id type: object XRayServicesList: description: AWS X-Ray services to collect traces from. Defaults to `include_only`. oneOf: - $ref: '#/components/schemas/XRayServicesIncludeAll' - $ref: '#/components/schemas/XRayServicesIncludeOnly' OpsgenieServiceType: default: opsgenie-service description: Opsgenie service resource type. enum: - opsgenie-service example: opsgenie-service type: string x-enum-varnames: - OPSGENIE_SERVICE IncidentFieldAttributes: description: Dynamic fields for which selections can be made, with field names as keys. oneOf: - $ref: '#/components/schemas/IncidentFieldAttributesSingleValue' - $ref: '#/components/schemas/IncidentFieldAttributesMultipleValue' RoutingRuleRelationshipsPolicyDataType: default: policies description: Indicates that the resource is of type 'policies'. enum: - policies example: policies type: string x-enum-varnames: - POLICIES RestrictionPolicyBinding: description: Specifies which principals are associated with a relation. properties: principals: description: 'An array of principals. A principal is a subject or group of subjects. Each principal is formatted as `type:id`. Supported types: `role`, `team`, `user`, and `org`. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.' example: - role:00000000-0000-1111-0000-000000000000 items: description: 'Subject or group of subjects. Each principal is formatted as `type:id`. Supported types: `role`, `team`, `user`, and `org`. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.' type: string type: array relation: description: The role/level of access. example: editor type: string required: - relation - principals type: object APITriggerWrapper: description: Schema for an API-based trigger. properties: apiTrigger: $ref: '#/components/schemas/APITrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - apiTrigger type: object ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem: description: Single key-value pair used as a custom log header for Sumo Logic. properties: name: description: The header field name. example: X-Sumo-Category type: string value: description: The header field value. example: my-app-logs type: string required: - name - value type: object Log: description: Object description of a log after being processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/LogAttributes' id: description: Unique ID of the Log. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/LogType' type: object HTTPTokenAuthType: description: The definition of `HTTPTokenAuthType` object. enum: - HTTPTokenAuth example: HTTPTokenAuth type: string x-enum-varnames: - HTTPTOKENAUTH TeamOnCallRespondersIncluded: description: Represents an union of related resources included in the response, such as users and escalation steps. oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/Escalation' DORAEvent: description: A DORA event. properties: attributes: description: The attributes of the event. type: object id: description: The ID of the event. type: string example: abc-123-def type: description: The type of the event. type: string example: metric alert type: object TeamRelationshipsLinks: description: Links attributes. properties: related: description: Related link. example: /api/v2/team/c75a4a8e-20c7-11ee-a3a5-da7ad0900002/links type: string type: object CustomDestinationsResponse: description: The available custom destinations. properties: data: description: A list of custom destinations. items: $ref: '#/components/schemas/CustomDestinationResponseDefinition' type: array type: object AWSResourcesConfig: description: AWS Resources Collection config. properties: cloud_security_posture_management_collection: description: Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations, identity risks, and compliance violations. Defaults to `false`. Requires `extended_collection` to be set to `true`. example: false type: boolean extended_collection: description: Whether Datadog collects additional attributes and configuration information about the resources in your AWS account. Defaults to `true`. Required for `cloud_security_posture_management_collection`. example: true type: boolean type: object AWSAccountResponseAttributes: description: AWS Account response attributes. properties: account_tags: $ref: '#/components/schemas/AWSAccountTags' auth_config: $ref: '#/components/schemas/AWSAuthConfig' aws_account_id: $ref: '#/components/schemas/AWSAccountID' aws_partition: $ref: '#/components/schemas/AWSAccountPartition' aws_regions: $ref: '#/components/schemas/AWSRegions' created_at: description: Timestamp of when the account integration was created. format: date-time readOnly: true type: string example: example_value logs_config: $ref: '#/components/schemas/AWSLogsConfig' metrics_config: $ref: '#/components/schemas/AWSMetricsConfig' modified_at: description: Timestamp of when the account integration was updated. format: date-time readOnly: true type: string example: example_value resources_config: $ref: '#/components/schemas/AWSResourcesConfig' traces_config: $ref: '#/components/schemas/AWSTracesConfig' required: - aws_account_id type: object DORAFetchResponse: description: Response for the DORA fetch endpoints. properties: data: $ref: '#/components/schemas/DORAEvent' type: object CompletionGate: description: Used to create conditions before running subsequent actions. properties: completionCondition: $ref: '#/components/schemas/CompletionCondition' retryStrategy: $ref: '#/components/schemas/RetryStrategy' required: - completionCondition - retryStrategy type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget: description: Applies the rule to all fields. enum: - all example: all type: string x-enum-varnames: - ALL HourlyUsageMeasurement: description: Usage amount for a given usage type. properties: usage_type: description: Type of usage. type: string example: metric alert value: description: Contains the number measured for the given usage_type during the hour. format: int64 nullable: true type: integer example: 42 type: object ApplicationSecurityWafCustomRuleType: default: custom_rule description: The type of the resource. The value should always be `custom_rule`. enum: - custom_rule example: custom_rule type: string x-enum-varnames: - CUSTOM_RULE LogsMetricResponseFilter: description: The log-based metric filter. Logs matching this filter will be aggregated in this metric. properties: query: description: The search query - following the log search syntax. example: service:web* AND @http.status_code:[200 TO 299] type: string type: object RestrictionQueryWithoutRelationships: description: Restriction query object returned by the API. properties: attributes: $ref: '#/components/schemas/RestrictionQueryAttributes' id: description: ID of the restriction query. example: 79a0e60a-644a-11ea-ad29-43329f7f58b5 type: string type: default: logs_restriction_queries description: Restriction queries type. example: logs_restriction_queries readOnly: true type: string type: object PowerpackTemplateVariable: description: Powerpack template variables. properties: available_values: description: The list of values that the template variable drop-down is limited to. example: - my-host - host1 - host2 items: description: Template variable value. type: string nullable: true type: array defaults: description: One or many template variable default values within the saved view, which are unioned together using `OR` if more than one is specified. items: description: One or many default values of the template variable. minLength: 1 type: string type: array name: description: The name of the variable. example: datacenter type: string prefix: description: The tag prefix associated with the variable. Only tags with this prefix appear in the variable drop-down. example: host nullable: true type: string required: - name type: object ObservabilityPipelineRsyslogSource: description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: rsyslog-source type: string mode: $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType' required: - id - type - mode type: object APITrigger: description: Trigger a workflow from an API request. The workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object IncidentAttachmentAttributes: description: The attributes object for an attachment. oneOf: - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes' - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes' DomainAllowlistResponseData: description: The email domain allowlist response for an org. properties: attributes: $ref: '#/components/schemas/DomainAllowlistResponseDataAttributes' id: description: The unique identifier of the org. nullable: true type: string example: abc-123-def type: $ref: '#/components/schemas/DomainAllowlistType' required: - type type: object AuthNMappingIncluded: description: Included data in the AuthN Mapping response. oneOf: - $ref: '#/components/schemas/SAMLAssertionAttribute' - $ref: '#/components/schemas/Role' - $ref: '#/components/schemas/AuthNMappingTeam' ActiveBillingDimensionsResponse: description: Active billing dimensions response. properties: data: $ref: '#/components/schemas/ActiveBillingDimensionsBody' type: object AwsOnDemandAttributes: description: Attributes for the AWS on demand task. properties: arn: description: The arn of the resource to scan. example: arn:aws:ec2:us-east-1:727000456123:instance/i-0eabb50529b67a1ba type: string assigned_at: description: Specifies the assignment timestamp if the task has been already assigned to a scanner. example: '2025-02-11T18:25:04.550564Z' type: string created_at: description: The task submission timestamp. example: '2025-02-11T18:13:24.576915Z' type: string status: description: 'Indicates the status of the task. QUEUED: the task has been submitted successfully and the resource has not been assigned to a scanner yet. ASSIGNED: the task has been assigned. ABORTED: the scan has been aborted after a period of time due to technical reasons, such as resource not found, insufficient permissions, or the absence of a configured scanner.' example: QUEUED type: string type: object DowntimeRelationshipsCreatedByData: description: Data for the user who created the downtime. nullable: true properties: id: description: User ID of the downtime creator. example: 00000000-0000-1234-0000-000000000000 type: string type: $ref: '#/components/schemas/UsersType' type: object RuleTypesItems: description: 'Security rule type which can be used in security rules. Signal-based notification rules can filter signals based on rule types application_security, log_detection, workload_security, signal_correlation, cloud_configuration and infrastructure_configuration. Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability, application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, and api_security.' enum: - application_security - log_detection - workload_security - signal_correlation - cloud_configuration - infrastructure_configuration - application_code_vulnerability - application_library_vulnerability - attack_path - container_image_vulnerability - identity_risk - misconfiguration - api_security type: string x-enum-varnames: - APPLICATION_SECURITY - LOG_DETECTION - WORKLOAD_SECURITY - SIGNAL_CORRELATION - CLOUD_CONFIGURATION - INFRASTRUCTURE_CONFIGURATION - APPLICATION_CODE_VULNERABILITY - APPLICATION_LIBRARY_VULNERABILITY - ATTACK_PATH - CONTAINER_IMAGE_VULNERABILITY - IDENTITY_RISK - MISCONFIGURATION - API_SECURITY AWSLogsServicesResponseData: description: AWS Logs Services response body properties: attributes: $ref: '#/components/schemas/AWSLogsServicesResponseAttributes' id: default: logs_services description: The `AWSLogsServicesResponseData` `id`. example: logs_services type: string type: $ref: '#/components/schemas/AWSLogsServicesResponseDataType' required: - id - type type: object ServiceDefinitionSchema: description: Service definition schema. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV1' - $ref: '#/components/schemas/ServiceDefinitionV2' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1' - $ref: '#/components/schemas/ServiceDefinitionV2Dot2' ActionQuerySpecInputs: description: The inputs to the action query. These are the values that are passed to the action when it is triggered. oneOf: - type: string - $ref: '#/components/schemas/ActionQuerySpecInput' MonitorNotificationRuleId: description: The ID of the monitor notification rule. example: 00000000-0000-1234-0000-000000000000 type: string IncidentTodoAnonymousAssigneeSource: default: slack description: The source of the anonymous assignee. enum: - slack - microsoft_teams example: slack type: string x-enum-varnames: - SLACK - MICROSOFT_TEAMS StepDisplayBounds: description: The definition of `StepDisplayBounds` object. properties: x: description: The `bounds` `x`. format: double type: number example: 95.5 y: description: The `bounds` `y`. format: double type: number example: 95.5 type: object MetricTagConfigurationType: default: manage_tags description: The metric tag configuration resource type. enum: - manage_tags example: manage_tags type: string x-enum-varnames: - MANAGE_TAGS ApiID: description: API identifier. example: 90646597-5fdb-4a17-a240-647003f8c028 format: uuid type: string ObservabilityPipelineEnrichmentTableFileKeyItemsComparison: description: Defines how to compare key fields for enrichment table lookups. enum: - equals example: equals type: string x-enum-varnames: - EQUALS SecurityMonitoringSignalRuleResponse: description: Rule. properties: cases: description: Cases for generating signals. items: $ref: '#/components/schemas/SecurityMonitoringRuleCase' type: array createdAt: description: When the rule was created, timestamp in milliseconds. format: int64 type: integer example: 42 creationAuthorId: description: User ID of the user who created the rule. format: int64 type: integer example: 42 deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 type: integer example: 42 filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. type: boolean example: true id: description: The ID of the rule. type: string example: abc-123-def isDefault: description: Whether the rule is included by default. type: boolean example: true isDeleted: description: Whether the rule has been deleted. type: boolean example: true isEnabled: description: Whether the rule is enabled. type: boolean example: true message: description: Message for generated signals. type: string example: CPU usage is high on {{host.name}} name: description: The name of the rule. type: string example: Example Monitor options: $ref: '#/components/schemas/SecurityMonitoringRuleOptions' queries: description: Queries for selecting logs which are part of the rule. items: $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery' type: array tags: description: Tags for generated signals. items: description: Tag. type: string type: array type: $ref: '#/components/schemas/SecurityMonitoringSignalRuleType' updateAuthorId: description: User ID of the user who updated the rule. format: int64 type: integer example: 42 version: description: The version of the rule. format: int64 type: integer example: 42 type: object FindingResourceType: description: The resource type of this finding. example: azure_storage_account type: string EntityV3APISpecInterfaceDefinition: additionalProperties: false description: The definition of `EntityV3APISpecInterfaceDefinition` object. properties: definition: description: The API definition. type: object type: object ObservabilityPipelineParseGrokProcessorRuleMatchRule: description: 'Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns. Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field. ' properties: name: description: The name of the rule. example: MyParsingRule type: string rule: description: The definition of the Grok rule. example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' type: string required: - name - rule type: object AWSLambdaForwarderConfig: description: 'Log Autosubscription configuration for Datadog Forwarder Lambda functions. Automatically set up triggers for existing and new logs for some services, ensuring no logs from new resources are missed and saving time spent on manual configuration.' properties: lambdas: description: List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to `[]`. items: example: arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder type: string type: array sources: description: 'List of service IDs set to enable automatic log collection. Discover the list of available services with the [Get list of AWS log ready services](https://docs.datadoghq.com/api/latest/aws-logs-integration/#get-list-of-aws-log-ready-services) endpoint.' items: example: s3 type: string type: array type: object ObservabilityPipelineParseJSONProcessor: description: The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string. properties: field: description: The name of the log field that contains a JSON string. example: message type: string id: description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: parse-json-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessorType' required: - id - type - include - field - inputs type: object IPAllowlistEntryType: default: ip_allowlist_entry description: IP allowlist Entry type. enum: - ip_allowlist_entry example: ip_allowlist_entry type: string x-enum-varnames: - IP_ALLOWLIST_ENTRY APIKeysType: default: api_keys description: API Keys resource type. enum: - api_keys example: api_keys type: string x-enum-varnames: - API_KEYS RelationshipToOrganization: description: Relationship to an organization. properties: data: $ref: '#/components/schemas/RelationshipToOrganizationData' required: - data type: object TeamOnCallRespondersDataRelationshipsResponders: description: Defines the list of users assigned as on-call responders for the team. properties: data: description: Array of user references associated as responders. items: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationshipsRespondersDataItems' type: array type: object IncidentAttachmentLinkAttachmentType: default: link description: The type of link attachment attributes. enum: - link example: link type: string x-enum-varnames: - LINK ComponentGridPropertiesIsVisible: description: Whether the grid component and its children are visible. If a string, it must be a valid JavaScript expression that evaluates to a boolean. oneOf: - type: string - default: true type: boolean IncidentTodoRelationships: description: The incident's relationships from a response. properties: created_by_user: $ref: '#/components/schemas/RelationshipToUser' last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' type: object ObservabilityPipelineReduceProcessorMergeStrategy: description: Defines how a specific field should be merged across grouped events. properties: path: description: The field path in the log event. example: log.user.roles type: string strategy: $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategyStrategy' required: - path - strategy type: object ServiceDefinitionV2Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: '#/components/schemas/ServiceDefinitionV2Opsgenie' pagerduty: $ref: '#/components/schemas/ServiceDefinitionV2Pagerduty' type: object DetailedFinding: description: A single finding with with message and resource configuration. properties: attributes: $ref: '#/components/schemas/DetailedFindingAttributes' id: $ref: '#/components/schemas/FindingID' type: $ref: '#/components/schemas/DetailedFindingType' type: object EntityResponseIncludedRawSchemaType: description: Raw schema type. enum: - rawSchema type: string x-enum-varnames: - RAW_SCHEMA ShiftDataRelationshipsUserData: description: Represents a reference to the user assigned to this shift, containing the user's ID and resource type. properties: id: description: Specifies the unique identifier of the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/ShiftDataRelationshipsUserDataType' required: - type - id type: object SendSlackMessageActionType: default: send_slack_message description: Indicates that the action is a send Slack message action. enum: - send_slack_message example: send_slack_message type: string x-enum-varnames: - SEND_SLACK_MESSAGE ObservabilityPipelineAmazonDataFirehoseSourceType: default: amazon_data_firehose description: The source type. The value should always be `amazon_data_firehose`. enum: - amazon_data_firehose example: amazon_data_firehose type: string x-enum-varnames: - AMAZON_DATA_FIREHOSE BillingDimensionsMappingBodyItem: description: The mapping data for each billing dimension. properties: attributes: $ref: '#/components/schemas/BillingDimensionsMappingBodyItemAttributes' id: description: ID of the billing dimension. type: string example: abc-123-def type: $ref: '#/components/schemas/ActiveBillingDimensionsType' type: object DORAListDeploymentsRequestData: description: The JSON:API data. properties: attributes: $ref: '#/components/schemas/DORAListDeploymentsRequestAttributes' type: $ref: '#/components/schemas/DORAListDeploymentsRequestDataType' required: - attributes type: object EntityResponseData: description: List of entity data. items: $ref: '#/components/schemas/EntityData' type: array SecurityMonitoringRuleKeepAlive: description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY ReadinessGateThresholdType: description: The definition of `ReadinessGateThresholdType` object. enum: - ANY - ALL example: ANY type: string x-enum-varnames: - ANY - ALL MetricType: default: metrics description: The metric resource type. enum: - metrics example: metrics type: string x-enum-varnames: - METRICS CaseResourceType: default: case description: Case resource type enum: - case example: case type: string x-enum-varnames: - CASE ObservabilityPipelineDedupeProcessorType: default: dedupe description: The processor type. The value should always be `dedupe`. enum: - dedupe example: dedupe type: string x-enum-varnames: - DEDUPE EntityResponseIncludedRawSchema: description: Included raw schema. properties: attributes: $ref: '#/components/schemas/EntityResponseIncludedRawSchemaAttributes' id: description: Raw schema ID. type: string example: abc-123-def type: $ref: '#/components/schemas/EntityResponseIncludedRawSchemaType' type: object ServiceDefinitionV2Dot2Pagerduty: description: PagerDuty integration for the service. properties: service-url: description: PagerDuty service url. example: https://my-org.pagerduty.com/service-directory/PMyService type: string type: object x-ignore-duplicate-object: true ObservabilityPipelineSentinelOneDestinationRegion: description: The SentinelOne region to send logs to. enum: - us - eu - ca - data_set_us example: us type: string x-enum-varnames: - US - EU - CA - DATA_SET_US UserTeamPermission: description: A user's permissions for a given team properties: attributes: $ref: '#/components/schemas/UserTeamPermissionAttributes' id: description: The user team permission's identifier example: UserTeamPermissions-aeadc05e-98a8-11ec-ac2c-da7ad0900001-416595 type: string type: $ref: '#/components/schemas/UserTeamPermissionType' required: - id - type type: object x-merge-override: required: false FindingResourceDiscoveryDate: description: The date on which the resource was discovered (Unix ms). example: 1678721573794 format: int64 minimum: 1 type: integer ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions: description: Controls how partial redaction is applied, including character count and direction. properties: characters: description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions` `characters`. example: 4 format: int64 type: integer direction: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection' required: - characters - direction type: object ObservabilityPipelineGeneratedMetricIncrementByField: description: Strategy that increments a generated metric based on the value of a log field. properties: field: description: Name of the log field containing the numeric value to increment the metric by. example: errors type: string strategy: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy' required: - strategy - field type: object FullAPIKeyAttributes: description: Attributes of a full API key. properties: category: description: The category of the API key. type: string example: example_value created_at: description: Creation date of the API key. example: '2020-11-23T10:00:00.000Z' format: date-time readOnly: true type: string key: description: The API key. readOnly: true type: string x-secret: true example: example_value last4: description: The last four characters of the API key. example: abcd maxLength: 4 minLength: 4 readOnly: true type: string x-secret: true modified_at: description: Date the API key was last modified. example: '2020-11-23T10:00:00.000Z' format: date-time readOnly: true type: string name: description: Name of the API key. example: API Key for submitting metrics type: string remote_config_read_enabled: description: The remote config read enabled status. type: boolean example: true type: object DashboardType: description: The type of the dashboard. enum: - custom_timeboard - custom_screenboard - integration_screenboard - integration_timeboard - host_timeboard example: host_timeboard type: string x-enum-varnames: - CUSTOM_TIMEBOARD - CUSTOM_SCREENBOARD - INTEGRATION_SCREENBOARD - INTEGRATION_TIMEBOARD - HOST_TIMEBOARD Weekday: description: A day of the week. enum: - monday - tuesday - wednesday - thursday - friday - saturday - sunday type: string x-enum-varnames: - MONDAY - TUESDAY - WEDNESDAY - THURSDAY - FRIDAY - SATURDAY - SUNDAY MetricsAndMetricTagConfigurations: description: Object for a metrics and metric tag configurations. oneOf: - $ref: '#/components/schemas/Metric' - $ref: '#/components/schemas/MetricTagConfiguration' DataTransformProperties: description: The properties of the data transformer. properties: outputs: description: A JavaScript function that returns the transformed data. example: "${(() => {return {\n allItems: [...fetchOrder1.outputs.items, ...fetchOrder2.outputs.items],\n}})()}" type: string type: object EscalationPolicyStepRelationships: description: Represents the relationship of an escalation policy step to its targets. properties: targets: $ref: '#/components/schemas/EscalationTargets' type: object IncidentFieldAttributesMultipleValue: description: A field with potentially multiple values selected. properties: type: $ref: '#/components/schemas/IncidentFieldAttributesValueType' value: description: The multiple values selected for this field. example: - '1.0' - '1.1' items: description: A value which has been selected for the parent field. example: '1.1' type: string nullable: true type: array type: object HistoricalJobResponse: description: Historical job response. properties: data: $ref: '#/components/schemas/HistoricalJobResponseData' type: object ObservabilityPipelineGeneratedMetricMetricType: description: Type of metric to create. enum: - count - gauge - distribution example: count type: string x-enum-varnames: - COUNT - GAUGE - DISTRIBUTION SpansAggregateResponseStatus: description: The status of the response. enum: - done - timeout example: done type: string x-enum-varnames: - DONE - TIMEOUT AwsScanOptionsData: description: Single AWS Scan Options entry. properties: attributes: $ref: '#/components/schemas/AwsScanOptionsAttributes' id: description: The ID of the AWS account. example: '184366314700' type: string type: $ref: '#/components/schemas/AwsScanOptionsType' type: object UsageAttributesObject: description: Usage attributes data. properties: org_name: description: The organization name. type: string example: Example Monitor product_family: description: The product for which usage is being reported. type: string example: example_value public_id: description: The organization public ID. type: string example: abc-123-def region: description: The region of the Datadog instance that the organization belongs to. type: string example: example_value timeseries: description: List of usage data reported for each requested hour. items: $ref: '#/components/schemas/UsageTimeSeriesObject' type: array usage_type: $ref: '#/components/schemas/HourlyUsageType' type: object CustomDestinationResponseForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttp' - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunk' - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearch' SecurityMonitoringRuleImpossibleTravelOptions: description: Options on impossible travel detection method. properties: baselineUserLocations: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations' type: object OktaAccountAttributes: description: Attributes object for an Okta account. properties: api_key: description: The API key of the Okta account. type: string writeOnly: true example: example_value auth_method: description: The authorization method for an Okta account. example: oauth type: string client_id: description: The Client ID of an Okta app integration. type: string example: abc-123-def client_secret: description: The client secret of an Okta app integration. type: string writeOnly: true example: example_value domain: description: The domain of the Okta account. example: https://example.okta.com/ type: string name: description: The name of the Okta account. example: Okta-Prod type: string required: - auth_method - domain - name type: object Case3rdPartyTicketStatus: default: IN_PROGRESS description: Case status enum: - IN_PROGRESS - COMPLETED - FAILED example: COMPLETED readOnly: true type: string x-enum-varnames: - IN_PROGRESS - COMPLETED - FAILED Urgency: description: Specifies the level of urgency for a routing rule (low, high, or dynamic). enum: - low - high - dynamic example: low type: string x-enum-varnames: - LOW - HIGH - DYNAMIC UserTeamTeamType: default: team description: User team team type enum: - team example: team type: string x-enum-varnames: - TEAM TeamAttributes: description: Team attributes properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: đŸ¥‘ nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer example: 42 created_at: description: Creation date of the team format: date-time type: string example: example_value description: description: Free-form markdown description/content for the team's homepage nullable: true type: string example: example_value handle: description: The team's identifier example: example-team maxLength: 195 type: string hidden_modules: description: Collection of hidden modules for the team items: description: String identifier of the module type: string type: array link_count: description: The number of links belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 modified_at: description: Modification date of the team format: date-time type: string example: example_value name: description: The name of the team example: Example Team maxLength: 200 type: string summary: description: A brief summary of the team, derived from the `description` maxLength: 120 nullable: true type: string example: example_value user_count: description: The number of users belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 visible_modules: description: Collection of visible modules for the team items: description: String identifier of the module type: string type: array required: - handle - name type: object Role: description: Role object returned by the API. properties: attributes: $ref: '#/components/schemas/RoleAttributes' id: description: The unique identifier of the role. type: string example: abc-123-def relationships: $ref: '#/components/schemas/RoleResponseRelationships' type: $ref: '#/components/schemas/RolesType' required: - type type: object x-merge-override: required: false CloudConfigurationComplianceRuleOptions: additionalProperties: {} description: 'Options for cloud_configuration rules. Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules. ' properties: complexRule: description: 'Whether the rule is a complex one. Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false. ' type: boolean example: true regoRule: $ref: '#/components/schemas/CloudConfigurationRegoRule' resourceType: description: 'Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`. ' example: aws_acm type: string type: object CustomDestinationResponseElasticsearchDestinationAuth: additionalProperties: description: Basic access authentication. description: Basic access authentication. type: object EntityResponseIncludedRelatedEntityMeta: description: Included related entity meta. properties: createdAt: description: Entity creation time. format: date-time type: string example: example_value defined_by: description: Entity relation defined by. type: string example: example_value modifiedAt: description: Entity modification time. format: date-time type: string example: example_value source: description: Entity relation source. type: string example: example_value type: object AuthNMappingsType: default: authn_mappings description: AuthN Mappings resource type. enum: - authn_mappings example: authn_mappings type: string x-enum-varnames: - AUTHN_MAPPINGS ListDowntimesResponse: description: Response for retrieving all downtimes. properties: data: description: An array of downtimes. items: $ref: '#/components/schemas/DowntimeResponseData' type: array included: description: Array of objects related to the downtimes. items: $ref: '#/components/schemas/DowntimeResponseIncludedItem' type: array meta: $ref: '#/components/schemas/DowntimeMeta' type: object AWSLogsServicesResponseAttributes: description: AWS Logs Services response body properties: logs_services: description: List of AWS services that can send logs to Datadog example: - s3 items: example: s3 type: string type: array required: - logs_services type: object AuditLogsResponseLinks: description: Links attributes. properties: next: description: 'Link for the next set of results. Note that the request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/audit/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object ServiceDefinitionV2Dot1Pagerduty: description: PagerDuty integration for the service. properties: service-url: description: PagerDuty service url. example: https://my-org.pagerduty.com/service-directory/PMyService type: string type: object x-ignore-duplicate-object: true OutboundEdge: description: The definition of `OutboundEdge` object. properties: branchName: description: The `OutboundEdge` `branchName`. example: '' type: string nextStepName: description: The `OutboundEdge` `nextStepName`. example: '' type: string required: - nextStepName - branchName type: object IncidentServiceIncludedItems: description: An object related to an incident service which is present in the included payload. oneOf: - $ref: '#/components/schemas/User' DORAListFailuresRequestDataType: description: The definition of `DORAListFailuresRequestDataType` object. enum: - dora_failures_list_request type: string x-enum-varnames: - DORA_FAILURES_LIST_REQUEST MonitorNotificationRuleRecipients: description: A list of recipients to notify. Uses the same format as the monitor `message` field. Must not start with an '@'. example: - slack-test-channel - jira-test items: description: individual recipient. maxLength: 255 type: string maxItems: 20 minItems: 1 type: array uniqueItems: true ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions: description: Options for defining a custom regex pattern. properties: rule: description: A regular expression used to detect sensitive values. Must be a valid regex. example: \b\d{16}\b type: string required: - rule type: object CloudflareAccountType: default: cloudflare-accounts description: The JSON:API type for this API. Should always be `cloudflare-accounts`. enum: - cloudflare-accounts example: cloudflare-accounts type: string x-enum-varnames: - CLOUDFLARE_ACCOUNTS ObservabilityPipelineAwsAuth: description: 'AWS authentication credentials used for accessing AWS services such as S3. If omitted, the system’s default credentials are used (for example, the IAM role and environment variables). ' properties: assume_role: description: The Amazon Resource Name (ARN) of the role to assume. type: string example: example_value external_id: description: A unique identifier for cross-account role assumption. type: string example: abc-123-def session_name: description: A session identifier used for logging and tracing the assumed role session. type: string example: Example Monitor type: object ObservabilityPipelineConfigProcessorItem: description: A processor for the pipeline. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineFilterProcessor' - $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessor' - $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessor' - $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineSampleProcessor' - $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessor' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessor' - $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessor' - $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessor' - $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor' - $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor' - $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor' SingleAggregatedConnectionResponseArray: description: List of aggregated connections. example: data: - attributes: bytes_sent_by_client: 100 bytes_sent_by_server: 200 group_bys: client_team: - networks server_service: - hucklebuck packets_sent_by_client: 10 packets_sent_by_server: 20 rtt_micro_seconds: 800 tcp_closed_connections: 30 tcp_established_connections: 40 tcp_refusals: 7 tcp_resets: 5 tcp_retransmits: 30 tcp_timeouts: 6 id: client_team:networks, server_service:hucklebuck type: aggregated_connection properties: data: description: Array of aggregated connection objects. items: $ref: '#/components/schemas/SingleAggregatedConnectionResponseData' type: array type: object CustomDestinationResponseDefinition: description: The definition of a custom destination. properties: attributes: $ref: '#/components/schemas/CustomDestinationResponseAttributes' id: description: The custom destination ID. example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 readOnly: true type: string type: $ref: '#/components/schemas/CustomDestinationType' type: object ServiceDefinitionV2LinkType: description: Link type. enum: - doc - wiki - runbook - url - repo - dashboard - oncall - code - link example: runbook type: string x-enum-varnames: - DOC - WIKI - RUNBOOK - URL - REPO - DASHBOARD - ONCALL - CODE - LINK ObservabilityPipelineReduceProcessor: description: The `reduce` processor aggregates and merges logs based on matching keys and merge strategies. properties: group_by: description: A list of fields used to group log events for merging. example: - log.user.id - log.device.id items: type: string type: array id: description: The unique identifier for this processor. example: reduce-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: env:prod type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - parse-json-processor items: type: string type: array merge_strategies: description: List of merge strategies defining how values from grouped events should be combined. items: $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategy' type: array type: $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorType' required: - id - type - include - inputs - group_by - merge_strategies type: object RumMetricResponseFilter: description: The rum-based metric filter. RUM events matching this filter will be aggregated in this metric. properties: query: description: The search query - following the RUM search syntax. example: service:web* AND @http.status_code:[200 TO 299] type: string type: object RestrictionQueryRelationships: description: Relationships of the restriction query object. properties: roles: $ref: '#/components/schemas/RelationshipToRoles' type: object RoutingRuleType: default: team_routing_rules description: Team routing rules resource type. enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES CsmCoverageAnalysis: description: CSM Coverage Analysis. properties: configured_resources_count: description: The number of fully configured resources. example: 8 format: int64 type: integer coverage: description: The coverage percentage. example: 0.8 format: double type: number partially_configured_resources_count: description: The number of partially configured resources. example: 0 format: int64 type: integer total_resources_count: description: The total number of resources. example: 10 format: int64 type: integer type: object IncidentAttachmentsResponseIncludedItem: description: An object related to an attachment that is included in the response. oneOf: - $ref: '#/components/schemas/User' UserTeamsResponse: description: Team memberships response properties: data: description: Team memberships response data items: $ref: '#/components/schemas/UserTeam' type: array included: description: Resources related to the team memberships items: $ref: '#/components/schemas/UserTeamIncluded' type: array links: $ref: '#/components/schemas/TeamsResponseLinks' meta: $ref: '#/components/schemas/TeamsResponseMeta' type: object CustomConnectionType: default: custom_connections description: The custom connection type. enum: - custom_connections example: custom_connections type: string x-enum-varnames: - CUSTOM_CONNECTIONS SecurityMonitoringFilter: description: The rule's suppression filter. properties: action: $ref: '#/components/schemas/SecurityMonitoringFilterAction' query: description: Query for selecting logs to apply the filtering action. type: string example: avg:system.cpu.user{*} type: object ConfluentAccountResponse: description: The expected response schema when getting a Confluent account. properties: data: $ref: '#/components/schemas/ConfluentAccountResponseData' type: object AuthNMappingAttributes: description: Attributes of AuthN Mapping. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string created_at: description: Creation time of the AuthN Mapping. format: date-time readOnly: true type: string example: example_value modified_at: description: Time of last AuthN Mapping modification. format: date-time readOnly: true type: string example: example_value saml_assertion_attribute_id: description: The ID of the SAML assertion attribute. example: '0' type: string type: object FindingRule: additionalProperties: false description: The rule that triggered this finding. properties: id: description: The ID of the rule that triggered this finding. example: dv2-jzf-41i type: string name: description: The name of the rule that triggered this finding. example: Soft delete is enabled for Azure Storage type: string type: object LogsArchiveDestinationGCSType: default: gcs description: Type of the GCS archive destination. enum: - gcs example: gcs type: string x-enum-varnames: - GCS JiraIssueResult: description: Jira issue information properties: issue_id: description: Jira issue ID type: string example: abc-123-def issue_key: description: Jira issue key type: string example: example_value issue_url: description: Jira issue URL type: string example: https://app.datadoghq.com project_key: description: Jira project key type: string example: example_value type: object ContainerGroupRelationships: description: Relationships to containers inside a container group. properties: containers: $ref: '#/components/schemas/ContainerGroupRelationshipsLink' type: object ContainerImageGroupAttributes: description: Attributes for a Container Image Group. properties: count: description: Number of Container Images in the group. format: int64 type: integer example: 42 name: description: Name of the Container Image group. type: string example: Example Monitor tags: description: Tags from the group name parsed in key/value format. type: object type: object IncidentTypeListResponse: description: Response with a list of incident types. properties: data: description: An array of incident type objects. items: $ref: '#/components/schemas/IncidentTypeObject' type: array required: - data type: object TeamLinkAttributes: description: Team link attributes properties: label: description: The link's label example: Link label maxLength: 256 type: string position: description: The link's position, used to sort links for the team format: int32 maximum: 2147483647 type: integer example: 42 team_id: description: ID of the team the link is associated with readOnly: true type: string example: abc-123-def url: description: The URL for the link example: https://example.com type: string required: - label - url type: object ActionQuery: description: An action query. This query type is used to trigger an action, such as sending a HTTP request. properties: events: description: Events to listen for downstream of the action query. items: $ref: '#/components/schemas/AppBuilderEvent' type: array id: description: The ID of the action query. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this action query. This name is also used to access the query's result throughout the app. example: fetchPendingOrders type: string properties: $ref: '#/components/schemas/ActionQueryProperties' type: $ref: '#/components/schemas/ActionQueryType' required: - id - name - type - properties type: object CSMAgentsType: default: datadog_agent description: The type of the resource. The value should always be `datadog_agent`. enum: - datadog_agent example: datadog_agent type: string x-enum-varnames: - DATADOG_AGENT PermissionAttributes: description: Attributes of a permission. properties: created: description: Creation time of the permission. format: date-time type: string example: example_value description: description: Description of the permission. type: string example: example_value display_name: description: Displayed name for the permission. type: string example: Example Monitor display_type: description: Display type. type: string example: metric alert group_name: description: Name of the permission group. type: string example: Example Monitor name: description: Name of the permission. type: string example: Example Monitor restricted: description: Whether or not the permission is restricted. type: boolean example: true type: object SBOMMetadata: description: Provides additional information about a BOM. properties: component: $ref: '#/components/schemas/SBOMMetadataComponent' type: object NotificationRule: description: 'Notification rules allow full control over notifications generated by the various Datadog security products. They allow users to define the conditions under which a notification should be generated (based on rule severities, rule types, rule tags, and so on), and the targets to notify. A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required. ' properties: attributes: $ref: '#/components/schemas/NotificationRuleAttributes' id: $ref: '#/components/schemas/ID' type: $ref: '#/components/schemas/NotificationRulesType' required: - attributes - id - type type: object ActionQueryPollingIntervalInMs: description: If specified, the app will poll the query at the specified interval in milliseconds. The minimum polling interval is 15 seconds. The query will only poll when the app's browser tab is active. oneOf: - example: 30000 format: double minimum: 15000 type: number - description: If this is a string, it must be a valid JavaScript expression that evaluates to a number. example: ${15000} type: string LogsMetricResponse: description: The log-based metric object. properties: data: $ref: '#/components/schemas/LogsMetricResponseData' type: object ApplicationSecurityWafExclusionFilterResponse: description: Response object for a single WAF exclusion filter. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResource' type: object SlackIntegrationMetadata: description: Incident integration metadata for the Slack integration. properties: channels: description: Array of Slack channels in this integration metadata. example: [] items: $ref: '#/components/schemas/SlackIntegrationMetadataChannelItem' type: array required: - channels type: object IncidentTodoResponseData: description: Incident todo response data. properties: attributes: $ref: '#/components/schemas/IncidentTodoAttributes' id: description: The incident todo's ID. example: 00000000-0000-0000-1234-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentTodoRelationships' type: $ref: '#/components/schemas/IncidentTodoType' required: - id - type type: object RelationshipToIncidentIntegrationMetadataData: description: A relationship reference for an integration metadata object. example: id: 00000000-abcd-0002-0000-000000000000 type: incident_integrations properties: id: description: A unique identifier that represents the integration metadata. example: 00000000-abcd-0001-0000-000000000000 type: string type: $ref: '#/components/schemas/IncidentIntegrationMetadataType' required: - id - type type: object x-merge-override: required: false CloudWorkloadSecurityAgentRuleData: description: Object for a single Agent rule properties: attributes: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAttributes' id: description: The ID of the Agent rule example: 3dd-0uc-h1s type: string type: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType' type: object AWSAccountResponseData: description: AWS Account response data. properties: attributes: $ref: '#/components/schemas/AWSAccountResponseAttributes' id: $ref: '#/components/schemas/AWSAccountConfigID' type: $ref: '#/components/schemas/AWSAccountType' required: - id - type type: object MicrosoftTeamsTenantBasedHandleInfoResponseData: description: Tenant-based handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleInfoResponseAttributes' id: description: The ID of the tenant-based handle. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleInfoType' type: object x-merge-override: required: false EscalationRelationshipsRespondersDataItemsType: default: users description: Represents the resource type for users assigned as responders in an escalation step. enum: - users example: users type: string x-enum-varnames: - USERS RelationshipToTeam: description: Relationship to team. properties: data: $ref: '#/components/schemas/RelationshipToTeamData' type: object x-merge-override: required: false MonitorNotificationRuleRelationshipsCreatedBy: description: The user who created the monitor notification rule. properties: data: $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedByData' type: object LayerRelationshipsMembers: description: Holds an array of references to the members of a Layer, each containing member IDs. properties: data: description: The list of members who belong to this layer. items: $ref: '#/components/schemas/LayerRelationshipsMembersDataItems' type: array type: object ProjectAttributes: description: Project attributes properties: key: description: The project's key example: CASEM type: string name: description: Project's name type: string example: Example Monitor type: object JSONAPIErrorItemSource: description: References to the source of the error. properties: header: description: A string indicating the name of a single request header which caused the error. example: Authorization type: string parameter: description: A string indicating which URI query parameter caused the error. example: limit type: string pointer: description: A JSON pointer to the value in the request document that caused the error. example: /data/attributes/title type: string type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude: description: Includes only specific fields for sensitive data scanning. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions' target: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget' required: - target - options type: object EntityV3Datastore: additionalProperties: false description: Schema for datastore entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3DatastoreDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3DatastoreKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3DatastoreSpec' required: - apiVersion - kind - metadata type: object IncidentServiceType: default: services description: Incident service resource type. enum: - services example: services type: string x-enum-varnames: - SERVICES TeamRoutingRulesDataRelationshipsRulesDataItemsType: default: team_routing_rules description: Indicates that the resource is of type 'team_routing_rules'. enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES SLOReportStatusGetResponse: description: The SLO report status response. properties: data: $ref: '#/components/schemas/SLOReportStatusGetResponseData' type: object Creator: description: Creator of the object. properties: email: description: Email of the creator. type: string example: user@example.com handle: description: Handle of the creator. type: string example: example_value name: description: Name of the creator. nullable: true type: string example: Example Monitor type: object EntityResponseMeta: description: Entity metadata. properties: count: description: Total entities count. format: int64 type: integer example: 42 includeCount: description: Total included data count. format: int64 type: integer example: 42 type: object MonitorConfigPolicyAttributeResponse: description: Policy and policy type for a monitor configuration policy. properties: policy: $ref: '#/components/schemas/MonitorConfigPolicyPolicy' policy_type: $ref: '#/components/schemas/MonitorConfigPolicyType' type: object AuditLogsEventsResponse: description: Response object with all events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: '#/components/schemas/AuditLogsEvent' type: array links: $ref: '#/components/schemas/AuditLogsResponseLinks' meta: $ref: '#/components/schemas/AuditLogsResponseMetadata' type: object SecurityTrigger: description: Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object WorklflowGetInstanceResponseDataAttributes: additionalProperties: {} description: The attributes of the instance response data. properties: id: description: The id of the instance. type: string example: abc-123-def type: object TeamOnCallRespondersDataRelationshipsEscalationsDataItems: description: Represents a link to a specific escalation policy step associated with the on-call team. properties: id: description: Unique identifier of the escalation step. example: '' type: string type: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationshipsEscalationsDataItemsType' required: - type - id type: object ServiceDefinitionV2Dot1EmailType: description: Contact type. enum: - email example: email type: string x-enum-varnames: - EMAIL TeamPermissionSettingType: default: team_permission_settings description: Team permission setting type enum: - team_permission_settings example: team_permission_settings type: string x-enum-varnames: - TEAM_PERMISSION_SETTINGS SecurityMonitoringSignalsSort: description: The sort parameters used for querying security signals. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING IncidentTodoResponse: description: Response with an incident todo. properties: data: $ref: '#/components/schemas/IncidentTodoResponseData' included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentTodoResponseIncludedItem' readOnly: true type: array required: - data type: object ListEntityCatalogResponseIncluded: description: List entity response included. items: $ref: '#/components/schemas/ListEntityCatalogResponseIncludedItem' type: array ObservabilityPipelineEnrichmentTableFileSchemaItems: description: Describes a single column and its type in an enrichment table schema. properties: column: description: The `items` `column`. example: region type: string type: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItemsType' required: - column - type type: object ObservabilityPipelineNewRelicDestinationType: default: new_relic description: The destination type. The value should always be `new_relic`. enum: - new_relic example: new_relic type: string x-enum-varnames: - NEW_RELIC HTTPCredentials: description: The definition of `HTTPCredentials` object. oneOf: - $ref: '#/components/schemas/HTTPTokenAuth' RoutingRuleRelationshipsPolicyData: description: Represents the policy data reference, containing the policy's ID and resource type. properties: id: description: Specifies the unique identifier of the policy. example: '' type: string type: $ref: '#/components/schemas/RoutingRuleRelationshipsPolicyDataType' required: - type - id type: object ConnectionEnv: description: A list of connections or connection groups used in the workflow. properties: connectionGroups: description: The `ConnectionEnv` `connectionGroups`. items: $ref: '#/components/schemas/ConnectionGroup' type: array connections: description: The `ConnectionEnv` `connections`. items: $ref: '#/components/schemas/Connection' type: array env: $ref: '#/components/schemas/ConnectionEnvEnv' required: - env type: object ContainerMetaPage: description: Paging attributes. properties: cursor: description: The cursor used to get the current results, if any. type: string example: example_value limit: description: Number of results returned format: int32 maximum: 10000 minimum: 0 type: integer example: 42 next_cursor: description: The cursor used to get the next results, if any. type: string example: example_value prev_cursor: description: The cursor used to get the previous results, if any. nullable: true type: string example: example_value total: description: Total number of records that match the query. format: int64 type: integer example: 42 type: $ref: '#/components/schemas/ContainerMetaPageType' type: object RumMetricResponseCompute: description: The compute rule to compute the rum-based metric. properties: aggregation_type: $ref: '#/components/schemas/RumMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/RumMetricComputeIncludePercentiles' path: description: 'The path to the value the rum-based metric will aggregate on. Only present when `aggregation_type` is `distribution`.' example: '@duration' type: string type: object RestrictionPolicy: description: Restriction policy object. properties: attributes: $ref: '#/components/schemas/RestrictionPolicyAttributes' id: description: The identifier, always equivalent to the value specified in the `resource_id` path parameter. example: dashboard:abc-def-ghi type: string type: $ref: '#/components/schemas/RestrictionPolicyType' required: - type - id - attributes type: object SBOM: description: A single SBOM properties: attributes: $ref: '#/components/schemas/SBOMAttributes' id: description: The unique ID for this SBOM (it is equivalent to the `asset_name` or `asset_name@repo_digest` (Image) example: github.com/datadog/datadog-agent type: string type: $ref: '#/components/schemas/SBOMType' type: object DeviceAttributes: description: The device attributes properties: description: description: The device description example: a device monitored with NDM type: string device_type: description: The device type example: other type: string integration: description: The device integration example: snmp type: string interface_statuses: $ref: '#/components/schemas/DeviceAttributesInterfaceStatuses' ip_address: description: The device IP address example: 1.2.3.4 type: string location: description: The device location example: paris type: string model: description: The device model example: xx-123 type: string name: description: The device name example: example device type: string os_hostname: description: The device OS hostname type: string example: Example Monitor os_name: description: The device OS name example: example OS type: string os_version: description: The device OS version example: 1.0.2 type: string ping_status: description: The device ping status example: unmonitored type: string product_name: description: The device product name example: example device type: string serial_number: description: The device serial number example: X12345 type: string status: description: The device SNMP status example: ok type: string subnet: description: The device subnet example: 1.2.3.4/24 type: string sys_object_id: description: The device `sys_object_id` example: 1.3.6.1.4.1.99999 type: string tags: description: The list of device tags example: - device_ip:1.2.3.4 - device_id:example:1.2.3.4 items: type: string type: array vendor: description: The device vendor example: example vendor type: string version: description: The device version example: 1.2.3 type: string type: object EscalationRelationshipsResponders: description: Lists the users involved in a specific step of the escalation policy. properties: data: description: Array of user references assigned as responders for this escalation step. items: $ref: '#/components/schemas/EscalationRelationshipsRespondersDataItems' type: array type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction: description: Action type that redacts part of the sensitive data while preserving a configurable number of characters, typically used for masking purposes (e.g., show last 4 digits of a credit card). enum: - partial_redact example: partial_redact type: string x-enum-varnames: - PARTIAL_REDACT ExternalUserMeta: description: Metadata associated with a user. properties: created: description: The date and time the user was created. example: '2024-10-17T12:53:35.793Z' format: date-time type: string lastModified: description: The date and time the user was last changed. example: '2024-10-19T12:53:35.793Z' format: date-time type: string location: description: URL identifying the resource. example: https://app.datadoghq.com/api/scim/v2/Users/13a95654-b76d-478d-8636-157a7e461d7c type: string resourceType: description: Type of resource. example: User type: string type: object ExternalUserGroup: description: Definition of a group. properties: displayName: description: A human-readable name for the group. type: string example: Example Monitor externalId: description: An identifier for the resource as defined by the provisioning client. type: string example: abc-123-def id: description: The identifier of the resource. Not required when creating a group. type: string example: abc-123-def members: description: Members of the group. items: $ref: '#/components/schemas/ExternalUserGroupMembersItems' type: array meta: $ref: '#/components/schemas/ExternalUserGroupMeta' schemas: description: Input JSON Schemas. example: - urn:ietf:params:scim:schemas:core:2.0:Group items: type: string type: array type: object CustomDestinationResponseForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP ConfluentResourceResponseData: description: Confluent Cloud resource data. properties: attributes: $ref: '#/components/schemas/ConfluentResourceResponseAttributes' id: description: The ID associated with the Confluent resource. example: resource_id_abc123 type: string type: $ref: '#/components/schemas/ConfluentResourceType' required: - attributes - type - id type: object x-merge-override: required: false OktaAccountResponse: description: Response object for an Okta account. properties: data: $ref: '#/components/schemas/OktaAccount' type: object LogsMetricResponseComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION EntityToSchema: description: Entity to detail schema relationship. properties: data: $ref: '#/components/schemas/RelationshipItem' type: object SecurityMonitoringSignalRuleType: description: The rule type. enum: - signal_correlation type: string x-enum-varnames: - SIGNAL_CORRELATION AwsOnDemandData: description: Single AWS on demand task. properties: attributes: $ref: '#/components/schemas/AwsOnDemandAttributes' id: description: The UUID of the task. example: 6d09294c-9ad9-42fd-a759-a0c1599b4828 type: string type: $ref: '#/components/schemas/AwsOnDemandType' type: object EventType: default: event description: Type of the event. enum: - event example: event type: string x-enum-varnames: - EVENT PartialApplicationKey: description: Partial Datadog application key. properties: attributes: $ref: '#/components/schemas/PartialApplicationKeyAttributes' id: description: ID of the application key. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ApplicationKeyRelationships' type: $ref: '#/components/schemas/ApplicationKeysType' type: object x-merge-override: required: false MicrosoftTeamsGetChannelByNameResponse: description: Response with channel, team, and tenant ID information. properties: data: $ref: '#/components/schemas/MicrosoftTeamsChannelInfoResponseData' type: object IncidentTodoAnonymousAssignee: description: Anonymous assignee entity. properties: icon: description: URL for assignee's icon. example: https://a.slack-edge.com/80588/img/slackbot_48.png type: string id: description: Anonymous assignee's ID. example: USLACKBOT type: string name: description: Assignee's name. example: Slackbot type: string source: $ref: '#/components/schemas/IncidentTodoAnonymousAssigneeSource' required: - id - icon - name - source type: object SBOMComponent: description: Software or hardware component. properties: bom-ref: description: An optional identifier that can be used to reference the component elsewhere in the BOM. example: pkg:golang/google.golang.org/grpc@1.68.1 type: string name: description: The name of the component. This will often be a shortened, single name of the component. example: google.golang.org/grpc type: string purl: description: Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the [specification](https://github.com/package-url/purl-spec). example: pkg:golang/google.golang.org/grpc@1.68.1 type: string type: $ref: '#/components/schemas/SBOMComponentType' version: description: The component version. example: 1.68.1 type: string required: - type - name - version type: object EntityResponseIncludedRelatedOncallEscalationItem: description: Oncall escalation. properties: email: description: Oncall email. type: string example: user@example.com escalationLevel: description: Oncall level. format: int64 type: integer example: 42 name: description: Oncall name. type: string example: Example Monitor type: object GetInterfacesResponse: description: The `GetInterfaces` operation's response. properties: data: description: Get Interfaces response items: $ref: '#/components/schemas/GetInterfacesData' type: array type: object GetActionConnectionResponse: description: The response for found connection properties: data: $ref: '#/components/schemas/ActionConnectionData' type: object UserResourceType: default: user description: User resource type. enum: - user example: user type: string x-enum-varnames: - USER CustomDestinationType: default: custom_destination description: The type of the resource. The value should always be `custom_destination`. enum: - custom_destination example: custom_destination type: string x-enum-varnames: - CUSTOM_DESTINATION EntityResponseIncludedOncallType: description: Oncall type. enum: - oncall type: string x-enum-varnames: - ONCALL PowerpackInnerWidgetLayout: description: Powerpack inner widget layout. properties: height: description: The height of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer width: description: The width of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer x: description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer y: description: The position of the widget on the y (vertical) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer required: - x - y - width - height type: object IncidentAttachmentData: description: A single incident attachment. example: attributes: attachment: documentUrl: '' title: Postmortem IR-123 attachment_type: postmortem id: 00000000-abcd-0002-0000-000000000000 relationships: last_modified_by_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users type: incident_attachments properties: attributes: $ref: '#/components/schemas/IncidentAttachmentAttributes' id: description: A unique identifier that represents the incident attachment. example: 00000000-abcd-0001-0000-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentAttachmentRelationships' type: $ref: '#/components/schemas/IncidentAttachmentType' required: - type - attributes - id - relationships type: object EntityV3APISpec: additionalProperties: false description: The definition of Entity V3 API Spec object. properties: implementedBy: description: Services which implemented the API. items: type: string type: array interface: $ref: '#/components/schemas/EntityV3APISpecInterface' lifecycle: description: The lifecycle state of the component. minLength: 1 type: string example: example_value tier: description: The importance of the component. minLength: 1 type: string example: example_value type: description: The type of API. type: string example: metric alert type: object CaseType: description: Case type enum: - STANDARD example: STANDARD type: string x-enum-varnames: - STANDARD RetryStrategy: description: The definition of `RetryStrategy` object. properties: kind: $ref: '#/components/schemas/RetryStrategyKind' linear: $ref: '#/components/schemas/RetryStrategyLinear' required: - kind type: object HourlyUsageMetadata: description: The object containing document metadata. properties: pagination: $ref: '#/components/schemas/HourlyUsagePagination' type: object RetryStrategyKind: description: The definition of `RetryStrategyKind` object. enum: - RETRY_STRATEGY_LINEAR example: RETRY_STRATEGY_LINEAR type: string x-enum-varnames: - RETRY_STRATEGY_LINEAR TeamRoutingRulesDataRelationshipsRules: description: Holds references to a set of routing rules in a relationship. properties: data: description: An array of references to the routing rules associated with this team. items: $ref: '#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItems' type: array type: object UserInvitationDataAttributes: description: Attributes of a user invitation. properties: created_at: description: Creation time of the user invitation. format: date-time type: string example: example_value expires_at: description: Time of invitation expiration. format: date-time type: string example: example_value invite_type: description: Type of invitation. type: string example: metric alert uuid: description: UUID of the user invitation. type: string example: abc-123-def type: object MonitorNotificationRuleRelationshipsCreatedByData: description: Data for the user who created the monitor notification rule. nullable: true properties: id: description: User ID of the monitor notification rule creator. example: 00000000-0000-1234-0000-000000000000 type: string type: $ref: '#/components/schemas/UsersType' type: object SecurityFilterResponse: description: Response object which includes a single security filter. properties: data: $ref: '#/components/schemas/SecurityFilter' meta: $ref: '#/components/schemas/SecurityFilterMeta' type: object AWSAccountTags: description: Tags to apply to all hosts and metrics reporting for this account. Defaults to `[]`. items: description: Tag in the form `key:value`. example: env:prod type: string nullable: true type: array CsmCloudAccountsCoverageAnalysisAttributes: description: CSM Cloud Accounts Coverage Analysis attributes. properties: aws_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' azure_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' gcp_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' org_id: description: The ID of your organization. example: 123456 format: int64 type: integer total_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' type: object ObservabilityPipelineGoogleCloudStorageDestination: description: 'The `google_cloud_storage` destination stores logs in a Google Cloud Storage (GCS) bucket. It requires a bucket name, GCP authentication, and metadata fields. ' properties: acl: $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationAcl' auth: $ref: '#/components/schemas/ObservabilityPipelineGcpAuth' bucket: description: Name of the GCS bucket. example: error-logs type: string id: description: Unique identifier for the destination component. example: gcs-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array key_prefix: description: Optional prefix for object keys within the GCS bucket. type: string example: example_value metadata: description: Custom metadata to attach to each object uploaded to the GCS bucket. items: $ref: '#/components/schemas/ObservabilityPipelineMetadataEntry' type: array storage_class: $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationStorageClass' type: $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationType' required: - id - type - inputs - bucket - auth - storage_class - acl type: object ListEntityCatalogResponseLinks: description: List entity response links. properties: next: description: Next link. type: string example: example_value previous: description: Previous link. type: string example: example_value self: description: Current link. type: string example: example_value type: object ServiceDefinitionV1Integrations: description: Third party integrations that Datadog supports. properties: pagerduty: $ref: '#/components/schemas/ServiceDefinitionV1Pagerduty' type: object CustomCostsFileMetadataWithContentHighLevel: description: JSON API format of for a Custom Costs file with content. properties: attributes: $ref: '#/components/schemas/CustomCostsFileMetadataWithContent' id: description: ID of the Custom Costs metadata. type: string example: abc-123-def type: description: Type of the Custom Costs file metadata. type: string example: metric alert type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern: description: Defines a custom regex-based pattern for identifying sensitive data in logs. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions' type: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType' required: - type - options type: object CloudWorkloadSecurityAgentRuleKill: description: Kill system call applied on the container matching the rule properties: signal: description: Supported signals for the kill system call type: string example: example_value type: object ServiceDefinitionSchemaVersions: description: Schema versions enum: - v1 - v2 - v2.1 - v2.2 type: string x-enum-varnames: - V1 - V2 - V2_1 - V2_2 RuleVersionUpdateType: description: The type of change. enum: - create - update - delete type: string x-enum-varnames: - CREATE - UPDATE - DELETE UserAttributes: description: Attributes of user object returned by the API. properties: created_at: description: Creation time of the user. format: date-time type: string example: example_value disabled: description: Whether the user is disabled. type: boolean example: true email: description: Email of the user. type: string example: user@example.com handle: description: Handle of the user. type: string example: example_value icon: description: URL of the user's icon. type: string example: example_value mfa_enabled: description: If user has MFA enabled. readOnly: true type: boolean example: true modified_at: description: Time that the user was last modified. format: date-time type: string example: example_value name: description: Name of the user. nullable: true type: string example: Example Monitor service_account: description: Whether the user is a service account. type: boolean example: true status: description: Status of the user. type: string example: OK title: description: Title of the user. nullable: true type: string example: Example Monitor verified: description: Whether the user is verified. type: boolean example: true type: object ApplicationSecurityWafCustomRuleConditionParameters: description: The scope of the WAF custom rule. properties: data: description: Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter. example: blocked_users type: string inputs: description: List of inputs on which at least one should match with the given operator. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput' type: array list: description: 'List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and !exact_match operator.' items: type: string type: array options: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions' regex: description: Regex to use with the condition. Only used with match_regex and !match_regex operator. example: path.* type: string value: description: Store the captured value in the specified tag name. Only used with the capture_data operator. example: custom_tag type: string required: - inputs type: object IncidentType: default: incidents description: Incident resource type. enum: - incidents example: incidents type: string x-enum-varnames: - INCIDENTS Component: description: '[Definition of a UI component in the app](https://docs.datadoghq.com/service_management/app_builder/components/)' properties: events: description: Events to listen for on the UI component. items: $ref: '#/components/schemas/AppBuilderEvent' type: array id: description: The ID of the UI component. This property is deprecated; use `name` to identify individual components instead. nullable: true type: string example: abc-123-def name: description: A unique identifier for this UI component. This name is also visible in the app editor. example: '' type: string properties: $ref: '#/components/schemas/ComponentProperties' type: $ref: '#/components/schemas/ComponentType' required: - name - type - properties type: object RestrictionQueryResponseIncludedItem: description: An object related to a restriction query. discriminator: mapping: roles: '#/components/schemas/RestrictionQueryRole' propertyName: type oneOf: - $ref: '#/components/schemas/RestrictionQueryRole' EntityV3DatadogIntegrationOpsgenie: additionalProperties: false description: An Opsgenie integration schema. properties: region: description: The region for the Opsgenie integration. minLength: 1 type: string example: example_value serviceURL: description: The service URL for the Opsgenie integration. example: https://www.opsgenie.com/service/shopping-cart minLength: 1 type: string required: - serviceURL type: object UserInvitationsType: default: user_invitations description: User invitations type. enum: - user_invitations example: user_invitations type: string x-enum-varnames: - USER_INVITATIONS IncidentIntegrationMetadataResponseData: description: Incident integration metadata from a response. properties: attributes: $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes' id: description: The incident integration metadata's ID. example: 00000000-0000-0000-1234-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentIntegrationRelationships' type: $ref: '#/components/schemas/IncidentIntegrationMetadataType' required: - id - type type: object InputSchema: description: A list of input parameters for the workflow. These can be used as dynamic runtime values in your workflow. properties: parameters: description: The `InputSchema` `parameters`. items: $ref: '#/components/schemas/InputSchemaParameters' type: array type: object UserTarget: description: Represents a user target for an escalation policy step, including the user's ID and resource type. properties: id: description: Specifies the unique identifier of the user resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UserTargetType' required: - type - id type: object SecurityMonitoringSuppressionResponse: description: Response object containing a single suppression rule. properties: data: $ref: '#/components/schemas/SecurityMonitoringSuppression' type: object SecurityFilterMeta: description: Optional metadata associated to the response. properties: warning: description: A warning message. example: All the security filters are disabled. As a result, no logs are being analyzed. type: string type: object RoleAttributes: description: Attributes of the role. properties: created_at: description: Creation time of the role. format: date-time readOnly: true type: string example: example_value modified_at: description: Time of last role modification. format: date-time readOnly: true type: string example: example_value name: description: The name of the role. The name is neither unique nor a stable identifier of the role. type: string example: Example Monitor user_count: description: Number of users with that role. format: int64 readOnly: true type: integer example: 42 type: object LogsArchiveIntegrationAzure: description: The Azure archive's integration destination. properties: client_id: description: A client ID. example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa type: string tenant_id: description: A tenant ID. example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa type: string required: - tenant_id - client_id type: object IncidentAttachmentsResponse: description: The response object containing an incident's attachments. properties: data: description: An array of incident attachments. example: - attributes: attachment: documentUrl: '' title: Postmortem IR-123 attachment_type: postmortem id: 00000000-abcd-0002-0000-000000000000 relationships: last_modified_by_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users type: incident_attachments items: $ref: '#/components/schemas/IncidentAttachmentData' type: array included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentAttachmentsResponseIncludedItem' type: array required: - data type: object User: description: User object returned by the API. properties: attributes: $ref: '#/components/schemas/UserAttributes' id: description: ID of the user. type: string example: abc-123-def relationships: $ref: '#/components/schemas/UserResponseRelationships' type: $ref: '#/components/schemas/UsersType' type: object x-merge-override: required: false EntityV3DatastoreKind: description: The definition of Entity V3 Datastore Kind object. enum: - datastore example: datastore type: string x-enum-varnames: - DATASTORE ObservabilityPipelineSensitiveDataScannerProcessor: description: The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log events. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: sensitive-scanner type: string include: description: A Datadog search query used to determine which logs this processor targets. example: source:prod type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - parse-json-processor items: type: string type: array rules: description: A list of rules for identifying and acting on sensitive data patterns. items: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule' type: array type: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType' required: - id - type - include - inputs - rules type: object ContainerImagesResponse: description: List of Container Images. properties: data: description: Array of Container Image objects. items: $ref: '#/components/schemas/ContainerImageItem' type: array links: $ref: '#/components/schemas/ContainerImagesResponseLinks' meta: $ref: '#/components/schemas/ContainerImageMeta' type: object ObservabilityPipelineDatadogLogsDestinationType: default: datadog_logs description: The destination type. The value should always be `datadog_logs`. enum: - datadog_logs example: datadog_logs type: string x-enum-varnames: - DATADOG_LOGS RelationshipToIncidentAttachment: description: A relationship reference for attachments. properties: data: description: An array of incident attachments. items: $ref: '#/components/schemas/RelationshipToIncidentAttachmentData' type: array required: - data type: object CostAttributionTagNames: additionalProperties: description: 'A list of values that are associated with each tag key. - An empty list means the resource use wasn''t tagged with the respective tag. - Multiple values means the respective tag was applied multiple times on the resource. - An `` value means the resource was tagged with the respective tag but did not have a value.' items: description: A given tag in a list. example: datadog-integrations-lab type: string type: array description: 'Tag keys and values. A `null` value here means that the requested tag breakdown cannot be applied because it does not match the [tags configured for usage attribution](https://docs.datadoghq.com/account_management/billing/usage_attribution/#getting-started). In this scenario the API returns the total cost, not broken down by tags.' nullable: true type: object UserTeamRole: description: The user's role within the team enum: - admin nullable: true type: string x-enum-varnames: - ADMIN ActionQueryMockedOutputs: description: The mocked outputs of the action query. This is useful for testing the app without actually running the action. oneOf: - type: string - $ref: '#/components/schemas/ActionQueryMockedOutputsObject' EntityResponseIncludedRelatedEntity: description: Included related entity. properties: attributes: $ref: '#/components/schemas/EntityResponseIncludedRelatedEntityAttributes' id: description: Entity UUID. type: string example: abc-123-def meta: $ref: '#/components/schemas/EntityResponseIncludedRelatedEntityMeta' type: $ref: '#/components/schemas/EntityResponseIncludedRelatedEntityType' type: object EntityV3Integrations: additionalProperties: false description: A base schema for defining third-party integrations. properties: opsgenie: $ref: '#/components/schemas/EntityV3DatadogIntegrationOpsgenie' pagerduty: $ref: '#/components/schemas/EntityV3DatadogIntegrationPagerduty' type: object CostByOrgAttributes: description: Cost attributes data. properties: account_name: description: The account name. type: string example: Example Monitor account_public_id: description: The account public ID. type: string example: abc-123-def charges: description: List of charges data reported for the requested month. items: $ref: '#/components/schemas/ChargebackBreakdown' type: array date: description: The month requested. format: date-time type: string example: '2026-04-17T12:00:00Z' org_name: description: The organization name. type: string example: Example Monitor public_id: description: The organization public ID. type: string example: abc-123-def region: description: The region of the Datadog instance that the organization belongs to. type: string example: example_value total_cost: description: The total cost of products for the month. format: double type: number example: 95.5 type: object HTTPIntegrationType: description: The definition of `HTTPIntegrationType` object. enum: - HTTP example: HTTP type: string x-enum-varnames: - HTTP ConfluentAccountResponseData: description: An API key and API secret pair that represents a Confluent account. properties: attributes: $ref: '#/components/schemas/ConfluentAccountResponseAttributes' id: description: A randomly generated ID associated with a Confluent account. example: account_id_abc123 type: string type: $ref: '#/components/schemas/ConfluentAccountType' required: - attributes - id - type type: object x-merge-override: required: false EmailTypeType: description: The type of email. enum: - work type: string x-enum-varnames: - WORK ObservabilityPipelineGenerateMetricsProcessor: description: 'The `generate_datadog_metrics` processor creates custom metrics from logs and sends them to Datadog. Metrics can be counters, gauges, or distributions and optionally grouped by log fields. ' properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: generate-metrics-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this processor. example: - source-id items: type: string type: array metrics: description: Configuration for generating individual metrics. items: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetric' type: array type: $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessorType' required: - id - type - inputs - include - metrics type: object RelationEntity: description: Relation entity reference. properties: kind: description: Entity kind. type: string example: example_value name: description: Entity name. type: string example: Example Monitor namespace: description: Entity namespace. type: string example: Example Monitor type: object ListRelationCatalogResponseLinks: description: List relation response links. properties: next: description: Next link. example: /api/v2/catalog/relation?filter[from_ref]=service:service-catalog&include=entity&page[limit]=2&page[offset]=2 type: string previous: description: Previous link. type: string example: example_value self: description: Current link. example: /api/v2/catalog/relation?filter[from_ref]=service:service-catalog&include=entity&page[limit]=2&page[offset]=0 type: string type: object LogsResponseMetadataPage: description: Paging attributes. properties: after: description: 'The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.' example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object EntityMeta: description: Entity metadata. properties: createdAt: description: The creation time. type: string example: example_value ingestionSource: description: The ingestion source. type: string example: example_value modifiedAt: description: The modification time. type: string example: example_value origin: description: The origin. type: string example: example_value type: object ScheduleTriggerWrapper: description: Schema for a Schedule-based trigger. properties: scheduleTrigger: $ref: '#/components/schemas/ScheduleTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - scheduleTrigger type: object IncidentResponseData: description: Incident data from a response. properties: attributes: $ref: '#/components/schemas/IncidentResponseAttributes' id: description: The incident's ID. example: 00000000-0000-0000-1234-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentResponseRelationships' type: $ref: '#/components/schemas/IncidentType' required: - id - type type: object x-merge-override: required: false FullApplicationKeyAttributes: description: Attributes of a full application key. properties: created_at: description: Creation date of the application key. example: '2020-11-23T10:00:00.000Z' format: date-time readOnly: true type: string key: description: The application key. readOnly: true type: string x-secret: true example: example_value last4: description: The last four characters of the application key. example: abcd maxLength: 4 minLength: 4 readOnly: true type: string x-secret: true name: description: Name of the application key. example: Application Key for managing dashboards type: string scopes: description: Array of scopes to grant the application key. example: - dashboards_read - dashboards_write - dashboards_public_share items: description: Name of scope. type: string nullable: true type: array type: object x-merge-override: properties: false MetricsAndMetricTagConfigurationsResponse: description: Response object that includes metrics and metric tag configurations. properties: data: description: Array of metrics and metric tag configurations. items: $ref: '#/components/schemas/MetricsAndMetricTagConfigurations' type: array links: $ref: '#/components/schemas/MetricsListResponseLinks' meta: $ref: '#/components/schemas/MetricPaginationMeta' readOnly: true type: object PowerpackData: description: Powerpack data object. properties: attributes: $ref: '#/components/schemas/PowerpackAttributes' id: description: ID of the powerpack. type: string example: abc-123-def relationships: $ref: '#/components/schemas/PowerpackRelationships' type: description: Type of widget, must be powerpack. example: powerpack type: string type: object x-merge-override: required: false EscalationRelationshipsRespondersDataItems: description: Represents a user assigned to an escalation step. properties: id: description: Unique identifier of the user assigned to the escalation step. example: '' type: string type: $ref: '#/components/schemas/EscalationRelationshipsRespondersDataItemsType' required: - type - id type: object DeploymentRelationshipData: description: Data object containing the deployment ID. properties: id: description: The deployment ID. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: '#/components/schemas/AppDeploymentType' type: object CIAppPipelineEvent: description: Object description of a pipeline event after being processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/CIAppPipelineEventAttributes' id: description: Unique ID of the event. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/CIAppPipelineEventTypeName' type: object IncidentUserDefinedFieldType: description: The incident user defined fields type. enum: - user_defined_field example: user_defined_field type: string x-enum-varnames: - USER_DEFINED_FIELD FindingStatus: description: The status of the finding. enum: - critical - high - medium - low - info example: critical type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - INFO CIAppTestLevel: description: Test run level. enum: - session - module - suite - test example: test type: string x-enum-varnames: - SESSION - MODULE - SUITE - TEST MonitorNotificationRuleResourceType: default: monitor-notification-rule description: Monitor notification rule resource type. enum: - monitor-notification-rule example: monitor-notification-rule type: string x-enum-varnames: - MONITOR_NOTIFICATION_RULE RelationRelationships: description: Relation relationships. properties: fromEntity: $ref: '#/components/schemas/RelationToEntity' toEntity: $ref: '#/components/schemas/RelationToEntity' type: object OrganizationsType: default: orgs description: Organizations resource type. enum: - orgs example: orgs type: string x-enum-varnames: - ORGS ListRelationCatalogResponse: description: List entity relation response. properties: data: $ref: '#/components/schemas/RelationResponseData' included: $ref: '#/components/schemas/ListRelationCatalogResponseIncluded' links: $ref: '#/components/schemas/ListRelationCatalogResponseLinks' meta: $ref: '#/components/schemas/RelationResponseMeta' type: object MonitorDowntimeMatchResponseAttributes: description: Downtime match details. properties: end: description: The end of the downtime. example: '2020-01-02T03:04:00.000Z' format: date-time nullable: true type: string groups: description: An array of groups associated with the downtime. example: - service:postgres - team:frontend items: description: An array of groups. example: service:postgres type: string type: array scope: $ref: '#/components/schemas/DowntimeScope' start: description: The start of the downtime. example: '2020-01-02T03:04:00.000Z' format: date-time type: string type: object ServiceDefinitionV2OpsgenieRegion: description: Opsgenie instance region. enum: - US - EU example: US type: string x-enum-varnames: - US - EU ApplicationSecurityWafCustomRuleConditionOptions: description: Options for the operator of this condition. properties: case_sensitive: default: false description: Evaluate the value as case sensitive. type: boolean example: true min_length: default: 0 description: Only evaluate this condition if the value has a minimum amount of characters. format: int64 type: integer example: 42 type: object CaseTriggerWrapper: description: Schema for a Case-based trigger. properties: caseTrigger: $ref: '#/components/schemas/CaseTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - caseTrigger type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection: description: Indicates whether to redact characters from the first or last part of the matched value. enum: - first - last example: last type: string x-enum-varnames: - FIRST - LAST EntityResponseIncludedSchema: description: Included detail entity schema. properties: attributes: $ref: '#/components/schemas/EntityResponseIncludedSchemaAttributes' id: description: Entity ID. type: string example: abc-123-def type: $ref: '#/components/schemas/EntityResponseIncludedSchemaType' type: object MonitorConfigPolicyType: default: tag description: The monitor configuration policy type. enum: - tag example: tag type: string x-enum-varnames: - TAG UsersRelationship: description: Relationship to users. properties: data: description: Relationships to user objects. example: [] items: $ref: '#/components/schemas/UserRelationshipData' type: array required: - data type: object MicrosoftTeamsTenantBasedHandleInfoType: default: ms-teams-tenant-based-handle-info description: Tenant-based handle resource type. enum: - ms-teams-tenant-based-handle-info example: ms-teams-tenant-based-handle-info type: string x-enum-varnames: - MS_TEAMS_TENANT_BASED_HANDLE_INFO RumMetricResponseUniqueness: description: The rule to count updatable events. Is only set if `event_type` is `session` or `view`. properties: when: $ref: '#/components/schemas/RumMetricUniquenessWhen' type: object DORAListDeploymentsRequest: description: Request to get a list of deployments. properties: data: $ref: '#/components/schemas/DORAListDeploymentsRequestData' required: - data type: object ObservabilityPipelineElasticsearchDestinationApiVersion: description: The Elasticsearch API version to use. Set to `auto` to auto-detect. enum: - auto - v6 - v7 - v8 example: auto type: string x-enum-varnames: - AUTO - V6 - V7 - V8 ServiceDefinitionV2Contact: description: Service owner's contacts information. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV2Email' - $ref: '#/components/schemas/ServiceDefinitionV2Slack' - $ref: '#/components/schemas/ServiceDefinitionV2MSTeams' WorkflowUserRelationshipType: description: The definition of `WorkflowUserRelationshipType` object. enum: - users example: users type: string x-enum-varnames: - USERS EventAttributes: description: Object description of attributes from your event. properties: aggregation_key: description: Aggregation key of the event. type: string example: example_value date_happened: description: 'POSIX timestamp of the event. Must be sent as an integer (no quotation marks). Limited to events no older than 18 hours.' format: int64 type: integer example: 42 device_name: description: A device name. type: string example: Example Monitor duration: description: The duration between the triggering of the event and its recovery in nanoseconds. format: int64 type: integer example: 42 event_object: description: The event title. example: Did you hear the news today? type: string evt: $ref: '#/components/schemas/Event' hostname: description: 'Host name to associate with the event. Any tags associated with the host are also applied to this event.' type: string example: Example Monitor monitor: $ref: '#/components/schemas/MonitorType' monitor_groups: description: List of groups referred to in the event. items: description: Group referred to in the event. type: string nullable: true type: array monitor_id: description: ID of the monitor that triggered the event. When an event isn't related to a monitor, this field is empty. format: int64 nullable: true type: integer example: 42 priority: $ref: '#/components/schemas/EventPriority' related_event_id: description: Related event ID. format: int64 type: integer example: 42 service: description: Service that triggered the event. example: datadog-api type: string source_type_name: description: 'The type of event being posted. For example, `nagios`, `hudson`, `jenkins`, `my_apps`, `chef`, `puppet`, `git` or `bitbucket`. The list of standard source attribute values is [available here](https://docs.datadoghq.com/integrations/faq/list-of-api-source-attribute-value).' type: string example: Example Monitor sourcecategory: description: Identifier for the source of the event, such as a monitor alert, an externally-submitted event, or an integration. type: string example: example_value status: $ref: '#/components/schemas/EventStatusType' tags: description: A list of tags to apply to the event. example: - environment:test items: description: A tag. type: string type: array timestamp: description: POSIX timestamp of your event in milliseconds. example: 1652274265000 format: int64 type: integer title: description: The event title. example: Oh boy! type: string type: object ObservabilityPipelinePipelineKafkaSourceSaslMechanism: description: SASL mechanism used for Kafka authentication. enum: - PLAIN - SCRAM-SHA-256 - SCRAM-SHA-512 type: string x-enum-varnames: - PLAIN - SCRAMNOT_SHANOT_256 - SCRAMNOT_SHANOT_512 RelationshipToOrganizationData: description: Relationship to organization object. properties: id: description: ID of the organization. example: 00000000-0000-beef-0000-000000000000 type: string type: $ref: '#/components/schemas/OrganizationsType' required: - id - type type: object MonthlyCostAttributionBody: description: Cost data. properties: attributes: $ref: '#/components/schemas/MonthlyCostAttributionAttributes' id: description: Unique ID of the response. type: string example: abc-123-def type: $ref: '#/components/schemas/CostAttributionType' type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern: description: Specifies a pattern from Datadog’s sensitive data detection library to match known sensitive data types. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions' type: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType' required: - type - options type: object DashboardTriggerWrapper: description: Schema for a Dashboard-based trigger. properties: dashboardTrigger: description: Trigger a workflow from a Dashboard. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - dashboardTrigger type: object XRayServicesIncludeOnly: description: Include only these services. Defaults to `[]`. nullable: true properties: include_only: description: Include only these services. example: - AWS/AppSync items: example: AWS/AppSync type: string type: array required: - include_only type: object OrgConfigGetResponse: description: A response with a single Org Config. properties: data: $ref: '#/components/schemas/OrgConfigRead' required: - data type: object PowerpackGroupWidget: description: Powerpack group widget definition object. properties: definition: $ref: '#/components/schemas/PowerpackGroupWidgetDefinition' layout: $ref: '#/components/schemas/PowerpackGroupWidgetLayout' live_span: $ref: '#/components/schemas/WidgetLiveSpan' required: - definition type: object CustomDestinationResponseAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.' example: - datacenter - host items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType' forwarder_destination: $ref: '#/components/schemas/CustomDestinationResponseForwardDestination' name: description: The custom destination name. example: Nginx logs type: string query: default: '' description: The custom destination query filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string type: object SecurityFilterFilteredDataType: description: The filtered data type. enum: - logs example: logs type: string x-enum-varnames: - LOGS OpsgenieServiceRegionType: description: The region for the Opsgenie service. enum: - us - eu - custom example: us type: string x-enum-varnames: - US - EU - CUSTOM CustomDestinationResponseForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC ProjectResourceType: default: project description: Project resource type enum: - project example: project type: string x-enum-varnames: - PROJECT RUMApplicationAttributes: description: RUM application attributes. properties: application_id: description: ID of the RUM application. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string x-merge-override: format: false client_token: description: Client token of the RUM application. example: abcd1234efgh5678ijkl90abcd1234efgh0 type: string created_at: description: Timestamp in ms of the creation date. example: 1659479836169 format: int64 type: integer created_by_handle: description: Handle of the creator user. example: john.doe type: string hash: description: Hash of the RUM application. Optional. type: string example: example_value is_active: description: Indicates if the RUM application is active. example: true type: boolean name: description: Name of the RUM application. example: my_rum_application type: string org_id: description: Org ID of the RUM application. example: 999 format: int32 maximum: 2147483647 type: integer type: description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`. example: browser type: string updated_at: description: Timestamp in ms of the last update date. example: 1659479836169 format: int64 type: integer updated_by_handle: description: Handle of the updater user. example: jane.doe type: string required: - application_id - client_token - created_at - created_by_handle - name - org_id - type - updated_at - updated_by_handle type: object ContainerImageMetaPage: description: Paging attributes. properties: cursor: description: The cursor used to get the current results, if any. type: string example: example_value limit: description: Number of results returned format: int32 maximum: 10000 minimum: 0 type: integer example: 42 next_cursor: description: The cursor used to get the next results, if any. type: string example: example_value prev_cursor: description: The cursor used to get the previous results, if any. nullable: true type: string example: example_value total: description: Total number of records that match the query. format: int64 type: integer example: 42 type: $ref: '#/components/schemas/ContainerImageMetaPageType' type: object ObservabilityPipelineGooglePubSubSource: description: The `google_pubsub` source ingests logs from a Google Cloud Pub/Sub subscription. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineGcpAuth' decoding: $ref: '#/components/schemas/ObservabilityPipelineDecoding' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: google-pubsub-source type: string project: description: The GCP project ID that owns the Pub/Sub subscription. example: my-gcp-project type: string subscription: description: The Pub/Sub subscription name from which messages are consumed. example: logs-subscription type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSourceType' required: - id - type - auth - decoding - project - subscription type: object DowntimeMetaPage: description: Object containing the total filtered count. properties: total_filtered_count: description: Total count of elements matched by the filter. format: int64 type: integer example: 42 type: object RumMetricsResponse: description: All the available rum-based metric objects. properties: data: description: A list of rum-based metric objects. items: $ref: '#/components/schemas/RumMetricResponseData' type: array type: object PowerpackGroupWidgetLayout: description: Powerpack group widget layout. properties: height: description: The height of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer width: description: The width of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer x: description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer y: description: The position of the widget on the y (vertical) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer required: - x - y - width - height type: object ObservabilityPipelineOcsfMapperProcessorType: default: ocsf_mapper description: The processor type. The value should always be `ocsf_mapper`. enum: - ocsf_mapper example: ocsf_mapper type: string x-enum-varnames: - OCSF_MAPPER SpecVersion: description: The version of the CycloneDX specification a BOM conforms to. enum: - '1.0' - '1.1' - '1.2' - '1.3' - '1.4' - '1.5' example: '1.5' type: string x-enum-varnames: - ONE_ZERO - ONE_ONE - ONE_TWO - ONE_THREE - ONE_FOUR - ONE_FIVE IncidentAttachmentsPostmortemAttributesAttachmentObject: description: The postmortem attachment. properties: documentUrl: description: The URL of this notebook attachment. example: https://app.datadoghq.com/notebook/123 type: string title: description: The title of this postmortem attachment. example: Postmortem IR-123 type: string required: - documentUrl - title type: object ObservabilityPipelineKafkaSourceLibrdkafkaOption: description: Represents a key-value pair used to configure low-level `librdkafka` client options for Kafka sources, such as timeouts, buffer sizes, and security settings. properties: name: description: The name of the `librdkafka` configuration option to set. example: fetch.message.max.bytes type: string value: description: The value assigned to the specified `librdkafka` configuration option. example: '1048576' type: string required: - name - value type: object UsageDataObject: description: Usage data. properties: attributes: $ref: '#/components/schemas/UsageAttributesObject' id: description: Unique ID of the response. type: string example: abc-123-def type: $ref: '#/components/schemas/UsageTimeSeriesType' type: object LayerRelationships: description: Holds references to objects related to the Layer entity, such as its members. properties: members: $ref: '#/components/schemas/LayerRelationshipsMembers' type: object DowntimeNotifyEndStateTypes: description: State that will trigger a monitor notification when the `notify_end_types` action occurs. enum: - alert - no data - warn example: alert type: string x-enum-varnames: - ALERT - NO_DATA - WARN DowntimeScheduleRecurrencesResponse: description: A recurring downtime schedule definition. properties: current_downtime: $ref: '#/components/schemas/DowntimeScheduleCurrentDowntimeResponse' recurrences: description: A list of downtime recurrences. items: $ref: '#/components/schemas/DowntimeScheduleRecurrenceResponse' maxItems: 5 minItems: 1 type: array timezone: default: UTC description: 'The timezone in which to schedule the downtime. This affects recurring start and end dates. Must match `display_timezone`.' example: America/New_York type: string required: - recurrences type: object SpansMetricResponse: description: The span-based metric object. properties: data: $ref: '#/components/schemas/SpansMetricResponseData' type: object ActiveBillingDimensionsAttributes: description: List of active billing dimensions. properties: month: description: 'Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]`.' format: date-time type: string example: example_value values: description: 'List of active billing dimensions. Example: `[infra_host, apm_host, serverless_infra]`.' items: description: A given billing dimension in a list. example: infra_host type: string type: array type: object RUMResponsePage: description: Paging attributes. properties: after: description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object ExternalUserEmailType: description: Email address for the user. properties: primary: description: Boolean indicating if this email is the primary email address. type: boolean example: true type: $ref: '#/components/schemas/EmailTypeType' value: description: Email addresses for the user. type: string example: example_value type: object TagFilter: description: Tag filter for the budget's entries. properties: tag_key: description: The key of the tag. example: service type: string tag_value: description: The value of the tag. example: ec2 type: string type: object SendSlackMessageAction: description: Sends a message to a Slack channel. properties: channel: description: The channel ID. example: CHANNEL type: string type: $ref: '#/components/schemas/SendSlackMessageActionType' workspace: description: The workspace ID. example: WORKSPACE type: string required: - type - channel - workspace type: object SecurityMonitoringRuleEvaluationWindow: description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY AuditLogsResponsePage: description: Paging attributes. properties: after: description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object RuleName: description: Name of the notification rule. example: Rule 1 type: string UserTeamRelationships: description: Relationship between membership and a user properties: team: $ref: '#/components/schemas/RelationshipToUserTeamTeam' user: $ref: '#/components/schemas/RelationshipToUserTeamUser' type: object CustomCostsFileGetResponse: description: Response for Get Custom Costs files. properties: data: $ref: '#/components/schemas/CustomCostsFileMetadataWithContentHighLevel' meta: $ref: '#/components/schemas/CustomCostGetResponseMeta' type: object ObservabilityPipelineRenameFieldsProcessorType: default: rename_fields description: The processor type. The value should always be `rename_fields`. enum: - rename_fields example: rename_fields type: string x-enum-varnames: - RENAME_FIELDS ObservabilityPipelineHttpClientSourceType: default: http_client description: The source type. The value should always be `http_client`. enum: - http_client example: http_client type: string x-enum-varnames: - HTTP_CLIENT SecurityMonitoringFilterAction: description: The type of filtering action. enum: - require - suppress type: string x-enum-varnames: - REQUIRE - SUPPRESS JSONAPIErrorResponse: description: API error response. properties: errors: description: A list of errors. items: $ref: '#/components/schemas/JSONAPIErrorItem' type: array required: - errors type: object CaseTrigger: description: Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object TeamLinksResponse: description: Team links response properties: data: description: Team links response data items: $ref: '#/components/schemas/TeamLink' type: array type: object IncidentNotificationHandle: description: A notification handle that will be notified at incident creation. properties: display_name: description: The name of the notified handle. example: Jane Doe type: string handle: description: The handle used for the notification. This includes an email address, Slack channel, or workflow. example: '@test.user@test.com' type: string type: object MetricTagConfigurationMetricTypeCategory: default: distribution description: The metric's type category. enum: - non_distribution - distribution example: distribution type: string x-enum-varnames: - NON_DISTRIBUTION - DISTRIBUTION ActionQueryType: default: action description: The action query type. enum: - action example: action type: string x-enum-varnames: - ACTION ScheduleDataRelationshipsLayersDataItems: description: Relates a layer to this schedule, identified by `id` and `type` (must be `layers`). properties: id: description: The unique identifier of the layer in this relationship. example: 00000000-0000-0000-0000-000000000001 type: string type: $ref: '#/components/schemas/ScheduleDataRelationshipsLayersDataItemsType' required: - type - id type: object ApplicationSecurityWafExclusionFilterOnMatch: description: The action taken when the exclusion filter matches. When set to `monitor`, security traces are emitted but the requests are not blocked. By default, security traces are not emitted and the requests are not blocked. enum: - monitor type: string x-enum-varnames: - MONITOR RelationIncludeType: description: Supported include types for relations. enum: - entity - schema type: string x-enum-varnames: - ENTITY - SCHEMA CsmHostsAndContainersCoverageAnalysisData: description: CSM Hosts and Containers Coverage Analysis data. properties: attributes: $ref: '#/components/schemas/CsmHostsAndContainersCoverageAnalysisAttributes' id: description: The ID of your organization. example: 66b3c6b5-5c9a-457e-b1c3-f247ca23afa3 type: string type: default: get_hosts_and_containers_coverage_analysis_response_public_v0 description: The type of the resource. The value should always be `get_hosts_and_containers_coverage_analysis_response_public_v0`. example: get_hosts_and_containers_coverage_analysis_response_public_v0 type: string type: object ServiceDefinitionV2Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string type: $ref: '#/components/schemas/ServiceDefinitionV2LinkType' url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object ScheduleDataRelationshipsLayersDataItemsType: default: layers description: Layers resource type. enum: - layers example: layers type: string x-enum-varnames: - LAYERS RelationshipToPermissionData: description: Relationship to permission object. properties: id: description: ID of the permission. type: string example: abc-123-def type: $ref: '#/components/schemas/PermissionsType' type: object x-merge-override: required: false MetricMetaPage: description: Paging attributes. Only present if pagination query parameters were provided. properties: cursor: description: The cursor used to get the current results, if any. nullable: true type: string example: example_value limit: description: Number of results returned format: int32 maximum: 20000 minimum: 0 type: integer example: 42 next_cursor: description: The cursor used to get the next results, if any. nullable: true type: string example: example_value type: $ref: '#/components/schemas/MetricMetaPageType' type: object InterfaceAttributes: description: The interface attributes properties: alias: description: The interface alias example: interface_0 type: string description: description: The interface description example: a network interface type: string index: description: The interface index example: 0 format: int64 type: integer ip_addresses: description: The interface IP addresses example: - 1.1.1.1 - 1.1.1.2 items: type: string type: array mac_address: description: The interface MAC address example: 00:00:00:00:00:00 type: string name: description: The interface name example: if0 type: string status: $ref: '#/components/schemas/InterfaceAttributesStatus' type: object IPAllowlistEntry: description: IP allowlist entry object. properties: data: $ref: '#/components/schemas/IPAllowlistEntryData' required: - data type: object CloudWorkloadSecurityAgentRuleAction: description: The action the rule can perform if triggered properties: filter: description: SECL expression used to target the container to apply the action on type: string example: example_value kill: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill' metadata: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata' set: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet' type: object AppBuilderEventType: description: The response to the event. enum: - custom - setComponentState - triggerQuery - openModal - closeModal - openUrl - downloadFile - setStateVariableValue example: triggerQuery type: string x-enum-varnames: - CUSTOM - SETCOMPONENTSTATE - TRIGGERQUERY - OPENMODAL - CLOSEMODAL - OPENURL - DOWNLOADFILE - SETSTATEVARIABLEVALUE SecurityMonitoringRuleCaseActionOptions: additionalProperties: {} description: Options for the rule action properties: duration: description: Duration of the action in seconds. 0 indicates no expiration. example: 0 format: int64 minimum: 0 type: integer userBehaviorName: $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName' type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget: description: Applies the rule only to included fields. enum: - include example: include type: string x-enum-varnames: - INCLUDE EntityResponseIncludedOncall: description: Included oncall. properties: attributes: $ref: '#/components/schemas/EntityResponseIncludedRelatedOncallAttributes' id: description: Oncall ID. type: string example: abc-123-def type: $ref: '#/components/schemas/EntityResponseIncludedOncallType' type: object DetailedFindingType: default: detailed_finding description: The JSON:API type for findings that have the message and resource configuration. enum: - detailed_finding example: detailed_finding type: string x-enum-varnames: - DETAILED_FINDING ObservabilityPipelineFilterProcessor: description: The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: filter-processor type: string include: description: A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineFilterProcessorType' required: - id - type - include - inputs type: object JiraIntegrationMetadata: description: Incident integration metadata for the Jira integration. properties: issues: description: Array of Jira issues in this integration metadata. example: [] items: $ref: '#/components/schemas/JiraIntegrationMetadataIssuesItem' type: array required: - issues type: object DeploymentMetadata: description: Metadata object containing the publication creation information. properties: created_at: description: Timestamp of when the app was published. format: date-time type: string example: example_value user_id: description: The ID of the user who published the app. format: int64 type: integer example: 42 user_name: description: The name (or email address) of the user who published the app. type: string example: Example Monitor user_uuid: description: The UUID of the user who published the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: object TeamPermissionSetting: description: Team permission setting properties: attributes: $ref: '#/components/schemas/TeamPermissionSettingAttributes' id: description: The team permission setting's identifier example: TeamPermission-aeadc05e-98a8-11ec-ac2c-da7ad0900001-edit type: string type: $ref: '#/components/schemas/TeamPermissionSettingType' required: - id - type type: object x-merge-override: required: false Enabled: description: Field used to enable or disable the rule. example: true type: boolean JobDefinition: description: Definition of a historical job. properties: calculatedFields: description: Calculated fields. items: $ref: '#/components/schemas/CalculatedField' type: array cases: description: Cases used for generating job results. items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate' type: array from: description: Starting time of data analyzed by the job. example: 1729843470000 format: int64 type: integer groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array index: description: Index used to load the data. example: cloud_siem type: string message: description: Message for generated results. example: A large number of failed login attempts. type: string name: description: Job name. example: Excessive number of failed attempts. type: string options: $ref: '#/components/schemas/HistoricalJobOptions' queries: description: Queries for selecting logs analyzed by the job. items: $ref: '#/components/schemas/HistoricalJobQuery' type: array referenceTables: description: Reference tables used in the queries. items: $ref: '#/components/schemas/SecurityMonitoringReferenceTable' type: array tags: description: Tags for generated signals. items: type: string type: array thirdPartyCases: description: Cases for generating results from third-party detection method. Only available for third-party detection method. example: [] items: $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate' type: array to: description: Ending time of data analyzed by the job. example: 1729847070000 format: int64 type: integer type: description: Job type. type: string example: metric alert required: - from - to - index - name - cases - queries - message type: object IncidentTypeAttributes: description: Incident type's attributes. properties: createdAt: description: Timestamp when the incident type was created. format: date-time readOnly: true type: string example: example_value createdBy: description: A unique identifier that represents the user that created the incident type. example: 00000000-0000-0000-0000-000000000000 readOnly: true type: string description: description: Text that describes the incident type. example: Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data. type: string is_default: default: false description: If true, this incident type will be used as the default incident type if a type is not specified during the creation of incident resources. example: false type: boolean lastModifiedBy: description: A unique identifier that represents the user that last modified the incident type. example: 00000000-0000-0000-0000-000000000000 readOnly: true type: string modifiedAt: description: Timestamp when the incident type was last modified. format: date-time readOnly: true type: string example: example_value name: description: The name of the incident type. example: Security Incident type: string prefix: description: The string that will be prepended to the incident title across the Datadog app. example: IR readOnly: true type: string required: - name type: object ObservabilityPipelineParseGrokProcessor: description: The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns. properties: disable_library_rules: default: false description: If set to `true`, disables the default Grok rules provided by Datadog. example: true type: boolean id: description: A unique identifier for this processor. example: parse-grok-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array rules: description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied. items: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRule' type: array type: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorType' required: - id - type - include - inputs - rules type: object ObservabilityPipelineSumoLogicDestinationType: default: sumo_logic description: The destination type. The value should always be `sumo_logic`. enum: - sumo_logic example: sumo_logic type: string x-enum-varnames: - SUMO_LOGIC SecurityMonitoringReferenceTable: description: Reference tables used in the queries. properties: checkPresence: description: Whether to include or exclude the matched values. type: boolean example: true columnName: description: The name of the column in the reference table. type: string example: Example Monitor logFieldPath: description: The field in the log to match against the reference table. type: string example: example_value ruleQueryName: description: The name of the query to apply the reference table to. type: string example: Example Monitor tableName: description: The name of the reference table. type: string example: Example Monitor type: object ServiceDefinitionDataAttributes: description: Service definition attributes. properties: meta: $ref: '#/components/schemas/ServiceDefinitionMeta' schema: $ref: '#/components/schemas/ServiceDefinitionSchema' type: object DowntimeScheduleRecurrenceResponse: description: An RRULE-based recurring downtime. properties: duration: $ref: '#/components/schemas/DowntimeScheduleRecurrenceDuration' rrule: $ref: '#/components/schemas/DowntimeScheduleRecurrenceRrule' start: description: 'ISO-8601 Datetime to start the downtime. Must not include a UTC offset. If not provided, the downtime starts the moment it is created.' example: 2020-01-02T03:04 type: string type: object ProjectRelationshipData: description: Relationship to project object properties: id: description: A unique identifier that represents the project example: e555e290-ed65-49bd-ae18-8acbfcf18db7 type: string type: $ref: '#/components/schemas/ProjectResourceType' required: - id - type type: object IncidentResponse: description: Response with an incident. properties: data: $ref: '#/components/schemas/IncidentResponseData' included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentResponseIncludedItem' readOnly: true type: array required: - data type: object RUMApplicationType: default: rum_application description: RUM application response type. enum: - rum_application example: rum_application type: string x-enum-varnames: - RUM_APPLICATION ObservabilityPipelineElasticsearchDestinationType: default: elasticsearch description: The destination type. The value should always be `elasticsearch`. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH DORAListFailuresRequestAttributes: description: Attributes to get a list of failures. properties: from: description: Minimum timestamp for requested events. format: date-time type: string example: example_value limit: default: 10 description: Maximum number of events in the response. format: int32 maximum: 1000 type: integer example: 42 query: description: Search query with event platform syntax. type: string example: avg:system.cpu.user{*} sort: description: Sort order (prefixed with `-` for descending). type: string example: example_value to: description: Maximum timestamp for requested events. format: date-time type: string example: example_value type: object RumRetentionFilterType: default: retention_filters description: The type of the resource. The value should always be retention_filters. enum: - retention_filters example: retention_filters type: string x-enum-varnames: - RETENTION_FILTERS CsmCloudAccountsCoverageAnalysisData: description: CSM Cloud Accounts Coverage Analysis data. properties: attributes: $ref: '#/components/schemas/CsmCloudAccountsCoverageAnalysisAttributes' id: description: The ID of your organization. example: 66b3c6b5-5c9a-457e-b1c3-f247ca23afa3 type: string type: default: get_cloud_accounts_coverage_analysis_response_public_v0 description: The type of the resource. The value should always be `get_cloud_accounts_coverage_analysis_response_public_v0`. example: get_cloud_accounts_coverage_analysis_response_public_v0 type: string type: object ObservabilityPipelineSplunkHecSource: description: 'The `splunk_hec` source implements the Splunk HTTP Event Collector (HEC) API. ' properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: splunk-hec-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSourceType' required: - id - type type: object ObservabilityPipelineAmazonS3SourceType: default: amazon_s3 description: The source type. Always `amazon_s3`. enum: - amazon_s3 example: amazon_s3 type: string x-enum-varnames: - AMAZON_S3 UserInvitationResponse: description: User invitation as returned by the API. properties: data: $ref: '#/components/schemas/UserInvitationResponseData' type: object IncidentTodoAttributes: description: Incident todo's attributes. properties: assignees: $ref: '#/components/schemas/IncidentTodoAssigneeArray' completed: description: Timestamp when the todo was completed. example: '2023-03-06T22:00:00.000000+00:00' nullable: true type: string content: description: The follow-up task's content. example: Restore lost data. type: string created: description: Timestamp when the incident todo was created. format: date-time readOnly: true type: string example: example_value due_date: description: Timestamp when the todo should be completed by. example: '2023-07-10T05:00:00.000000+00:00' nullable: true type: string incident_id: description: UUID of the incident this todo is connected to. example: 00000000-aaaa-0000-0000-000000000000 type: string modified: description: Timestamp when the incident todo was last modified. format: date-time readOnly: true type: string example: example_value required: - content - assignees type: object ListEntityCatalogResponse: description: List entity response. properties: data: $ref: '#/components/schemas/EntityResponseData' included: $ref: '#/components/schemas/ListEntityCatalogResponseIncluded' links: $ref: '#/components/schemas/ListEntityCatalogResponseLinks' meta: $ref: '#/components/schemas/EntityResponseMeta' type: object RumMetricEventType: description: The type of RUM events to filter on. enum: - session - view - action - error - resource - long_task - vital example: session type: string x-enum-varnames: - SESSION - VIEW - ACTION - ERROR - RESOURCE - LONG_TASK - VITAL TeamResponse: description: Response with a team properties: data: $ref: '#/components/schemas/Team' type: object CloudConfigurationRuleComplianceSignalOptions: description: How to generate compliance signals. Useful for cloud_configuration rules only. properties: defaultActivationStatus: description: The default activation status. nullable: true type: boolean example: true defaultGroupByFields: description: The default group by fields. items: type: string nullable: true type: array userActivationStatus: description: Whether signals will be sent. nullable: true type: boolean example: true userGroupByFields: description: Fields to use to group findings by when sending signals. items: type: string nullable: true type: array type: object UserInvitationRelationships: description: Relationships data for user invitation. properties: user: $ref: '#/components/schemas/RelationshipToUser' required: - user type: object DowntimeRelationships: description: All relationships associated with downtime. properties: created_by: $ref: '#/components/schemas/DowntimeRelationshipsCreatedBy' monitor: $ref: '#/components/schemas/DowntimeRelationshipsMonitor' type: object TeamRoutingRulesDataRelationships: description: Specifies relationships for team routing rules, including rule references. properties: rules: $ref: '#/components/schemas/TeamRoutingRulesDataRelationshipsRules' type: object StateVariableProperties: description: The properties of the state variable. properties: defaultValue: description: The default value of the state variable. example: ${['order_3145', 'order_4920']} type: object TeamOnCallRespondersDataRelationshipsEscalations: description: Defines the escalation policy steps linked to the team's on-call configuration. properties: data: description: Array of escalation step references. items: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationshipsEscalationsDataItems' type: array type: object HourlyUsage: description: Hourly usage for a product family for an org. properties: attributes: $ref: '#/components/schemas/HourlyUsageAttributes' id: description: Unique ID of the response. type: string example: abc-123-def type: $ref: '#/components/schemas/UsageTimeSeriesType' type: object TeamsResponse: description: Response with multiple teams properties: data: description: Teams response data items: $ref: '#/components/schemas/Team' type: array included: description: Resources related to the team items: $ref: '#/components/schemas/TeamIncluded' type: array links: $ref: '#/components/schemas/TeamsResponseLinks' meta: $ref: '#/components/schemas/TeamsResponseMeta' type: object MonitorConfigPolicyPolicy: description: Configuration for the policy. oneOf: - $ref: '#/components/schemas/MonitorConfigPolicyTagPolicy' ServiceDefinitionGetResponse: description: Get service definition response. properties: data: $ref: '#/components/schemas/ServiceDefinitionData' type: object EscalationType: default: escalation_policy_steps description: Represents the resource type for individual steps in an escalation policy used during incident response. enum: - escalation_policy_steps example: escalation_policy_steps type: string x-enum-varnames: - ESCALATION_POLICY_STEPS LogsArchiveDestinationGCS: description: The GCS archive destination. properties: bucket: description: The bucket where the archive will be stored. example: bucket-name type: string integration: $ref: '#/components/schemas/LogsArchiveIntegrationGCS' path: description: The archive path. type: string example: example_value type: $ref: '#/components/schemas/LogsArchiveDestinationGCSType' required: - bucket - integration - type type: object ObservabilityPipelineThrottleProcessor: description: The `throttle` processor limits the number of events that pass through over a given time window. properties: group_by: description: Optional list of fields used to group events before the threshold has been reached. example: - log.user.id items: type: string type: array id: description: The unique identifier for this processor. example: throttle-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: env:prod type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - datadog-agent-source items: type: string type: array threshold: description: the number of events allowed in a given time window. Events sent after the threshold has been reached, are dropped. example: 1000 format: int64 type: integer type: $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessorType' window: description: The time window in seconds over which the threshold applies. example: 60 format: double type: number required: - id - type - include - inputs - threshold - window type: object RumRetentionFilterEnabled: description: Whether the retention filter is enabled. example: true type: boolean IncludeType: description: Supported include types. enum: - schema - raw_schema - oncall - incident - relation type: string x-enum-varnames: - SCHEMA - RAW_SCHEMA - ONCALL - INCIDENT - RELATION ProjectedCostAttributes: description: Projected Cost attributes data. properties: account_name: description: The account name. type: string example: Example Monitor account_public_id: description: The account public ID. type: string example: abc-123-def charges: description: List of charges data reported for the requested month. items: $ref: '#/components/schemas/ChargebackBreakdown' type: array date: description: The month requested. format: date-time type: string example: '2026-04-17T12:00:00Z' org_name: description: The organization name. type: string example: Example Monitor projected_total_cost: description: The total projected cost of products for the month. format: double type: number example: 95.5 public_id: description: The organization public ID. type: string example: abc-123-def region: description: The region of the Datadog instance that the organization belongs to. type: string example: example_value type: object TeamPermissionSettingsResponse: description: Team permission settings response properties: data: description: Team permission settings response data items: $ref: '#/components/schemas/TeamPermissionSetting' type: array type: object IncidentTodoType: default: incident_todos description: Todo resource type. enum: - incident_todos example: incident_todos type: string x-enum-varnames: - INCIDENT_TODOS GetRuleVersionHistoryData: description: Data for the rule version history. properties: attributes: $ref: '#/components/schemas/RuleVersionHistory' id: description: ID of the rule. type: string example: abc-123-def type: $ref: '#/components/schemas/GetRuleVersionHistoryDataType' type: object ShiftDataRelationshipsUserDataType: default: users description: Indicates that the related resource is of type 'users'. enum: - users example: users type: string x-enum-varnames: - USERS NullableUserRelationship: description: Relationship to user. nullable: true properties: data: $ref: '#/components/schemas/NullableUserRelationshipData' required: - data type: object LogsMetricResponseData: description: The log-based metric properties. properties: attributes: $ref: '#/components/schemas/LogsMetricResponseAttributes' id: $ref: '#/components/schemas/LogsMetricID' type: $ref: '#/components/schemas/LogsMetricType' type: object ObservabilityPipelineQuotaProcessorOverflowAction: description: 'The action to take when the quota is exceeded. Options: - `drop`: Drop the event. - `no_action`: Let the event pass through. - `overflow_routing`: Route to an overflow destination. ' enum: - drop - no_action - overflow_routing example: drop type: string x-enum-varnames: - DROP - NO_ACTION - OVERFLOW_ROUTING CloudWorkloadSecurityAgentPolicyAttributes: description: A Cloud Workload Security Agent policy returned by the API properties: blockingRulesCount: description: The number of rules with the blocking feature in this policy example: 100 format: int32 maximum: 2147483647 type: integer datadogManaged: description: Whether the policy is managed by Datadog example: false type: boolean description: description: The description of the policy example: My agent policy type: string disabledRulesCount: description: The number of rules that are disabled in this policy example: 100 format: int32 maximum: 2147483647 type: integer enabled: description: Whether the Agent policy is enabled example: true type: boolean hostTags: description: The host tags defining where this policy is deployed items: type: string type: array hostTagsLists: description: The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR items: items: type: string type: array type: array monitoringRulesCount: description: The number of rules in the monitoring state in this policy example: 100 format: int32 maximum: 2147483647 type: integer name: description: The name of the policy example: my_agent_policy type: string policyVersion: description: The version of the policy example: '1' type: string priority: description: The priority of the policy example: 10 format: int64 type: integer ruleCount: description: The number of rules in this policy example: 100 format: int32 maximum: 2147483647 type: integer updateDate: description: Timestamp in milliseconds when the policy was last updated example: 1624366480320 format: int64 type: integer updatedAt: description: When the policy was last updated, timestamp in milliseconds example: 1624366480320 format: int64 type: integer updater: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdaterAttributes' type: object ResponseMetaAttributes: description: Object describing meta attributes of response. properties: page: $ref: '#/components/schemas/Pagination' type: object x-merge-override: properties: false CIAppResponseLinks: description: Links attributes. properties: next: description: 'Link for the next set of results. The request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/ci/tests/events?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object ObservabilityPipelineSplunkHecSourceType: default: splunk_hec description: The source type. Always `splunk_hec`. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC LogsMetricType: default: logs_metrics description: The type of the resource. The value should always be logs_metrics. enum: - logs_metrics example: logs_metrics type: string x-enum-varnames: - LOGS_METRICS EntityV3Metadata: additionalProperties: false description: The definition of Entity V3 Metadata object. properties: additionalOwners: additionalProperties: false description: The additional owners of the entity, usually a team. items: $ref: '#/components/schemas/EntityV3MetadataAdditionalOwnersItems' type: array contacts: additionalProperties: false description: A list of contacts for the entity. items: $ref: '#/components/schemas/EntityV3MetadataContactsItems' type: array description: description: Short description of the entity. The UI can leverage the description for display. type: string example: example_value displayName: description: User friendly name of the entity. The UI can leverage the display name for display. type: string example: Example Monitor id: description: A read-only globally unique identifier for the entity generated by Datadog. User supplied values are ignored. example: 4b163705-23c0-4573-b2fb-f6cea2163fcb minLength: 1 type: string inheritFrom: description: The entity reference from which to inherit metadata example: application:default/myapp type: string links: additionalProperties: false description: A list of links for the entity. items: $ref: '#/components/schemas/EntityV3MetadataLinksItems' type: array managed: additionalProperties: {} description: A read-only set of Datadog managed attributes generated by Datadog. User supplied values are ignored. type: object name: description: Unique name given to an entity under the kind/namespace. example: myService minLength: 1 type: string namespace: description: Namespace is a part of unique identifier. It has a default value of 'default'. example: default minLength: 1 type: string owner: description: The owner of the entity, usually a team. type: string example: example_value tags: description: A set of custom tags. example: - this:tag - that:tag items: type: string type: array required: - name type: object Step: description: A Step is a sub-component of a workflow. Each Step performs an action. properties: actionId: description: The unique identifier of an action. example: '' type: string completionGate: $ref: '#/components/schemas/CompletionGate' connectionLabel: description: The unique identifier of a connection defined in the spec. type: string example: example_value display: $ref: '#/components/schemas/StepDisplay' errorHandlers: description: The `Step` `errorHandlers`. items: $ref: '#/components/schemas/ErrorHandler' type: array name: description: Name of the step. example: '' type: string outboundEdges: description: A list of subsequent actions to run. items: $ref: '#/components/schemas/OutboundEdge' type: array parameters: description: A list of inputs for an action. items: $ref: '#/components/schemas/Parameter' type: array readinessGate: $ref: '#/components/schemas/ReadinessGate' required: - name - actionId type: object ProjectRelationships: description: Project relationships properties: member_team: $ref: '#/components/schemas/RelationshipToTeamLinks' member_user: $ref: '#/components/schemas/UsersRelationship' type: object NotificationRuleQuery: description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes. example: (source:production_service OR env:prod) type: string ScheduleTrigger: description: Trigger a workflow from a Schedule. The workflow must be published. properties: rruleExpression: description: Recurrence rule expression for scheduling. example: '' type: string required: - rruleExpression type: object ContainerImageItem: description: Possible Container Image models. oneOf: - $ref: '#/components/schemas/ContainerImage' - $ref: '#/components/schemas/ContainerImageGroup' SecurityMonitoringRuleNewValueOptionsForgetAfter: description: The duration in days after which a learned value is forgotten. enum: - 1 - 2 - 7 - 14 - 21 - 28 format: int32 type: integer x-enum-varnames: - ONE_DAY - TWO_DAYS - ONE_WEEK - TWO_WEEKS - THREE_WEEKS - FOUR_WEEKS CostByOrg: description: Cost data. properties: attributes: $ref: '#/components/schemas/CostByOrgAttributes' id: description: Unique ID of the response. type: string example: abc-123-def type: $ref: '#/components/schemas/CostByOrgType' type: object ObservabilityPipelineLogstashSourceType: default: logstash description: The source type. The value should always be `logstash`. enum: - logstash example: logstash type: string x-enum-varnames: - LOGSTASH SBOMMetadataComponent: description: The component that the BOM describes. properties: name: description: The name of the component. This will often be a shortened, single name of the component. example: github.com/datadog/datadog-agent type: string type: description: Specifies the type of the component. example: application type: string type: object APIKeyRelationships: description: Resources related to the API key. properties: created_by: $ref: '#/components/schemas/RelationshipToUser' modified_by: $ref: '#/components/schemas/NullableRelationshipToUser' type: object RelationshipToUserTeamPermission: description: Relationship between a user team permission and a team properties: data: $ref: '#/components/schemas/RelationshipToUserTeamPermissionData' links: $ref: '#/components/schemas/TeamRelationshipsLinks' type: object x-merge-override: required: false FastlyAccountResponse: description: The expected response schema when getting a Fastly account. properties: data: $ref: '#/components/schemas/FastlyAccountResponseData' type: object IncidentResponseRelationships: description: The incident's relationships from a response. properties: attachments: $ref: '#/components/schemas/RelationshipToIncidentAttachment' commander_user: $ref: '#/components/schemas/NullableRelationshipToUser' created_by_user: $ref: '#/components/schemas/RelationshipToUser' impacts: $ref: '#/components/schemas/RelationshipToIncidentImpacts' integrations: $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas' last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' responders: $ref: '#/components/schemas/RelationshipToIncidentResponders' user_defined_fields: $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields' type: object CustomDestinationAttributeTagsRestrictionListType: default: ALLOW_LIST description: 'How `forward_tags_restriction_list` parameter should be interpreted. If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded. `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list.' enum: - ALLOW_LIST - BLOCK_LIST example: ALLOW_LIST type: string x-enum-varnames: - ALLOW_LIST - BLOCK_LIST ServiceDefinitionV2EmailType: description: Contact type. enum: - email example: email type: string x-enum-varnames: - EMAIL RetentionFilterAllAttributes: description: The attributes of the retention filter. properties: created_at: description: The creation timestamp of the retention filter. format: int64 type: integer example: 42 created_by: description: The creator of the retention filter. type: string example: example_value editable: description: Shows whether the filter can be edited. example: true type: boolean enabled: description: The status of the retention filter (Enabled/Disabled). example: true type: boolean execution_order: description: The execution order of the retention filter. format: int64 type: integer example: 42 filter: $ref: '#/components/schemas/SpansFilter' filter_type: $ref: '#/components/schemas/RetentionFilterAllType' modified_at: description: The modification timestamp of the retention filter. format: int64 type: integer example: 42 modified_by: description: The modifier of the retention filter. type: string example: example_value name: description: The name of the retention filter. example: my retention filter type: string rate: description: 'Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query.' example: 1 format: double type: number trace_rate: description: 'Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query.' example: 1 format: double type: number type: object EscalationPolicyStepType: default: steps description: Indicates that the resource is of type `steps`. enum: - steps example: steps type: string x-enum-varnames: - STEPS AWSAccountResponse: description: AWS Account response body. properties: data: $ref: '#/components/schemas/AWSAccountResponseData' required: - data type: object EntityV3APISpecInterfaceFileRef: additionalProperties: false description: The definition of `EntityV3APISpecInterfaceFileRef` object. properties: fileRef: description: The reference to the API definition file. type: string example: example_value type: object RelationAttributes: description: Relation attributes. properties: from: $ref: '#/components/schemas/RelationEntity' to: $ref: '#/components/schemas/RelationEntity' type: $ref: '#/components/schemas/RelationType' type: object CsmAgentsAttributes: description: A CSM Agent returned by the API. properties: agent_version: description: Version of the Datadog Agent. type: string example: example_value aws_fargate: description: AWS Fargate details. type: string example: example_value cluster_name: description: List of cluster names associated with the Agent. items: type: string type: array datadog_agent: description: Unique identifier for the Datadog Agent. type: string example: example_value ecs_fargate_task_arn: description: ARN of the ECS Fargate task. type: string example: example_value envs: description: List of environments associated with the Agent. items: type: string nullable: true type: array host_id: description: ID of the host. format: int64 type: integer example: 42 hostname: description: Name of the host. type: string example: Example Monitor install_method_installer_version: description: Version of the installer used for installing the Datadog Agent. type: string example: example_value install_method_tool: description: Tool used for installing the Datadog Agent. type: string example: example_value is_csm_vm_containers_enabled: description: Indicates if CSM VM Containers is enabled. nullable: true type: boolean example: true is_csm_vm_hosts_enabled: description: Indicates if CSM VM Hosts is enabled. nullable: true type: boolean example: true is_cspm_enabled: description: Indicates if CSPM is enabled. nullable: true type: boolean example: true is_cws_enabled: description: Indicates if CWS is enabled. nullable: true type: boolean example: true is_cws_remote_configuration_enabled: description: Indicates if CWS Remote Configuration is enabled. nullable: true type: boolean example: true is_remote_configuration_enabled: description: Indicates if Remote Configuration is enabled. nullable: true type: boolean example: true os: description: Operating system of the host. type: string example: example_value type: object LogsArchiveOrderAttributes: description: The attributes associated with the archive order. properties: archive_ids: description: 'An ordered array of `` strings, the order of archive IDs in the array define the overall archives order for Datadog.' example: - a2zcMylnM4OCHpYusxIi1g - a2zcMylnM4OCHpYusxIi2g - a2zcMylnM4OCHpYusxIi3g items: description: A given archive ID. type: string type: array required: - archive_ids type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType: description: Indicates that a predefined library pattern is used. enum: - library example: library type: string x-enum-varnames: - LIBRARY Trigger: description: One of the triggers that can start the execution of a workflow. oneOf: - $ref: '#/components/schemas/APITriggerWrapper' - $ref: '#/components/schemas/AppTriggerWrapper' - $ref: '#/components/schemas/CaseTriggerWrapper' - $ref: '#/components/schemas/ChangeEventTriggerWrapper' - $ref: '#/components/schemas/DatabaseMonitoringTriggerWrapper' - $ref: '#/components/schemas/DashboardTriggerWrapper' - $ref: '#/components/schemas/GithubWebhookTriggerWrapper' - $ref: '#/components/schemas/IncidentTriggerWrapper' - $ref: '#/components/schemas/MonitorTriggerWrapper' - $ref: '#/components/schemas/NotebookTriggerWrapper' - $ref: '#/components/schemas/ScheduleTriggerWrapper' - $ref: '#/components/schemas/SecurityTriggerWrapper' - $ref: '#/components/schemas/SelfServiceTriggerWrapper' - $ref: '#/components/schemas/SlackTriggerWrapper' - $ref: '#/components/schemas/SoftwareCatalogTriggerWrapper' - $ref: '#/components/schemas/WorkflowTriggerWrapper' DowntimeResponseAttributes: description: Downtime details. properties: canceled: description: Time that the downtime was canceled. example: 2020-01-02T03:04:05.282979+0000 format: date-time nullable: true type: string created: description: Creation time of the downtime. example: 2020-01-02T03:04:05.282979+0000 format: date-time type: string display_timezone: $ref: '#/components/schemas/DowntimeDisplayTimezone' message: $ref: '#/components/schemas/DowntimeMessage' modified: description: Time that the downtime was last modified. example: 2020-01-02T03:04:05.282979+0000 format: date-time type: string monitor_identifier: $ref: '#/components/schemas/DowntimeMonitorIdentifier' mute_first_recovery_notification: $ref: '#/components/schemas/DowntimeMuteFirstRecoveryNotification' notify_end_states: $ref: '#/components/schemas/DowntimeNotifyEndStates' notify_end_types: $ref: '#/components/schemas/DowntimeNotifyEndTypes' schedule: $ref: '#/components/schemas/DowntimeScheduleResponse' scope: $ref: '#/components/schemas/DowntimeScope' status: $ref: '#/components/schemas/DowntimeStatus' type: object ServiceDefinitionV2SlackType: description: Contact type. enum: - slack example: slack type: string x-enum-varnames: - SLACK ScheduleDataRelationshipsLayers: description: Associates layers with this schedule in a data structure. properties: data: description: An array of layer references for this schedule. items: $ref: '#/components/schemas/ScheduleDataRelationshipsLayersDataItems' type: array type: object ObservabilityPipelineHttpClientSource: description: The `http_client` source scrapes logs from HTTP endpoints at regular intervals. properties: auth_strategy: $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceAuthStrategy' decoding: $ref: '#/components/schemas/ObservabilityPipelineDecoding' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: http-client-source type: string scrape_interval_secs: description: The interval (in seconds) between HTTP scrape requests. example: 60 format: int64 type: integer scrape_timeout_secs: description: The timeout (in seconds) for each scrape request. example: 10 format: int64 type: integer tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceType' required: - id - type - decoding type: object ApplicationKeyResponseIncludedItem: description: An object related to an application key. oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/Role' - $ref: '#/components/schemas/LeakedKey' TeamRoutingRules: description: Represents a complete set of team routing rules, including data and optionally included related resources. example: data: id: 27590dae-47be-4a7d-9abf-8f4e45124020 relationships: rules: data: - id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a type: team_routing_rules - id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a type: team_routing_rules type: team_routing_rules included: - attributes: actions: null query: tags.service:test time_restriction: restrictions: - end_day: monday end_time: '17:00:00' start_day: monday start_time: 09:00:00 - end_day: tuesday end_time: '17:00:00' start_day: tuesday start_time: 09:00:00 time_zone: '' urgency: high id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a relationships: policy: data: null type: team_routing_rules properties: data: $ref: '#/components/schemas/TeamRoutingRulesData' included: description: Provides related routing rules or other included resources. items: $ref: '#/components/schemas/TeamRoutingRulesIncluded' type: array type: object ContainerImageMeta: description: Response metadata object. properties: pagination: $ref: '#/components/schemas/ContainerImageMetaPage' type: object EventPriority: description: The priority of the event's monitor. For example, `normal` or `low`. enum: - normal - low example: normal nullable: true type: string x-enum-varnames: - NORMAL - LOW EscalationPolicyDataType: default: policies description: Indicates that the resource is of type `policies`. enum: - policies example: policies type: string x-enum-varnames: - POLICIES ServiceDefinitionV2Dot2Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Opsgenie' pagerduty: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Pagerduty' type: object ServiceDefinitionMetaWarnings: description: Schema validation warnings. properties: instance-location: description: The warning instance location. type: string example: example_value keyword-location: description: The warning keyword location. type: string example: example_value message: description: The warning message. type: string example: CPU usage is high on {{host.name}} type: object AWSIntegration: description: The definition of `AWSIntegration` object. properties: credentials: $ref: '#/components/schemas/AWSCredentials' type: $ref: '#/components/schemas/AWSIntegrationType' required: - type - credentials type: object SecurityMonitoringRuleOptions: description: Options. properties: complianceRuleOptions: $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions' decreaseCriticalityBasedOnEnv: $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv' detectionMethod: $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod' evaluationWindow: $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow' hardcodedEvaluatorType: $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType' impossibleTravelOptions: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions' keepAlive: $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive' maxSignalDuration: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object LogsArchiveDestinationS3Type: default: s3 description: Type of the S3 archive destination. enum: - s3 example: s3 type: string x-enum-varnames: - S3 OrgConfigRead: description: A single Org Config. properties: attributes: $ref: '#/components/schemas/OrgConfigReadAttributes' id: description: A unique identifier for an Org Config. example: abcd1234 type: string type: $ref: '#/components/schemas/OrgConfigType' required: - id - type - attributes type: object IncidentAttachmentLinkAttributesAttachmentObject: description: The link attachment. properties: documentUrl: description: The URL of this link attachment. example: https://www.example.com/webstore-failure-runbook type: string title: description: The title of this link attachment. example: Runbook for webstore service failures type: string required: - documentUrl - title type: object ConnectionGroup: description: The definition of `ConnectionGroup` object. properties: connectionGroupId: description: The `ConnectionGroup` `connectionGroupId`. example: '' type: string label: description: The `ConnectionGroup` `label`. example: '' type: string tags: description: The `ConnectionGroup` `tags`. example: - '' items: type: string type: array required: - connectionGroupId - label - tags type: object RoleResponse: description: Response containing information about a single role. properties: data: $ref: '#/components/schemas/Role' type: object ComponentGrid: description: A grid component. The grid component is the root canvas for an app and contains all other components. properties: events: description: Events to listen for on the grid component. items: $ref: '#/components/schemas/AppBuilderEvent' type: array id: description: The ID of the grid component. This property is deprecated; use `name` to identify individual components instead. type: string example: abc-123-def name: description: A unique identifier for this grid component. This name is also visible in the app editor. example: '' type: string properties: $ref: '#/components/schemas/ComponentGridProperties' type: $ref: '#/components/schemas/ComponentGridType' required: - name - type - properties type: object ScheduleMember: description: Represents a single member entry in a schedule, referencing a specific user. properties: id: description: The unique identifier for this schedule member. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ScheduleMemberRelationships' type: $ref: '#/components/schemas/ScheduleMemberType' required: - type type: object IPAllowlistData: description: IP allowlist data. properties: attributes: $ref: '#/components/schemas/IPAllowlistAttributes' id: description: The unique identifier of the org. type: string example: abc-123-def type: $ref: '#/components/schemas/IPAllowlistType' required: - type type: object HistoricalJobDataType: description: Type of payload. enum: - historicalDetectionsJob type: string x-enum-varnames: - HISTORICALDETECTIONSJOB ApplicationKeyRelationships: description: Resources related to the application key. properties: owned_by: $ref: '#/components/schemas/RelationshipToUser' type: object x-merge-override: properties: false LeakedKey: description: The definition of LeakedKey object. properties: attributes: $ref: '#/components/schemas/LeakedKeyAttributes' id: description: The LeakedKey id. example: id type: string type: $ref: '#/components/schemas/LeakedKeyType' required: - attributes - id - type type: object MonitorConfigPolicyResponse: description: Response for retrieving a monitor configuration policy. properties: data: $ref: '#/components/schemas/MonitorConfigPolicyResponseData' type: object ShiftData: description: The definition of `ShiftData` object. properties: attributes: $ref: '#/components/schemas/ShiftDataAttributes' id: description: The `ShiftData` `id`. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ShiftDataRelationships' type: $ref: '#/components/schemas/ShiftDataType' required: - type type: object ObservabilityPipelineAddEnvVarsProcessorType: default: add_env_vars description: The processor type. The value should always be `add_env_vars`. enum: - add_env_vars example: add_env_vars type: string x-enum-varnames: - ADD_ENV_VARS ApplicationSecurityWafExclusionFilterResource: description: A JSON:API resource for an WAF exclusion filter. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterAttributes' id: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterID' type: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType' type: object DowntimeRelationshipsCreatedBy: description: The user who created the downtime. properties: data: $ref: '#/components/schemas/DowntimeRelationshipsCreatedByData' type: object ObservabilityPipelineGeneratedMetricIncrementByOneStrategy: description: Increments the metric by 1 for each matching event. enum: - increment_by_one example: increment_by_one type: string x-enum-varnames: - INCREMENT_BY_ONE SecurityMonitoringSuppressionType: default: suppressions description: The type of the resource. The value should always be `suppressions`. enum: - suppressions example: suppressions type: string x-enum-varnames: - SUPPRESSIONS ObservabilityPipelineSyslogNgSource: description: The `syslog_ng` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: syslog-ng-source type: string mode: $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSourceType' required: - id - type - mode type: object SecurityMonitoringSuppressionAttributes: description: The attributes of the suppression rule. properties: creation_date: description: A Unix millisecond timestamp given the creation date of the suppression rule. format: int64 type: integer example: 42 creator: $ref: '#/components/schemas/SecurityMonitoringUser' data_exclusion_query: description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. example: source:cloudtrail account_id:12345 type: string description: description: A description for the suppression rule. example: This rule suppresses low-severity signals in staging environments. type: string editable: description: Whether the suppression rule is editable. example: true type: boolean enabled: description: Whether the suppression rule is enabled. example: true type: boolean expiration_date: description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. example: 1703187336000 format: int64 type: integer name: description: The name of the suppression rule. example: Custom suppression type: string rule_query: description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules. example: type:log_detection source:cloudtrail type: string start_date: description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. example: 1703187336000 format: int64 type: integer suppression_query: description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer. example: env:staging status:low type: string update_date: description: A Unix millisecond timestamp given the update date of the suppression rule. format: int64 type: integer example: 42 updater: $ref: '#/components/schemas/SecurityMonitoringUser' version: description: The version of the suppression rule; it starts at 1, and is incremented at each update. example: 42 format: int32 maximum: 2147483647 type: integer type: object CloudWorkloadSecurityAgentPolicyData: description: Object for a single Agent policy properties: attributes: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyAttributes' id: description: The ID of the Agent policy example: 6517fcc1-cec7-4394-a655-8d6e9d085255 type: string type: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyType' type: object RelationshipToUserTeamTeam: description: Relationship between team membership and team properties: data: $ref: '#/components/schemas/RelationshipToUserTeamTeamData' required: - data type: object RUMEventType: default: rum description: Type of the event. enum: - rum example: rum type: string x-enum-varnames: - RUM RetryStrategyLinear: description: The definition of `RetryStrategyLinear` object. properties: interval: description: The `RetryStrategyLinear` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s example: '' type: string maxRetries: description: The `RetryStrategyLinear` `maxRetries`. example: 0 format: double type: number required: - interval - maxRetries type: object RumMetricResponseAttributes: description: The object describing a Datadog rum-based metric. properties: compute: $ref: '#/components/schemas/RumMetricResponseCompute' event_type: $ref: '#/components/schemas/RumMetricEventType' filter: $ref: '#/components/schemas/RumMetricResponseFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/RumMetricResponseGroupBy' type: array uniqueness: $ref: '#/components/schemas/RumMetricResponseUniqueness' type: object MetricMetaPageType: default: cursor_limit description: Type of metric pagination. enum: - cursor_limit example: cursor_limit type: string x-enum-varnames: - CURSOR_LIMIT GetDeviceData: description: Get device response data. properties: attributes: $ref: '#/components/schemas/GetDeviceAttributes' id: description: The device ID example: example:1.2.3.4 type: string type: description: The type of the resource. The value should always be device. type: string example: metric alert type: object RumRetentionFilterSampleRate: description: The sample rate for a RUM retention filter, between 0 and 100. example: 25 format: int64 maximum: 100 minimum: 0 type: integer CompletionCondition: description: The definition of `CompletionCondition` object. properties: operand1: description: The `CompletionCondition` `operand1`. example: example_value operand2: description: The `CompletionCondition` `operand2`. example: example_value operator: $ref: '#/components/schemas/CompletionConditionOperator' required: - operand1 - operator type: object ServiceDefinitionV2Dot1OpsgenieRegion: description: Opsgenie instance region. enum: - US - EU example: US type: string x-enum-varnames: - US - EU ProjectRelationship: description: Relationship to project properties: data: $ref: '#/components/schemas/ProjectRelationshipData' required: - data type: object RumRetentionFilterID: description: ID of retention filter in UUID. example: 051601eb-54a0-abc0-03f9-cc02efa18892 type: string IncidentTeamResponse: description: Response with an incident team payload. properties: data: $ref: '#/components/schemas/IncidentTeamResponseData' included: description: Included objects from relationships. items: $ref: '#/components/schemas/IncidentTeamIncludedItems' readOnly: true type: array required: - data type: object ObservabilityPipelineSensitiveDataScannerProcessorScope: description: Determines which parts of the log the pattern-matching rule should be applied to. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAll' UrlParam: description: The definition of `UrlParam` object. properties: name: $ref: '#/components/schemas/TokenName' example: MyUrlParameter value: description: The `UrlParam` `value`. example: Some Url Parameter value type: string required: - name - value type: object OpsgenieServiceResponseData: description: Opsgenie service data from a response. properties: attributes: $ref: '#/components/schemas/OpsgenieServiceResponseAttributes' id: description: The ID of the Opsgenie service. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/OpsgenieServiceType' required: - id - type - attributes type: object x-merge-override: required: false ApplicationSecurityWafCustomRuleAttributes: description: A WAF custom rule. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction' blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger.' items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition' type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean metadata: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleMetadata' name: description: The Name of the WAF custom rule. example: Block request from bad useragent type: string path_glob: description: The path glob for the WAF custom rule. example: /api/search/* type: string scope: description: The scope of the WAF custom rule. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope' type: array tags: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags' required: - enabled - blocking - name - tags - conditions type: object ObservabilityPipelineParseJSONProcessorType: default: parse_json description: The processor type. The value should always be `parse_json`. enum: - parse_json example: parse_json type: string x-enum-varnames: - PARSE_JSON AwsScanOptionsListResponse: description: Response object that includes a list of AWS scan options. properties: data: description: A list of AWS scan options. items: $ref: '#/components/schemas/AwsScanOptionsData' type: array type: object RuleUser: description: User creating or modifying a rule. properties: handle: description: The user handle. example: john.doe@domain.com type: string name: description: The user name. example: John Doe type: string type: object MetricName: description: The metric name for this resource. example: test.metric.latency type: string SAMLAssertionAttributesType: default: saml_assertion_attributes description: SAML assertion attributes resource type. enum: - saml_assertion_attributes example: saml_assertion_attributes type: string x-enum-varnames: - SAML_ASSERTION_ATTRIBUTES ServiceDefinitionV2Dot2Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: '#/components/schemas/ServiceDefinitionV2Dot2OpsgenieRegion' service-url: description: Opsgenie service url. example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 type: string required: - service-url type: object HourlyUsageAttributes: description: Attributes of hourly usage for a product family for an org for a time period. properties: account_name: description: The account name. type: string example: Example Monitor account_public_id: description: The account public ID. type: string example: abc-123-def measurements: description: List of the measured usage values for the product family for the org for the time period. items: $ref: '#/components/schemas/HourlyUsageMeasurement' type: array org_name: description: The organization name. type: string example: Example Monitor product_family: description: The product for which usage is being reported. type: string example: example_value public_id: description: The organization public ID. type: string example: abc-123-def region: description: The region of the Datadog instance that the organization belongs to. type: string example: example_value timestamp: description: Datetime in ISO-8601 format, UTC. The hour for the usage. format: date-time type: string example: '2026-04-17T12:00:00Z' type: object RelationshipToRoles: description: Relationship to roles. properties: data: description: An array containing type and the unique identifier of a role. items: $ref: '#/components/schemas/RelationshipToRoleData' type: array type: object x-merge-override: required: false NotebookTriggerWrapper: description: Schema for a Notebook-based trigger. properties: notebookTrigger: description: Trigger a workflow from a Notebook. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - notebookTrigger type: object LogAttributes: description: JSON object containing all log attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from your log. example: customAttribute: 123 duration: 2345 type: object host: description: Name of the machine from where the logs are being sent. example: i-0123 type: string message: description: 'The message [reserved attribute](https://docs.datadoghq.com/logs/log_collection/#reserved-attributes) of your log. By default, Datadog ingests the value of the message attribute as the body of the log entry. That value is then highlighted and displayed in the Logstream, where it is indexed for full text search.' example: Host connected to remote type: string service: description: 'The name of the application or service generating the log events. It is used to switch from Logs to APM, so make sure you define the same value when you use both products.' example: agent type: string status: description: Status of the message associated with your log. example: INFO type: string tags: description: Array of tags associated with your log. example: - team:A items: description: Tag associated with your log. type: string type: array timestamp: description: Timestamp of your log. example: '2019-01-02T09:42:36.320Z' format: date-time type: string type: object TeamPermissionSettingAttributes: description: Team permission setting attributes properties: action: $ref: '#/components/schemas/TeamPermissionSettingSerializerAction' editable: description: Whether or not the permission setting is editable by the current user readOnly: true type: boolean example: true options: $ref: '#/components/schemas/TeamPermissionSettingValues' title: description: The team permission name readOnly: true type: string example: Example Monitor value: $ref: '#/components/schemas/TeamPermissionSettingValue' type: object EntityV3SystemKind: description: The definition of Entity V3 System Kind object. enum: - system example: system type: string x-enum-varnames: - SYSTEM ObservabilityPipelineSyslogNgSourceType: default: syslog_ng description: The source type. The value should always be `syslog_ng`. enum: - syslog_ng example: syslog_ng type: string x-enum-varnames: - SYSLOG_NG SecurityMonitoringRuleCaseAction: description: Action to perform when a signal is triggered. Only available for Application Security rule type. properties: options: $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions' type: $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType' type: object SingleAggregatedConnectionResponseDataType: default: aggregated_connection description: Aggregated connection resource type. enum: - aggregated_connection type: string x-enum-varnames: - AGGREGATED_CONNECTION ObservabilityPipelineGenerateMetricsProcessorType: default: generate_datadog_metrics description: The processor type. Always `generate_datadog_metrics`. enum: - generate_datadog_metrics example: generate_datadog_metrics type: string x-enum-varnames: - GENERATE_DATADOG_METRICS ScheduleMemberType: default: members description: Schedule Members resource type. enum: - members example: members type: string x-enum-varnames: - MEMBERS ObservabilityPipelineParseGrokProcessorRuleSupportRule: description: The Grok helper rule referenced in the parsing rules. properties: name: description: The name of the Grok helper rule. example: user type: string rule: description: The definition of the Grok helper rule. example: ' %{word:user.name}' type: string required: - name - rule type: object SecurityMonitoringRuleCase: description: Case when signal is generated. properties: actions: description: Action to perform for each rule case. items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction' type: array condition: description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.' type: string example: example_value name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' type: object IncidentAttachmentPostmortemAttachmentType: default: postmortem description: The type of postmortem attachment attributes. enum: - postmortem example: postmortem type: string x-enum-varnames: - POSTMORTEM EntityV3QueueKind: description: The definition of Entity V3 Queue Kind object. enum: - queue example: queue type: string x-enum-varnames: - QUEUE ObservabilityPipelineSplunkTcpSourceType: default: splunk_tcp description: The source type. Always `splunk_tcp`. enum: - splunk_tcp example: splunk_tcp type: string x-enum-varnames: - SPLUNK_TCP DORAListResponse: description: Response for the DORA list endpoints. properties: data: description: The list of DORA events. items: $ref: '#/components/schemas/DORAEvent' type: array type: object EscalationPolicyDataRelationshipsStepsDataItems: description: Defines a relationship to a single step within an escalation policy. Contains the step's `id` and `type`. properties: id: description: Specifies the unique identifier for the step resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItemsType' required: - type - id type: object LogsArchiveEncryptionS3Type: description: Type of S3 encryption for a destination. enum: - NO_OVERRIDE - SSE_S3 - SSE_KMS example: SSE_S3 type: string x-enum-varnames: - NO_OVERRIDE - SSE_S3 - SSE_KMS LogsArchives: description: The available archives. properties: data: description: A list of archives. items: $ref: '#/components/schemas/LogsArchiveDefinition' type: array type: object SpansMetricType: default: spans_metrics description: The type of resource. The value should always be spans_metrics. enum: - spans_metrics example: spans_metrics type: string x-enum-varnames: - SPANS_METRICS RolesType: default: roles description: Roles type. enum: - roles example: roles type: string x-enum-varnames: - ROLES MetricCustomTimeAggregation: description: A time aggregation for use in query. enum: - avg - count - max - min - sum example: sum type: string x-enum-varnames: - AVG - COUNT - MAX - MIN - SUM ObservabilityPipelineKafkaSourceType: default: kafka description: The source type. The value should always be `kafka`. enum: - kafka example: kafka type: string x-enum-varnames: - KAFKA ProcessSummariesMetaPage: description: Paging attributes. properties: after: description: 'The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.' example: 911abf1204838d9cdfcb9a96d0b6a1bd03e1b514074f1ce1737c4cbd type: string size: description: Number of results returned. format: int32 maximum: 10000 minimum: 0 type: integer example: 42 type: object ObservabilityPipelineConfig: description: Specifies the pipeline's configuration, including its sources, processors, and destinations. properties: destinations: description: A list of destination components where processed logs are sent. example: - id: datadog-logs-destination inputs: - filter-processor type: datadog_logs items: $ref: '#/components/schemas/ObservabilityPipelineConfigDestinationItem' type: array processors: description: A list of processors that transform or enrich log data. example: - id: filter-processor include: service:my-service inputs: - datadog-agent-source type: filter items: $ref: '#/components/schemas/ObservabilityPipelineConfigProcessorItem' type: array sources: description: A list of configured data sources for the pipeline. example: - id: datadog-agent-source type: datadog_agent items: $ref: '#/components/schemas/ObservabilityPipelineConfigSourceItem' type: array required: - sources - destinations type: object RelationMeta: description: Relation metadata. properties: createdAt: description: Relation creation time. format: date-time type: string example: example_value definedBy: description: Relation defined by. type: string example: example_value modifiedAt: description: Relation modification time. format: date-time type: string example: example_value source: description: Relation source. type: string example: example_value type: object RUMEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from RUM events. example: customAttribute: 123 duration: 2345 type: object service: description: 'The name of the application or service generating RUM events. It is used to switch from RUM to APM, so make sure you define the same value when you use both products.' example: web-app type: string tags: description: Array of tags associated with your event. example: - team:A items: description: Tag associated with your event. type: string type: array timestamp: description: Timestamp of your event. example: '2019-01-02T09:42:36.320Z' format: date-time type: string type: object UsersType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS ServiceDefinitionV1Org: description: Org related information about the service. properties: application: description: App feature this service supports. example: E-Commerce type: string team: description: Team that owns the service. example: my-team type: string type: object StartStepNames: description: A list of steps that run first after a trigger fires. example: - '' items: description: The `StartStepNames` `items`. type: string type: array TeamOnCallRespondersDataRelationships: description: Relationship objects linked to a team's on-call responder configuration, including escalations and responders. properties: escalations: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationshipsEscalations' responders: $ref: '#/components/schemas/TeamOnCallRespondersDataRelationshipsResponders' type: object EntityToRawSchema: description: Entity to raw schema relationship. properties: data: $ref: '#/components/schemas/RelationshipItem' type: object ContainersResponse: description: List of containers. properties: data: description: Array of Container objects. items: $ref: '#/components/schemas/ContainerItem' type: array links: $ref: '#/components/schemas/ContainersResponseLinks' meta: $ref: '#/components/schemas/ContainerMeta' type: object CostAttributionType: default: cost_by_tag description: Type of cost attribution data. enum: - cost_by_tag example: cost_by_tag type: string x-enum-varnames: - COST_BY_TAG ContainerItem: description: Possible Container models. oneOf: - $ref: '#/components/schemas/Container' - $ref: '#/components/schemas/ContainerGroup' ContainerImage: description: Container Image object. properties: attributes: $ref: '#/components/schemas/ContainerImageAttributes' id: description: Container Image ID. type: string example: abc-123-def type: $ref: '#/components/schemas/ContainerImageType' type: object UserRelationshipData: description: Relationship to user object. properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UserResourceType' required: - id - type type: object SpansMetricResponseAttributes: description: The object describing a Datadog span-based metric. properties: compute: $ref: '#/components/schemas/SpansMetricResponseCompute' filter: $ref: '#/components/schemas/SpansMetricResponseFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/SpansMetricResponseGroupBy' type: array type: object RumRetentionFilterAttributes: description: The object describing attributes of a RUM retention filter. properties: enabled: $ref: '#/components/schemas/RumRetentionFilterEnabled' event_type: $ref: '#/components/schemas/RumRetentionFilterEventType' name: $ref: '#/components/schemas/RunRetentionFilterName' query: $ref: '#/components/schemas/RumRetentionFilterQuery' sample_rate: $ref: '#/components/schemas/RumRetentionFilterSampleRate' type: object RestrictionPolicyResponse: description: Response containing information about a single restriction policy. properties: data: $ref: '#/components/schemas/RestrictionPolicy' required: - data type: object IncidentIntegrationMetadataResponseIncludedItem: description: An object related to an incident integration metadata that is included in the response. oneOf: - $ref: '#/components/schemas/User' GetInterfacesData: description: The interfaces list data properties: attributes: $ref: '#/components/schemas/InterfaceAttributes' id: description: The interface ID example: example:1.2.3.4:99 type: string type: description: The type of the resource. The value should always be interface. type: string example: metric alert type: object GithubWebhookTriggerWrapper: description: Schema for a GitHub webhook-based trigger. properties: githubWebhookTrigger: $ref: '#/components/schemas/GithubWebhookTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - githubWebhookTrigger type: object MetricTagConfigurationMetricTypes: default: gauge description: The metric's type. enum: - gauge - count - rate - distribution example: count type: string x-enum-varnames: - GAUGE - COUNT - RATE - DISTRIBUTION Container: description: Container object. properties: attributes: $ref: '#/components/schemas/ContainerAttributes' id: description: Container ID. type: string example: abc-123-def type: $ref: '#/components/schemas/ContainerType' type: object TeamLinkResponse: description: Team link response properties: data: $ref: '#/components/schemas/TeamLink' type: object GetRuleVersionHistoryDataType: description: Type of data. enum: - GetRuleVersionHistoryResponse type: string x-enum-varnames: - GETRULEVERSIONHISTORYRESPONSE DomainAllowlistResponseDataAttributes: description: The details of the email domain allowlist. properties: domains: description: The list of domains in the email domain allowlist. items: type: string type: array enabled: description: Whether the email domain allowlist is enabled for the org. type: boolean example: true type: object x-ignore-duplicate-object: true EntityV3API: additionalProperties: false description: Schema for API entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3APIDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3APIKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3APISpec' required: - apiVersion - kind - metadata type: object HourlyUsageType: description: Usage type that is being measured. enum: - app_sec_host_count - observability_pipelines_bytes_processed - lambda_traced_invocations_count example: observability_pipelines_bytes_processed type: string x-enum-varnames: - APP_SEC_HOST_COUNT - OBSERVABILITY_PIPELINES_BYTES_PROCESSSED - LAMBDA_TRACED_INVOCATIONS_COUNT TimeRestriction: description: Defines a single time restriction rule with start and end times and the applicable weekdays. properties: end_day: $ref: '#/components/schemas/Weekday' end_time: description: Specifies the ending time for this restriction. type: string example: '2026-04-17T12:00:00Z' start_day: $ref: '#/components/schemas/Weekday' start_time: description: Specifies the starting time for this restriction. type: string example: '2026-04-17T12:00:00Z' type: object ApplicationSecurityWafCustomRuleActionAction: default: block_request description: Override the default action to take when the WAF custom rule would block. enum: - redirect_request - block_request example: block_request type: string x-enum-varnames: - REDIRECT_REQUEST - BLOCK_REQUEST EntityV3SystemSpec: additionalProperties: false description: The definition of Entity V3 System Spec object. properties: components: description: A list of components belongs to the system. items: type: string type: array lifecycle: description: The lifecycle state of the component. minLength: 1 type: string example: example_value tier: description: An entity reference to the owner of the component. minLength: 1 type: string example: example_value type: object ScheduleDataIncludedItem: description: Any additional resources related to this schedule, such as teams and layers. oneOf: - $ref: '#/components/schemas/TeamReference' - $ref: '#/components/schemas/Layer' - $ref: '#/components/schemas/ScheduleMember' - $ref: '#/components/schemas/ScheduleUser' ObservabilityPipelineGoogleCloudStorageDestinationAcl: description: Access control list setting for objects written to the bucket. enum: - private - project-private - public-read - authenticated-read - bucket-owner-read - bucket-owner-full-control example: private type: string x-enum-varnames: - PRIVATE - PROJECTNOT_PRIVATE - PUBLICNOT_READ - AUTHENTICATEDNOT_READ - BUCKETNOT_OWNERNOT_READ - BUCKETNOT_OWNERNOT_FULLNOT_CONTROL LogsArchiveAttributes: description: The attributes associated with the archive. properties: destination: $ref: '#/components/schemas/LogsArchiveDestination' include_tags: default: false description: 'To store the tags in the archive, set the value "true". If it is set to "false", the tags will be deleted when the logs are sent to the archive.' example: false type: boolean name: description: The archive name. example: Nginx Archive type: string query: description: The archive query/filter. Logs matching this query are included in the archive. example: source:nginx type: string rehydration_max_scan_size_in_gb: description: Maximum scan size for rehydration from this archive. example: 100 format: int64 nullable: true type: integer rehydration_tags: description: An array of tags to add to rehydrated logs from an archive. example: - team:intake - team:app items: description: A given tag in the `:` format. type: string type: array state: $ref: '#/components/schemas/LogsArchiveState' required: - name - query - destination type: object ObservabilityPipelineGoogleChronicleDestinationType: default: google_chronicle description: The destination type. The value should always be `google_chronicle`. enum: - google_chronicle example: google_chronicle type: string x-enum-varnames: - GOOGLE_CHRONICLE ObservabilityPipelineAmazonS3DestinationType: default: amazon_s3 description: The destination type. Always `amazon_s3`. enum: - amazon_s3 example: amazon_s3 type: string x-enum-varnames: - AMAZON_S3 ObservabilityPipelineGoogleChronicleDestinationEncoding: description: The encoding format for the logs sent to Chronicle. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE NotificationRulesType: description: The rule type associated to notification rules. enum: - notification_rules example: notification_rules type: string x-enum-varnames: - NOTIFICATION_RULES RelationshipToIncidentUserDefinedFieldData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the responder. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/IncidentUserDefinedFieldType' required: - id - type type: object x-merge-override: required: false FindingID: description: The unique ID for this finding. example: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: string ObservabilityPipelineFilterProcessorType: default: filter description: The processor type. The value should always be `filter`. enum: - filter example: filter type: string x-enum-varnames: - FILTER SecurityMonitoringThirdPartyRuleCaseCreate: description: Case when a signal is generated by a third party rule. properties: name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets for each case. items: description: Notification. type: string type: array query: description: A query to map a third party event to this case. type: string example: avg:system.cpu.user{*} status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' required: - status type: object FindingMuteReason: description: The reason why this finding is muted or unmuted. enum: - PENDING_FIX - FALSE_POSITIVE - ACCEPTED_RISK - NO_PENDING_FIX - HUMAN_ERROR - NO_LONGER_ACCEPTED_RISK - OTHER example: ACCEPTED_RISK type: string x-enum-varnames: - PENDING_FIX - FALSE_POSITIVE - ACCEPTED_RISK - NO_PENDING_FIX - HUMAN_ERROR - NO_LONGER_ACCEPTED_RISK - OTHER MicrosoftTeamsTenantBasedHandleAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: fake-channel-id maxLength: 255 type: string name: description: Tenant-based handle name. example: fake-handle-name maxLength: 255 type: string team_id: description: Team id. example: 00000000-0000-0000-0000-000000000000 maxLength: 255 type: string tenant_id: description: Tenant id. example: 00000000-0000-0000-0000-000000000001 maxLength: 255 type: string type: object x-merge-override: required: false ApplicationSecurityWafExclusionFilterRulesTargetTags: additionalProperties: type: string description: Target multiple WAF rules based on their tags. properties: category: description: The category of the targeted WAF rules. example: attack_attempt type: string type: description: The type of the targeted WAF rules. example: lfi type: string type: object ActiveBillingDimensionsBody: description: Active billing dimensions data. properties: attributes: $ref: '#/components/schemas/ActiveBillingDimensionsAttributes' id: description: Unique ID of the response. type: string example: abc-123-def type: $ref: '#/components/schemas/ActiveBillingDimensionsType' type: object ObservabilityPipelineParseGrokProcessorRule: description: 'A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields from a specific log field using Grok patterns. ' properties: match_rules: description: 'A list of Grok parsing rules that define how to extract fields from the source field. Each rule must contain a name and a valid Grok pattern. ' example: - name: MyParsingRule rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' items: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule' type: array source: description: The name of the field in the log event to apply the Grok rules to. example: message type: string support_rules: description: 'A list of Grok helper rules that can be referenced by the parsing rules. ' example: - name: user rule: '%{word:user.name}' items: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule' type: array required: - source - match_rules - support_rules type: object CustomDestinationResponse: description: The custom destination. properties: data: $ref: '#/components/schemas/CustomDestinationResponseDefinition' type: object ServiceNowTicketResult: description: ServiceNow ticket information properties: sys_target_link: description: Link to the Incident created on ServiceNow type: string example: example_value type: object ProjectedCost: description: Projected Cost data. properties: attributes: $ref: '#/components/schemas/ProjectedCostAttributes' id: description: Unique ID of the response. type: string example: abc-123-def type: $ref: '#/components/schemas/ProjectedCostType' type: object MonitorNotificationRuleName: description: The name of the monitor notification rule. example: A notification rule name maxLength: 1000 minLength: 1 type: string DetailedFindingAttributes: description: The JSON:API attributes of the detailed finding. properties: evaluation: $ref: '#/components/schemas/FindingEvaluation' evaluation_changed_at: $ref: '#/components/schemas/FindingEvaluationChangedAt' message: description: The remediation message for this finding. example: '## Remediation ### From the console 1. Go to Storage Account 2. For each Storage Account, navigate to Data Protection 3. Select Set soft delete enabled and enter the number of days to retain soft deleted data.' type: string mute: $ref: '#/components/schemas/FindingMute' resource: $ref: '#/components/schemas/FindingResource' resource_configuration: description: The resource configuration for this finding. type: object resource_discovery_date: $ref: '#/components/schemas/FindingResourceDiscoveryDate' resource_type: $ref: '#/components/schemas/FindingResourceType' rule: $ref: '#/components/schemas/FindingRule' status: $ref: '#/components/schemas/FindingStatus' tags: $ref: '#/components/schemas/FindingTags' type: object ObservabilityPipelineNewRelicDestinationRegion: description: The New Relic region. enum: - us - eu example: us type: string x-enum-varnames: - US - EU DowntimeResponseData: description: Downtime data. properties: attributes: $ref: '#/components/schemas/DowntimeResponseAttributes' id: description: The downtime ID. example: 00000000-0000-1234-0000-000000000000 type: string relationships: $ref: '#/components/schemas/DowntimeRelationships' type: $ref: '#/components/schemas/DowntimeResourceType' type: object EventsWarning: description: A warning message indicating something is wrong with the query. properties: code: description: A unique code for this type of warning. example: unknown_index type: string detail: description: A detailed explanation of this specific warning. example: 'indexes: foo, bar' type: string title: description: A short human-readable summary of the warning. example: One or several indexes are missing or invalid. Results hold data from the other indexes. type: string type: object IncidentIntegrationMetadataMetadata: description: Incident integration metadata's metadata attribute. oneOf: - $ref: '#/components/schemas/SlackIntegrationMetadata' - $ref: '#/components/schemas/JiraIntegrationMetadata' - $ref: '#/components/schemas/MSTeamsIntegrationMetadata' RestrictionQueryRoleAttribute: description: Attributes of the role for a restriction query. properties: name: description: The role name. example: Datadog Admin Role type: string type: object SpansListResponse: description: Response object with all spans matching the request and pagination information. properties: data: description: Array of spans matching the request. items: $ref: '#/components/schemas/Span' type: array links: $ref: '#/components/schemas/SpansListResponseLinks' meta: $ref: '#/components/schemas/SpansListResponseMetadata' type: object ContainerMeta: description: Response metadata object. properties: pagination: $ref: '#/components/schemas/ContainerMetaPage' type: object ScheduleTargetType: default: schedules description: Indicates that the resource is of type `schedules`. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ActionQuerySpecObject: description: The action query spec object. properties: connectionGroup: $ref: '#/components/schemas/ActionQuerySpecConnectionGroup' connectionId: description: The ID of the custom connection to use for this action query. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: string fqn: description: The fully qualified name of the action type. example: com.datadoghq.http.request type: string inputs: $ref: '#/components/schemas/ActionQuerySpecInputs' required: - fqn type: object ServiceDefinitionV2Dot2OpsgenieRegion: description: Opsgenie instance region. enum: - US - EU example: US type: string x-enum-varnames: - US - EU HTTPTokenAuth: description: The definition of `HTTPTokenAuth` object. properties: body: $ref: '#/components/schemas/HTTPBody' headers: description: The `HTTPTokenAuth` `headers`. items: $ref: '#/components/schemas/HTTPHeader' type: array tokens: description: The `HTTPTokenAuth` `tokens`. items: $ref: '#/components/schemas/HTTPToken' type: array type: $ref: '#/components/schemas/HTTPTokenAuthType' url_parameters: description: The `HTTPTokenAuth` `url_parameters`. items: $ref: '#/components/schemas/UrlParam' type: array required: - type type: object ServiceDefinitionV2Slack: description: Service owner's Slack channel. properties: contact: description: Slack Channel. example: https://yourcompany.slack.com/archives/channel123 type: string name: description: Contact Slack. example: Team Slack type: string type: $ref: '#/components/schemas/ServiceDefinitionV2SlackType' required: - type - contact type: object SecurityMonitoringRuleCaseCreate: description: Case when signal is generated. properties: actions: description: Action to perform for each rule case. items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction' type: array condition: description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.' type: string example: example_value name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets. items: description: Notification. type: string type: array status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' required: - status type: object RelationType: description: Supported relation types. enum: - RelationTypeOwns - RelationTypeOwnedBy - RelationTypeDependsOn - RelationTypeDependencyOf - RelationTypePartsOf - RelationTypeHasPart - RelationTypeOtherOwns - RelationTypeOtherOwnedBy - RelationTypeImplementedBy - RelationTypeImplements type: string x-enum-varnames: - RELATIONTYPEOWNS - RELATIONTYPEOWNEDBY - RELATIONTYPEDEPENDSON - RELATIONTYPEDEPENDENCYOF - RELATIONTYPEPARTSOF - RELATIONTYPEHASPART - RELATIONTYPEOTHEROWNS - RELATIONTYPEOTHEROWNEDBY - RELATIONTYPEIMPLEMENTEDBY - RELATIONTYPEIMPLEMENTS TagsEventAttribute: description: Array of tags associated with your event. example: - team:A items: description: Tag associated with your event. type: string type: array RumMetricUniquenessWhen: description: When to count updatable events. `match` when the event is first seen, or `end` when the event is complete. enum: - match - end example: match type: string x-enum-varnames: - WHEN_MATCH - WHEN_END RelationResponseData: description: Array of relation responses items: $ref: '#/components/schemas/RelationResponse' type: array LogsMetricResponseCompute: description: The compute rule to compute the log-based metric. properties: aggregation_type: $ref: '#/components/schemas/LogsMetricResponseComputeAggregationType' include_percentiles: $ref: '#/components/schemas/LogsMetricComputeIncludePercentiles' path: description: The path to the value the log-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: '@duration' type: string type: object InputSchemaParametersType: description: The definition of `InputSchemaParametersType` object. enum: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT example: STRING type: string x-enum-varnames: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT ApplicationSecurityWafExclusionFilterAttributes: description: Attributes describing a WAF exclusion filter. properties: description: description: A description for the exclusion filter. example: Exclude false positives on a path type: string enabled: description: Indicates whether the exclusion filter is enabled. example: true type: boolean event_query: description: The event query matched by the legacy exclusion filter. Cannot be created nor updated. type: string example: avg:system.cpu.user{*} ip_list: description: The client IP addresses matched by the exclusion filter (CIDR notation is supported). items: example: 198.51.100.72 type: string type: array metadata: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterMetadata' on_match: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch' parameters: description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character. items: example: list.search.query type: string type: array path_glob: description: The HTTP path glob expression matched by the exclusion filter. example: /accounts/* type: string rules_target: description: The WAF rules targeted by the exclusion filter. items: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget' type: array scope: description: The services where the exclusion filter is deployed. items: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterScope' type: array search_query: description: Generated event search query for traces matching the exclusion filter. readOnly: true type: string example: avg:system.cpu.user{*} type: object PowerpacksResponseMetaPagination: description: Powerpack response pagination metadata. properties: first_offset: description: The first offset. format: int64 type: integer example: 42 last_offset: description: The last offset. format: int64 nullable: true type: integer example: 42 limit: description: Pagination limit. format: int64 type: integer example: 42 next_offset: description: The next offset. format: int64 type: integer example: 42 offset: description: The offset. format: int64 type: integer example: 42 prev_offset: description: The previous offset. format: int64 type: integer example: 42 total: description: Total results. format: int64 type: integer example: 42 type: description: Offset type. type: string example: metric alert type: object ApplicationSecurityWafExclusionFilterMetadata: description: Extra information about the exclusion filter. properties: added_at: description: The creation date of the exclusion filter. format: date-time type: string example: example_value added_by: description: The handle of the user who created the exclusion filter. type: string example: example_value added_by_name: description: The name of the user who created the exclusion filter. type: string example: Example Monitor modified_at: description: The last modification date of the exclusion filter. format: date-time type: string example: example_value modified_by: description: The handle of the user who last modified the exclusion filter. type: string example: example_value modified_by_name: description: The name of the user who last modified the exclusion filter. type: string example: Example Monitor readOnly: true type: object Span: description: Object description of a spans after being processed and stored by Datadog. properties: attributes: $ref: '#/components/schemas/SpansAttributes' id: description: Unique ID of the Span. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: '#/components/schemas/SpansType' type: object ScheduleData: description: Represents the primary data object for a schedule, linking attributes and relationships. properties: attributes: $ref: '#/components/schemas/ScheduleDataAttributes' id: description: The schedule's unique identifier. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string relationships: $ref: '#/components/schemas/ScheduleDataRelationships' type: $ref: '#/components/schemas/ScheduleDataType' required: - type type: object Organization: description: Organization object. properties: attributes: $ref: '#/components/schemas/OrganizationAttributes' id: description: ID of the organization. type: string example: abc-123-def type: $ref: '#/components/schemas/OrganizationsType' required: - type type: object RumMetricResponseData: description: The rum-based metric properties. properties: attributes: $ref: '#/components/schemas/RumMetricResponseAttributes' id: $ref: '#/components/schemas/RumMetricID' type: $ref: '#/components/schemas/RumMetricType' type: object SendTeamsMessageAction: description: Sends a message to a Microsoft Teams channel. properties: channel: description: The channel ID. example: CHANNEL type: string team: description: The team ID. example: TEAM type: string tenant: description: The tenant ID. example: TENANT type: string type: $ref: '#/components/schemas/SendTeamsMessageActionType' required: - type - channel - tenant - team type: object ObservabilityPipelineHttpServerSourceType: default: http_server description: The source type. The value should always be `http_server`. enum: - http_server example: http_server type: string x-enum-varnames: - HTTP_SERVER CloudWorkloadSecurityAgentRuleAttributes: description: A Cloud Workload Security Agent rule returned by the API properties: actions: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions' agentConstraint: description: The version of the Agent type: string example: example_value blocking: description: The blocking policies that the rule belongs to items: type: string type: array category: description: The category of the Agent rule example: Process Activity type: string creationAuthorUuId: description: The ID of the user who created the rule example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string creationDate: description: When the Agent rule was created, timestamp in milliseconds example: 1624366480320 format: int64 type: integer creator: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreatorAttributes' defaultRule: description: Whether the rule is included by default example: false type: boolean description: description: The description of the Agent rule example: My Agent rule type: string disabled: description: The disabled policies that the rule belongs to items: type: string type: array enabled: description: Whether the Agent rule is enabled example: true type: boolean expression: description: The SECL expression of the Agent rule example: exec.file.name == "sh" type: string filters: description: The platforms the Agent rule is supported on items: type: string type: array monitoring: description: The monitoring policies that the rule belongs to items: type: string type: array name: description: The name of the Agent rule example: my_agent_rule type: string product_tags: description: The list of product tags associated with the rule items: type: string type: array updateAuthorUuId: description: The ID of the user who updated the rule example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string updateDate: description: Timestamp in milliseconds when the Agent rule was last updated example: 1624366480320 format: int64 type: integer updatedAt: description: When the Agent rule was last updated, timestamp in milliseconds example: 1624366480320 format: int64 type: integer updater: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdaterAttributes' version: description: The version of the Agent rule example: 23 format: int64 type: integer type: object NullableRelationshipToUserData: description: Relationship to user object. nullable: true properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UsersType' required: - id - type type: object x-merge-override: required: false ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions: description: Options for selecting a predefined library pattern and enabling keyword support. properties: id: description: Identifier for a predefined pattern from the sensitive data scanner pattern library. example: credit_card type: string use_recommended_keywords: description: Whether to augment the pattern with recommended keywords (optional). type: boolean example: true required: - id type: object ObservabilityPipelineAmazonS3DestinationStorageClass: description: S3 storage class. enum: - STANDARD - REDUCED_REDUNDANCY - INTELLIGENT_TIERING - STANDARD_IA - EXPRESS_ONEZONE - ONEZONE_IA - GLACIER - GLACIER_IR - DEEP_ARCHIVE example: STANDARD type: string x-enum-varnames: - STANDARD - REDUCED_REDUNDANCY - INTELLIGENT_TIERING - STANDARD_IA - EXPRESS_ONEZONE - ONEZONE_IA - GLACIER - GLACIER_IR - DEEP_ARCHIVE ObservabilityPipelineDecoding: description: The decoding format used to interpret incoming logs. enum: - bytes - gelf - json - syslog example: json type: string x-enum-varnames: - DECODE_BYTES - DECODE_GELF - DECODE_JSON - DECODE_SYSLOG EntityV3DatadogCodeLocations: additionalProperties: false description: Schema for mapping source code locations to an entity. items: $ref: '#/components/schemas/EntityV3DatadogCodeLocationItem' type: array ListTeamsSort: description: Specifies the order of the returned teams enum: - name - -name - user_count - -user_count type: string x-enum-varnames: - NAME - _NAME - USER_COUNT - _USER_COUNT ServiceDefinitionV1Contact: description: Contact information about the service. properties: email: description: Service owner’s email. example: contact@datadoghq.com type: string slack: description: Service owner’s Slack channel. example: https://yourcompany.slack.com/archives/channel123 type: string type: object CloudWorkloadSecurityAgentPolicyType: default: policy description: The type of the resource, must always be `policy` enum: - policy example: policy type: string x-enum-varnames: - POLICY CIAppSort: description: Sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING ServiceDefinitionV2Dot1Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string provider: description: Link provider. example: Github type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1LinkType' url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object FindingEvaluation: description: The evaluation of the finding. enum: - pass - fail example: pass type: string x-enum-varnames: - PASS - FAIL MicrosoftTeamsWorkflowsWebhookResponseAttributes: description: Workflows Webhook handle attributes. properties: name: description: Workflows Webhook handle name. example: fake-handle-name maxLength: 255 type: string type: object ObservabilityPipeline: description: Top-level schema representing a pipeline. properties: data: $ref: '#/components/schemas/ObservabilityPipelineData' required: - data type: object IncidentIntegrationMetadataAttributes: description: Incident integration metadata's attributes for a create request. properties: created: description: Timestamp when the incident todo was created. format: date-time readOnly: true type: string example: example_value incident_id: description: UUID of the incident this integration metadata is connected to. example: 00000000-aaaa-0000-0000-000000000000 type: string integration_type: description: 'A number indicating the type of integration this metadata is for. 1 indicates Slack; 8 indicates Jira.' example: 1 format: int32 maximum: 9 type: integer metadata: $ref: '#/components/schemas/IncidentIntegrationMetadataMetadata' modified: description: Timestamp when the incident todo was last modified. format: date-time readOnly: true type: string example: example_value status: description: 'A number indicating the status of this integration metadata. 0 indicates unknown; 1 indicates pending; 2 indicates complete; 3 indicates manually created; 4 indicates manually updated; 5 indicates failed.' format: int32 maximum: 5 type: integer example: 42 required: - integration_type - metadata type: object ObservabilityPipelineConfigDestinationItem: description: A destination for the pipeline. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestination' - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Destination' - $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestination' - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestination' - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestination' - $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestination' - $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestination' - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestination' - $ref: '#/components/schemas/AzureStorageDestination' - $ref: '#/components/schemas/MicrosoftSentinelDestination' - $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestination' - $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestination' - $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination' - $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination' - $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination' DevicesListData: description: The devices list data properties: attributes: $ref: '#/components/schemas/DeviceAttributes' id: description: The device ID example: example:1.2.3.4 type: string type: description: The type of the resource. The value should always be device. type: string example: metric alert type: object RestrictionPolicyType: default: restriction_policy description: Restriction policy type. enum: - restriction_policy example: restriction_policy type: string x-enum-varnames: - RESTRICTION_POLICY EntityV3DatastoreSpec: additionalProperties: false description: The definition of Entity V3 Datastore Spec object. properties: componentOf: description: A list of components the datastore is a part of items: type: string type: array lifecycle: description: The lifecycle state of the datastore. minLength: 1 type: string example: example_value tier: description: The importance of the datastore. minLength: 1 type: string example: example_value type: description: The type of datastore. type: string example: metric alert type: object ObservabilityPipelineConfigSourceItem: description: A data source for the pipeline. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineKafkaSource' - $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSource' - $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSource' - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSource' - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Source' - $ref: '#/components/schemas/ObservabilityPipelineFluentdSource' - $ref: '#/components/schemas/ObservabilityPipelineFluentBitSource' - $ref: '#/components/schemas/ObservabilityPipelineHttpServerSource' - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSource' - $ref: '#/components/schemas/ObservabilityPipelineRsyslogSource' - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSource' - $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSource' - $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource' - $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource' - $ref: '#/components/schemas/ObservabilityPipelineLogstashSource' IncidentTeamType: default: teams description: Incident Team resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS ObservabilityPipelineSensitiveDataScannerProcessorAction: description: Defines what action to take when sensitive data is matched. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedact' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHash' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact' SoftwareCatalogTriggerWrapper: description: Schema for a Software Catalog-based trigger. properties: softwareCatalogTrigger: description: Trigger a workflow from Software Catalog. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - softwareCatalogTrigger type: object ObservabilityPipelineNewRelicDestination: description: The `new_relic` destination sends logs to the New Relic platform. properties: id: description: The unique identifier for this component. example: new-relic-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - parse-json-processor items: type: string type: array region: $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion' type: $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationType' required: - id - type - inputs - region type: object PartialAPIKey: description: Partial Datadog API key. properties: attributes: $ref: '#/components/schemas/PartialAPIKeyAttributes' id: description: ID of the API key. type: string example: abc-123-def relationships: $ref: '#/components/schemas/APIKeyRelationships' type: $ref: '#/components/schemas/APIKeysType' type: object x-merge-override: required: false ApplicationSecurityWafCustomRuleAction: description: The definition of `ApplicationSecurityWafCustomRuleAction` object. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionAction' parameters: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters' type: object DowntimeScheduleCurrentDowntimeResponse: description: 'The most recent actual start and end dates for a recurring downtime. For a canceled downtime, this is the previously occurring downtime. For active downtimes, this is the ongoing downtime, and for scheduled downtimes it is the upcoming downtime.' properties: end: description: The end of the current downtime. example: '2020-01-02T03:04:00.000Z' format: date-time nullable: true type: string start: description: The start of the current downtime. example: '2020-01-02T03:04:00.000Z' format: date-time type: string type: object ApplicationSecurityWafCustomRuleResponse: description: Response object that includes a single WAF custom rule. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData' type: object ScheduleMemberRelationshipsUserData: description: Points to the user data associated with this schedule member, including an ID and type. properties: id: description: The user's unique identifier. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/ScheduleMemberRelationshipsUserDataType' required: - type - id type: object EntityV3DatadogLogItem: additionalProperties: false description: Log association item. properties: name: description: The name of the query. type: string example: Example Monitor query: description: The query to run. type: string example: avg:system.cpu.user{*} type: object SecurityMonitoringRuleQueryAggregation: description: The aggregation type. enum: - count - cardinality - sum - max - new_value - geo_data - event_count - none type: string x-enum-varnames: - COUNT - CARDINALITY - SUM - MAX - NEW_VALUE - GEO_DATA - EVENT_COUNT - NONE AzureStorageDestination: description: The `azure_storage` destination forwards logs to an Azure Blob Storage container. properties: blob_prefix: description: Optional prefix for blobs written to the container. example: logs/ type: string container_name: description: The name of the Azure Blob Storage container to store logs in. example: my-log-container type: string id: description: The unique identifier for this component. example: azure-storage-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - processor-id items: type: string type: array type: $ref: '#/components/schemas/AzureStorageDestinationType' required: - id - type - inputs - container_name type: object GetAppResponseDataAttributes: description: The app definition attributes, such as name, description, and components. properties: components: description: The UI components that make up the app. items: $ref: '#/components/schemas/ComponentGrid' type: array description: description: A human-readable description for the app. type: string example: example_value favorite: description: Whether the app is marked as a favorite by the current user. type: boolean example: true name: description: The name of the app. type: string example: Example Monitor queries: description: An array of queries, such as external actions and state variables, that the app uses. items: $ref: '#/components/schemas/Query' type: array rootInstanceName: description: The name of the root component of the app. This must be a `grid` component that contains all other components. type: string example: Example Monitor tags: description: A list of tags for the app, which can be used to filter apps. example: - service:webshop-backend - team:webshop items: description: An individual tag for the app. type: string type: array type: object MonitorNotificationRuleResponseAttributes: additionalProperties: {} description: Attributes of the monitor notification rule. properties: created: description: Creation time of the monitor notification rule. example: '2020-01-02T03:04:00.000Z' format: date-time type: string filter: $ref: '#/components/schemas/MonitorNotificationRuleFilter' modified: description: Time the monitor notification rule was last modified. example: '2020-01-02T03:04:00.000Z' format: date-time type: string name: $ref: '#/components/schemas/MonitorNotificationRuleName' recipients: $ref: '#/components/schemas/MonitorNotificationRuleRecipients' type: object HTTPBody: description: The definition of `HTTPBody` object. properties: content: description: Serialized body content example: '{"some-json": "with-value"}' type: string content_type: description: Content type of the body example: application/json type: string type: object ObservabilityPipelineHttpServerSource: description: The `http_server` source collects logs over HTTP POST from external services. properties: auth_strategy: $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy' decoding: $ref: '#/components/schemas/ObservabilityPipelineDecoding' id: description: Unique ID for the HTTP server source. example: http-server-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType' required: - id - type - auth_strategy - decoding type: object OktaAccountType: default: okta-accounts description: Account type for an Okta account. enum: - okta-accounts example: okta-accounts type: string x-enum-varnames: - OKTA_ACCOUNTS ServiceDefinitionData: description: Service definition data. properties: attributes: $ref: '#/components/schemas/ServiceDefinitionDataAttributes' id: description: Service definition id. type: string example: abc-123-def type: description: Service definition type. type: string example: metric alert type: object EscalationPolicyStep: description: Represents a single step in an escalation policy, including its attributes, relationships, and resource type. properties: attributes: $ref: '#/components/schemas/EscalationPolicyStepAttributes' id: description: Specifies the unique identifier of this escalation policy step. type: string example: abc-123-def relationships: $ref: '#/components/schemas/EscalationPolicyStepRelationships' type: $ref: '#/components/schemas/EscalationPolicyStepType' required: - type type: object APIKeysSort: default: name description: Sorting options enum: - created_at - -created_at - last4 - -last4 - modified_at - -modified_at - name - -name type: string x-enum-varnames: - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - LAST4_ASCENDING - LAST4_DESCENDING - MODIFIED_AT_ASCENDING - MODIFIED_AT_DESCENDING - NAME_ASCENDING - NAME_DESCENDING ObservabilityPipelineSensitiveDataScannerProcessorType: default: sensitive_data_scanner description: The processor type. The value should always be `sensitive_data_scanner`. enum: - sensitive_data_scanner example: sensitive_data_scanner type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER ContainerGroupRelationshipsLink: description: Relationships to Containers inside a Container Group. properties: data: $ref: '#/components/schemas/ContainerGroupRelationshipsData' links: $ref: '#/components/schemas/ContainerGroupRelationshipsLinks' type: object IncidentFieldAttributesValueType: default: multiselect description: Type of the multiple value field definitions. enum: - multiselect - textarray - metrictag - autocomplete example: multiselect type: string x-enum-varnames: - MULTISELECT - TEXTARRAY - METRICTAG - AUTOCOMPLETE IncidentServiceRelationships: description: The incident service's relationships. properties: created_by: $ref: '#/components/schemas/RelationshipToUser' last_modified_by: $ref: '#/components/schemas/RelationshipToUser' readOnly: true type: object RelationshipToIncidentIntegrationMetadatas: description: A relationship reference for multiple integration metadata objects. example: data: - id: 00000000-abcd-0005-0000-000000000000 type: incident_integrations - id: 00000000-abcd-0006-0000-000000000000 type: incident_integrations properties: data: description: Integration metadata relationship array example: - id: 00000000-abcd-0003-0000-000000000000 type: incident_integrations - id: 00000000-abcd-0004-0000-000000000000 type: incident_integrations items: $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadataData' type: array required: - data type: object SecurityMonitoringRuleHardcodedEvaluatorType: description: Hardcoded evaluator type. enum: - log4shell type: string x-enum-varnames: - LOG4SHELL ObservabilityPipelineGooglePubSubSourceType: default: google_pubsub description: The source type. The value should always be `google_pubsub`. enum: - google_pubsub example: google_pubsub type: string x-enum-varnames: - GOOGLE_PUBSUB TeamTargetType: default: teams description: Indicates that the resource is of type `teams`. enum: - teams example: teams type: string x-enum-varnames: - TEAMS ProjectsResponse: description: Response with projects properties: data: description: Projects response data items: $ref: '#/components/schemas/Project' type: array type: object CsmHostsAndContainersCoverageAnalysisAttributes: description: CSM Hosts and Containers Coverage Analysis attributes. properties: cspm_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' cws_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' org_id: description: The ID of your organization. example: 123456 format: int64 type: integer total_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' vm_coverage: $ref: '#/components/schemas/CsmCoverageAnalysis' type: object TeamPermissionSettingValues: description: Possible values for action items: $ref: '#/components/schemas/TeamPermissionSettingValue' readOnly: true type: array CloudWorkloadSecurityAgentRuleActions: description: The array of actions the rule can perform if triggered items: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAction' nullable: true type: array ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact: description: Configuration for partially redacting matched sensitive data. properties: action: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction' options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions' required: - action - options type: object ContainerImageType: default: container_image description: Type of Container Image. enum: - container_image example: container_image type: string x-enum-varnames: - CONTAINER_IMAGE LogType: default: log description: Type of the event. enum: - log example: log type: string x-enum-varnames: - LOG ObservabilityPipelineMetricValue: description: Specifies how the value of the generated metric is computed. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOne' - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByField' ScheduleUser: description: Represents a user object in the context of a schedule, including their `id`, type, and basic attributes. properties: attributes: $ref: '#/components/schemas/ScheduleUserAttributes' id: description: The unique user identifier. type: string example: abc-123-def type: $ref: '#/components/schemas/ScheduleUserType' required: - type type: object SAMLAssertionAttribute: description: SAML assertion attribute. properties: attributes: $ref: '#/components/schemas/SAMLAssertionAttributeAttributes' id: description: The ID of the SAML assertion attribute. example: '0' type: string type: $ref: '#/components/schemas/SAMLAssertionAttributesType' required: - id - type type: object x-merge-override: required: false MonitorConfigPolicyResponseData: description: A monitor configuration policy data. properties: attributes: $ref: '#/components/schemas/MonitorConfigPolicyAttributeResponse' id: description: ID of this monitor configuration policy. example: 00000000-0000-1234-0000-000000000000 type: string type: $ref: '#/components/schemas/MonitorConfigPolicyResourceType' type: object ShiftIncluded: description: The definition of `ShiftIncluded` object. oneOf: - $ref: '#/components/schemas/ScheduleUser' ProcessSummaryType: default: process description: Type of process summary. enum: - process example: process type: string x-enum-varnames: - PROCESS SecurityFilterID: description: The ID of the security filter. example: 3dd-0uc-h1s type: string IncidentTrigger: description: Trigger a workflow from an Incident. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object LogsArchive: description: The logs archive. properties: data: $ref: '#/components/schemas/LogsArchiveDefinition' type: object WorklflowGetInstanceResponseData: additionalProperties: {} description: The data of the instance response. properties: attributes: $ref: '#/components/schemas/WorklflowGetInstanceResponseDataAttributes' type: object RumMetricID: description: The name of the rum-based metric. example: rum.sessions.webui.count type: string SelfServiceTriggerWrapper: description: Schema for a Self Service-based trigger. properties: selfServiceTrigger: description: Trigger a workflow from Self Service. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - selfServiceTrigger type: object OnDemandConcurrencyCapAttributes: description: On-demand concurrency cap attributes. properties: on_demand_concurrency_cap: description: Value of the on-demand concurrency cap. format: double type: number example: 95.5 type: object ActiveBillingDimensionsType: default: billing_dimensions description: Type of active billing dimensions data. enum: - billing_dimensions type: string x-enum-varnames: - BILLING_DIMENSIONS TeamsResponseLinks: description: Teams response links. properties: first: description: First link. type: string example: example_value last: description: Last link. nullable: true type: string example: example_value next: description: Next link. type: string example: example_value prev: description: Previous link. nullable: true type: string example: example_value self: description: Current link. type: string example: example_value type: object MonitorTrigger: description: Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object AWSNamespaceFiltersIncludeOnly: description: Include only these namespaces. properties: include_only: description: Include only these namespaces. example: - AWS/EC2 items: example: AWS/EC2 type: string type: array required: - include_only type: object EntityV3DatadogLogs: additionalProperties: false description: Logs association. items: $ref: '#/components/schemas/EntityV3DatadogLogItem' type: array SecurityMonitoringSuppression: description: The suppression rule's properties. properties: attributes: $ref: '#/components/schemas/SecurityMonitoringSuppressionAttributes' id: $ref: '#/components/schemas/SecurityMonitoringSuppressionID' type: $ref: '#/components/schemas/SecurityMonitoringSuppressionType' type: object ListRelationCatalogResponseIncluded: description: List relation response included entities. items: $ref: '#/components/schemas/EntityData' type: array ServiceDefinitionV2Dot1: description: Service definition v2.1 for providing service metadata and integrations. properties: application: description: Identifier for a group of related services serving a product feature, which the service is a part of. example: my-app type: string contacts: description: A list of contacts related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Contact' type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string description: description: A short description of the service. example: My service description type: string extensions: additionalProperties: {} description: Extensions to v2.1 schema. example: myorg/extension: extensionValue type: object integrations: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Integrations' lifecycle: description: The current life cycle phase of the service. example: sandbox type: string links: description: A list of links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Link' type: array schema-version: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array team: description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists. example: my-team type: string tier: description: Importance of the service. example: High type: string required: - schema-version - dd-service type: object RelationshipToIncidentResponders: description: Relationship to incident responders. properties: data: description: An array of incident responders. items: $ref: '#/components/schemas/RelationshipToIncidentResponderData' type: array required: - data type: object RetentionFilterAllType: default: spans-sampling-processor description: The type of retention filter. enum: - spans-sampling-processor - spans-errors-sampling-processor - spans-appsec-sampling-processor example: spans-sampling-processor type: string x-enum-varnames: - SPANS_SAMPLING_PROCESSOR - SPANS_ERRORS_SAMPLING_PROCESSOR - SPANS_APPSEC_SAMPLING_PROCESSOR CloudflareAccountResponseAttributes: description: Attributes object of a Cloudflare account. properties: email: description: The email associated with the Cloudflare account. example: test-email@example.com type: string name: description: The name of the Cloudflare account. example: test-name type: string resources: description: An allowlist of resources, such as `web`, `dns`, `lb` (load balancer), `worker`, that restricts pulling metrics from those resources. example: - web - dns - lb - worker items: type: string type: array zones: description: An allowlist of zones to restrict pulling metrics for. example: - zone_id_1 - zone_id_2 items: type: string type: array required: - name type: object ObservabilityPipelineEnrichmentTableFile: description: Defines a static enrichment table loaded from a CSV file. properties: encoding: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncoding' key: description: Key fields used to look up enrichment values. items: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItems' type: array path: description: Path to the CSV file. example: /etc/enrichment/lookup.csv type: string schema: description: Schema defining column names and their types. items: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItems' type: array required: - encoding - key - path - schema type: object CloudWorkloadSecurityAgentRuleActionMetadata: description: The metadata action applied on the scope matching the rule properties: image_tag: description: The image tag of the metadata action type: string example: env:production service: description: The service of the metadata action type: string example: example_value short_image: description: The short image of the metadata action type: string example: example_value type: object Layer: description: Encapsulates a layer resource, holding attributes like rotation details, plus relationships to the members covering that layer. properties: attributes: $ref: '#/components/schemas/LayerAttributes' id: description: A unique identifier for this layer. type: string example: abc-123-def relationships: $ref: '#/components/schemas/LayerRelationships' type: $ref: '#/components/schemas/LayerType' required: - type type: object RumRetentionFilterEventType: description: The type of RUM events to filter on. enum: - session - view - action - error - resource - long_task - vital example: session type: string x-enum-varnames: - SESSION - VIEW - ACTION - ERROR - RESOURCE - LONG_TASK - VITAL IPAllowlistEntryData: description: Data of the IP allowlist entry object. properties: attributes: $ref: '#/components/schemas/IPAllowlistEntryAttributes' id: description: The unique identifier of the IP allowlist entry. type: string example: abc-123-def type: $ref: '#/components/schemas/IPAllowlistEntryType' required: - type type: object ApplicationSecurityWafCustomRuleTags: additionalProperties: type: string description: 'Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security activity field associated with the traces.' maxProperties: 32 properties: category: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory' type: description: The type of the WAF rule, associated with the category will form the security activity. example: users.login.success type: string required: - category - type type: object HTTPHeader: description: The definition of `HTTPHeader` object. properties: name: description: The `HTTPHeader` `name`. example: MyHttpHeader pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$ type: string value: description: The `HTTPHeader` `value`. example: Some header value type: string required: - name - value type: object OutputSchema: description: A list of output parameters for the workflow. properties: parameters: description: The `OutputSchema` `parameters`. items: $ref: '#/components/schemas/OutputSchemaParameters' type: array type: object LogsArchiveDefinition: description: The definition of an archive. properties: attributes: $ref: '#/components/schemas/LogsArchiveAttributes' id: description: The archive ID. example: a2zcMylnM4OCHpYusxIi3g readOnly: true type: string type: default: archives description: The type of the resource. The value should always be archives. example: archives readOnly: true type: string required: - type type: object IncidentsResponse: description: Response with a list of incidents. properties: data: description: An array of incidents. example: - attributes: created: '2020-04-21T15:34:08.627205+00:00' creation_idempotency_key: null customer_impact_duration: 0 customer_impact_end: null customer_impact_scope: null customer_impact_start: null customer_impacted: false detected: '2020-04-14T00:00:00+00:00' incident_type_uuid: 00000000-0000-0000-0000-000000000001 modified: '2020-09-17T14:16:58.696424+00:00' public_id: 1 resolved: null severity: SEV-1 time_to_detect: 0 time_to_internal_response: 0 time_to_repair: 0 time_to_resolve: 0 title: Example Incident id: 00000000-aaaa-0000-0000-000000000000 relationships: attachments: data: - id: 00000000-9999-0000-0000-000000000000 type: incident_attachments - id: 00000000-1234-0000-0000-000000000000 type: incident_attachments commander_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users created_by_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users integrations: data: - id: 00000000-0000-0000-4444-000000000000 type: incident_integrations - id: 00000000-0000-0000-5555-000000000000 type: incident_integrations last_modified_by_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users type: incidents - attributes: created: '2020-04-21T15:34:08.627205+00:00' creation_idempotency_key: null customer_impact_duration: 0 customer_impact_end: null customer_impact_scope: null customer_impact_start: null customer_impacted: false detected: '2020-04-14T00:00:00+00:00' incident_type_uuid: 00000000-0000-0000-0000-000000000002 modified: '2020-09-17T14:16:58.696424+00:00' public_id: 2 resolved: null severity: SEV-5 time_to_detect: 0 time_to_internal_response: 0 time_to_repair: 0 time_to_resolve: 0 title: Example Incident 2 id: 00000000-1111-0000-0000-000000000000 relationships: attachments: data: - id: 00000000-9999-0000-0000-000000000000 type: incident_attachments commander_user: data: id: 00000000-aaaa-0000-0000-000000000000 type: users created_by_user: data: id: 00000000-aaaa-0000-0000-000000000000 type: users integrations: data: - id: 00000000-0000-0000-0001-000000000000 type: incident_integrations - id: 00000000-0000-0000-0002-000000000000 type: incident_integrations last_modified_by_user: data: id: 00000000-aaaa-0000-0000-000000000000 type: users type: incidents items: $ref: '#/components/schemas/IncidentResponseData' type: array included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentResponseIncludedItem' readOnly: true type: array meta: $ref: '#/components/schemas/IncidentResponseMeta' required: - data type: object AWSAssumeRole: description: The definition of `AWSAssumeRole` object. properties: account_id: description: AWS account the connection is created for example: '111222333444' pattern: ^\d{12}$ type: string external_id: description: External ID used to scope which connection can be used to assume the role example: 33a1011635c44b38a064cf14e82e1d8f readOnly: true type: string principal_id: description: AWS account that will assume the role example: '123456789012' readOnly: true type: string role: description: Role to assume example: my-role type: string type: $ref: '#/components/schemas/AWSAssumeRoleType' required: - type - account_id - role type: object IncidentServiceResponseAttributes: description: The incident service's attributes from a response. properties: created: description: Timestamp of when the incident service was created. format: date-time readOnly: true type: string example: example_value modified: description: Timestamp of when the incident service was modified. format: date-time readOnly: true type: string example: example_value name: description: Name of the incident service. example: service name type: string type: object RUMSort: description: Sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING ServiceDefinitionV2Dot1Slack: description: Service owner's Slack channel. properties: contact: description: Slack Channel. example: https://yourcompany.slack.com/archives/channel123 type: string name: description: Contact Slack. example: Team Slack type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1SlackType' required: - type - contact type: object RelationshipToIncidentImpactData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the impact. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/IncidentImpactsType' required: - id - type type: object x-merge-override: required: false FastlyAccountResponseData: description: Data object of a Fastly account. properties: attributes: $ref: '#/components/schemas/FastlyAccounResponseAttributes' id: description: The ID of the Fastly account, a hash of the account name. example: abc123 type: string type: $ref: '#/components/schemas/FastlyAccountType' required: - attributes - id - type type: object x-merge-override: required: false TeamOnCallRespondersDataType: default: team_oncall_responders description: Represents the resource type for a group of users assigned to handle on-call duties within a team. enum: - team_oncall_responders example: team_oncall_responders type: string x-enum-varnames: - TEAM_ONCALL_RESPONDERS CustomDestinationResponseForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: '#/components/schemas/CustomDestinationResponseElasticsearchDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).' example: yyyy-MM-dd type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearchType' required: - type - endpoint - auth - index_name type: object CustomDestinationResponseForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH CostAttributionAggregatesBody: description: The object containing the aggregates. properties: agg_type: description: The aggregate type. example: sum type: string field: description: The field. example: infra_host_committed_cost type: string value: description: The value for a given field. format: double type: number example: 95.5 type: object RelationshipToUserTeamUser: description: Relationship between team membership and user properties: data: $ref: '#/components/schemas/RelationshipToUserTeamUserData' required: - data type: object ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction: description: Action type that completely replaces the matched sensitive data with a fixed replacement string to remove all visibility. enum: - redact example: redact type: string x-enum-varnames: - REDACT AWSAccountType: default: account description: AWS Account resource type. enum: - account example: account type: string x-enum-varnames: - ACCOUNT RUMResponseLinks: description: Links attributes. properties: next: description: 'Link for the next set of results. Note that the request can also be made using the POST endpoint.' example: https://app.datadoghq.com/api/v2/rum/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object SortDirection: default: desc description: The direction to sort by. enum: - desc - asc type: string x-enum-varnames: - DESC - ASC LayerRelationshipsMembersDataItems: description: 'Represents a single member object in a layer''s `members` array, referencing a unique Datadog user ID.' properties: id: description: The unique user ID of the layer member. example: 00000000-0000-0000-0000-000000000002 type: string type: $ref: '#/components/schemas/LayerRelationshipsMembersDataItemsType' required: - type - id type: object ApplicationKeysSort: default: name description: Sorting options enum: - created_at - -created_at - last4 - -last4 - name - -name type: string x-enum-varnames: - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - LAST4_ASCENDING - LAST4_DESCENDING - NAME_ASCENDING - NAME_DESCENDING SingleAggregatedConnectionResponseDataAttributes: description: Attributes for an aggregated connection. properties: bytes_sent_by_client: description: The total number of bytes sent by the client over the given period. format: int64 type: integer example: 42 bytes_sent_by_server: description: The total number of bytes sent by the server over the given period. format: int64 type: integer example: 42 group_bys: additionalProperties: description: The values for each group by. items: type: string type: array description: The key, value pairs for each group by. type: object packets_sent_by_client: description: The total number of packets sent by the client over the given period. format: int64 type: integer example: 42 packets_sent_by_server: description: The total number of packets sent by the server over the given period. format: int64 type: integer example: 42 rtt_micro_seconds: description: Measured as TCP smoothed round trip time in microseconds (the time between a TCP frame being sent and acknowledged). format: int64 type: integer example: 42 tcp_closed_connections: description: The number of TCP connections in a closed state. Measured in connections per second from the client. format: int64 type: integer example: 42 tcp_established_connections: description: The number of TCP connections in an established state. Measured in connections per second from the client. format: int64 type: integer example: 42 tcp_refusals: description: The number of TCP connections that were refused by the server. Typically this indicates an attempt to connect to an IP/port that is not receiving connections, or a firewall/security misconfiguration. format: int64 type: integer example: 42 tcp_resets: description: The number of TCP connections that were reset by the server. format: int64 type: integer example: 42 tcp_retransmits: description: TCP Retransmits represent detected failures that are retransmitted to ensure delivery. Measured in count of retransmits from the client. format: int64 type: integer example: 42 tcp_timeouts: description: The number of TCP connections that timed out from the perspective of the operating system. This can indicate general connectivity and latency issues. format: int64 type: integer example: 42 type: object ObservabilityPipelineReduceProcessorMergeStrategyStrategy: description: The merge strategy to apply. enum: - discard - retain - sum - max - min - array - concat - concat_newline - concat_raw - shortest_array - longest_array - flat_unique example: flat_unique type: string x-enum-varnames: - DISCARD - RETAIN - SUM - MAX - MIN - ARRAY - CONCAT - CONCAT_NEWLINE - CONCAT_RAW - SHORTEST_ARRAY - LONGEST_ARRAY - FLAT_UNIQUE SecurityMonitoringThirdPartyRootQuery: description: A query to be combined with the third party case query. properties: groupByFields: description: Fields to group by. items: description: Field. type: string type: array query: description: Query to run on logs. example: source:cloudtrail type: string type: object SLOReportStatusGetResponseData: description: The data portion of the SLO report status response. properties: attributes: $ref: '#/components/schemas/SLOReportStatusGetResponseAttributes' id: description: The ID of the report job. example: dc8d92aa-e0af-11ee-af21-1feeaccaa3a3 type: string type: description: The type of ID. example: report_id type: string type: object TeamIncluded: description: Included resources related to the team oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/TeamLink' - $ref: '#/components/schemas/UserTeamPermission' ContainerGroupRelationshipsLinks: description: Links attributes. properties: related: description: Link to related containers. type: string example: example_value type: object CustomDestinationResponseForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttpType' required: - type - endpoint - auth type: object BillingDimensionsMappingBodyItemAttributesEndpointsItems: description: An endpoint's keys mapped to the billing_dimension. properties: id: description: The URL for the endpoint. example: api/v1/usage/billable-summary type: string keys: description: The billing dimension. example: - apm_host_top99p - apm_host_sum items: example: apm_host_top99p type: string type: array status: $ref: '#/components/schemas/BillingDimensionsMappingBodyItemAttributesEndpointsItemsStatus' type: object SecurityMonitoringSignalListRequest: description: The request for a security signal list. properties: filter: $ref: '#/components/schemas/SecurityMonitoringSignalListRequestFilter' page: $ref: '#/components/schemas/SecurityMonitoringSignalListRequestPage' sort: $ref: '#/components/schemas/SecurityMonitoringSignalsSort' type: object MicrosoftTeamsChannelInfoResponseData: description: Channel data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsChannelInfoResponseAttributes' id: description: The ID of the channel. example: 19:b41k24b14bn1nwffkernfkwrnfneubgkr@thread.tacv2 maxLength: 255 minLength: 1 type: string type: $ref: '#/components/schemas/MicrosoftTeamsChannelInfoType' type: object x-merge-override: required: false IncidentSeverity: description: The incident severity. enum: - UNKNOWN - SEV-0 - SEV-1 - SEV-2 - SEV-3 - SEV-4 - SEV-5 example: UNKNOWN type: string x-enum-varnames: - UNKNOWN - SEV_0 - SEV_1 - SEV_2 - SEV_3 - SEV_4 - SEV_5 EscalationPolicyStepAttributes: description: Defines attributes for an escalation policy step, such as assignment strategy and escalation timeout. properties: assignment: $ref: '#/components/schemas/EscalationPolicyStepAttributesAssignment' escalate_after_seconds: description: Specifies how many seconds to wait before escalating to the next step. format: int64 type: integer example: 42 type: object ApplicationSecurityWafExclusionFilterID: description: The identifier of the WAF exclusion filter. example: 3dd-0uc-h1s readOnly: true type: string ObservabilityPipelineOpenSearchDestination: description: The `opensearch` destination writes logs to an OpenSearch cluster. properties: bulk_index: description: The index to write logs to. example: logs-index type: string id: description: The unique identifier for this component. example: opensearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestinationType' required: - id - type - inputs type: object DowntimeResponseIncludedItem: description: An object related to a downtime. oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/DowntimeMonitorIncludedItem' AWSAuthConfig: description: AWS Authentication config. oneOf: - $ref: '#/components/schemas/AWSAuthConfigKeys' - $ref: '#/components/schemas/AWSAuthConfigRole' SecurityFilterAttributes: description: The object describing a security filter. properties: exclusion_filters: description: The list of exclusion filters applied in this security filter. items: $ref: '#/components/schemas/SecurityFilterExclusionFilterResponse' type: array filtered_data_type: $ref: '#/components/schemas/SecurityFilterFilteredDataType' is_builtin: description: Whether the security filter is the built-in filter. example: false type: boolean is_enabled: description: Whether the security filter is enabled. example: false type: boolean name: description: The security filter name. example: Custom security filter type: string query: description: The security filter query. Logs accepted by this query will be accepted by this filter. example: service:api type: string version: description: The version of the security filter. example: 1 format: int32 maximum: 2147483647 type: integer type: object SpansMetricComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION BillingDimensionsMappingBodyItemAttributesEndpointsItemsStatus: description: Denotes whether mapping keys were available for this endpoint. enum: - OK - NOT_FOUND type: string x-enum-varnames: - OK - NOT_FOUND TeamReferenceType: default: teams description: Teams resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS parameters: FilterRelationByType: description: Filter relations by type. explode: true in: query name: filter[type] required: false schema: $ref: '#/components/schemas/RelationType' ApplicationKeyFilterCreatedAtEndParameter: description: Only include application keys created on or before the specified date. in: query name: filter[created_at][end] required: false schema: example: '2020-11-24T18:46:21+00:00' type: string x-merge-override: format: false IncidentTypeIncludeDeletedParameter: description: Include deleted incident types in the response. in: query name: include_deleted schema: default: false type: boolean ServiceName: description: The name of the service. in: path name: service_name required: true schema: example: my-service type: string ProjectIDPathParameter: description: Project UUID example: e555e290-ed65-49bd-ae18-8acbfcf18db7 in: path name: project_id required: true schema: type: string ApplicationSecurityWafCustomRuleIDParam: description: The ID of the custom rule. example: 3b5-v82-ns6 in: path name: custom_rule_id required: true schema: type: string SecurityMonitoringRuleID: description: The ID of the rule. in: path name: rule_id required: true schema: type: string IncidentTeamIncludeQueryParameter: description: Specifies which types of related objects should be included in the response. in: query name: include required: false schema: $ref: '#/components/schemas/IncidentRelatedObject' MicrosoftTeamsTenantIDQueryParameter: description: Your tenant id. in: query name: tenant_id required: false schema: type: string FilterRelationByFromRef: description: Filter relations by the reference of the first entity in the relation. example: service:shopping-cart explode: true in: query name: filter[from_ref] required: false schema: type: string CustomDestinationId: description: The ID of the custom destination. in: path name: custom_destination_id required: true schema: type: string ServiceAccountID: description: The ID of the service account. in: path name: service_account_id required: true schema: example: 00000000-0000-1234-0000-000000000000 type: string Include: description: Include relationship data. explode: true in: query name: include required: false schema: $ref: '#/components/schemas/IncludeType' FastlyAccountID: description: Fastly Account id. in: path name: account_id required: true schema: type: string RumMetricIDParameter: description: The name of the rum-based metric. in: path name: metric_id required: true schema: type: string MicrosoftTeamsChannelNamePathParameter: description: Your channel name. in: path name: channel_name required: true schema: type: string PageOffset: description: Specific offset to use as the beginning of the returned page. in: query name: page[offset] required: false schema: default: 0 example: 0 format: int64 type: integer APIKeyFilterModifiedAtEndParameter: description: Only include API keys modified on or before the specified date. in: query name: filter[modified_at][end] required: false schema: example: '2020-11-24T18:46:21+00:00' type: string x-merge-override: format: false IncidentTeamIDPathParameter: description: The ID of the incident team. in: path name: team_id required: true schema: type: string IncidentServiceIDPathParameter: description: The ID of the incident service. in: path name: service_id required: true schema: type: string ApplicationKeysSortParameter: description: 'Application key attribute used to sort results. Sort order is ascending by default. In order to specify a descending sort, prefix the attribute with a minus sign.' in: query name: sort required: false schema: $ref: '#/components/schemas/ApplicationKeysSort' HistoricalJobID: description: The ID of the job. in: path name: job_id required: true schema: type: string CustomFrameworkVersion: description: The framework version in: path name: version required: true schema: type: string SecurityMonitoringSuppressionID: description: The ID of the suppression rule in: path name: suppression_id required: true schema: type: string MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter: description: Your Workflows webhook handle id. in: path name: handle_id required: true schema: type: string SignalID: description: The ID of the signal. in: path name: signal_id required: true schema: type: string APIKeyFilterParameter: description: Filter API keys by the specified string. in: query name: filter required: false schema: type: string IncidentServiceSearchQueryParameter: description: A search query that filters services by name. in: query name: filter required: false schema: example: ExampleServiceName type: string InstanceId: description: The ID of the workflow instance. in: path name: instance_id required: true schema: type: string FilterByRelationType: description: Filter entities by relation type. explode: true in: query name: filter[relation][type] required: false schema: $ref: '#/components/schemas/RelationType' ApplicationKeyID: description: The ID of the application key. in: path name: app_key_id required: true schema: type: string ApplicationKeyIncludeParameter: description: Resource path for related resources to include in the response. Only `owned_by` is supported. in: query name: include required: false schema: example: owned_by type: string FastlyServiceID: description: Fastly Service ID. in: path name: service_id required: true schema: type: string RestrictionQueryID: description: The ID of the restriction query. in: path name: restriction_query_id required: true schema: type: string APIKeyReadConfigReadEnabledParameter: description: Filter API keys by remote config read enabled status. in: query name: filter[remote_config_read_enabled] required: false schema: type: boolean OnDemandTaskId: description: The UUID of the task. example: 6d09294c-9ad9-42fd-a759-a0c1599b4828 in: path name: task_id required: true schema: type: string UserID: description: The ID of the user. in: path name: user_id required: true schema: example: 00000000-0000-9999-0000-000000000000 type: string IncidentTypeIDPathParameter: description: The UUID of the incident type. in: path name: incident_type_id required: true schema: type: string SchemaVersion: description: The schema version desired in the response. in: query name: schema_version required: false schema: $ref: '#/components/schemas/ServiceDefinitionSchemaVersions' IncidentTodoIDPathParameter: description: The UUID of the incident todo. in: path name: todo_id required: true schema: type: string WorkflowId: description: The ID of the workflow. in: path name: workflow_id required: true schema: type: string FilterByKind: description: Filter entities by kind. explode: true in: query name: filter[kind] required: false schema: type: string IncidentAttachmentIncludeQueryParameter: description: Specifies which types of related objects are included in the response. explode: false in: query name: include required: false schema: items: $ref: '#/components/schemas/IncidentAttachmentRelatedObject' type: array MicrosoftTeamsTenantNamePathParameter: description: Your tenant name. in: path name: tenant_name required: true schema: type: string SecurityFilterID: description: The ID of the security filter. in: path name: security_filter_id required: true schema: type: string MicrosoftTeamsTeamNamePathParameter: description: Your team name. in: path name: team_name required: true schema: type: string BudgetID: description: Budget id. in: path name: budget_id required: true schema: type: string IncidentIDPathParameter: description: The UUID of the incident. in: path name: incident_id required: true schema: type: string APIKeyIncludeParameter: description: Comma separated list of resource paths for related resources to include in the response. Supported resource paths are `created_by` and `modified_by`. in: query name: include required: false schema: example: created_by,modified_by type: string IncidentIntegrationMetadataIDPathParameter: description: The UUID of the incident integration metadata. in: path name: integration_metadata_id required: true schema: type: string SpansMetricIDParameter: description: The name of the span-based metric. in: path name: metric_id required: true schema: type: string OpsgenieServiceIDPathParameter: description: The UUID of the service. in: path name: integration_service_id required: true schema: type: string IncidentServiceIncludeQueryParameter: description: Specifies which types of related objects should be included in the response. in: query name: include required: false schema: $ref: '#/components/schemas/IncidentRelatedObject' ResourceID: description: 'Identifier, formatted as `type:id`. Supported types: `connection`, `dashboard`, `integration-account`, `integration-service`, `integration-webhook`, `notebook`, `reference-table`, `security-rule`, `slo`, `workflow`, `app-builder-app`, `connection`, `connection-group`, `rum-application`.' example: dashboard:abc-def-ghi in: path name: resource_id required: true schema: type: string AuthNMappingID: description: The UUID of the AuthN Mapping. in: path name: authn_mapping_id required: true schema: type: string FilterByName: description: Filter entities by name. explode: true in: query name: filter[name] required: false schema: type: string RestrictionQueryRoleID: description: The ID of the role. in: path name: role_id required: true schema: type: string APIKeyCategoryParameter: description: Filter API keys by category. in: query name: filter[category] required: false schema: type: string RumApplicationIDParameter: description: RUM application ID. in: path name: app_id required: true schema: type: string CustomFrameworkHandle: description: The framework handle in: path name: handle required: true schema: type: string ApplicationKeyFilterCreatedAtStartParameter: description: Only include application keys created on or after the specified date. in: query name: filter[created_at][start] required: false schema: example: '2020-11-24T18:46:21+00:00' type: string x-merge-override: format: false MetricID: description: The name of the log-based metric. in: path name: metric_id required: true schema: type: string RoleID: description: The unique identifier of the role. in: path name: role_id required: true schema: type: string ApplicationSecurityWafExclusionFilterID: description: The identifier of the WAF exclusion filter. example: 3b5-v82-ns6 in: path name: exclusion_filter_id required: true schema: type: string APIKeyId: description: The ID of the API key. in: path name: api_key_id required: true schema: type: string CloudWorkloadSecurityAgentRuleID: description: The ID of the Agent rule example: 3b5-v82-ns6 in: path name: agent_rule_id required: true schema: type: string RelationInclude: description: Include relationship data. explode: true in: query name: include required: false schema: $ref: '#/components/schemas/RelationIncludeType' IncidentAttachmentFilterQueryParameter: description: Specifies which types of attachments are included in the response. explode: false in: query name: filter[attachment_type] required: false schema: items: $ref: '#/components/schemas/IncidentAttachmentAttachmentType' type: array IncidentTeamSearchQueryParameter: description: A search query that filters teams by name. in: query name: filter required: false schema: example: ExampleTeamName type: string ArchiveID: description: The ID of the archive. in: path name: archive_id required: true schema: type: string APIKeyFilterModifiedAtStartParameter: description: Only include API keys modified on or after the specified date. in: query name: filter[modified_at][start] required: false schema: example: '2020-11-24T18:46:21+00:00' type: string x-merge-override: format: false MicrosoftTeamsHandleNameQueryParameter: description: Your tenant-based handle name. in: query name: name required: false schema: type: string ConfluentAccountID: description: Confluent Account ID. in: path name: account_id required: true schema: type: string PageNumber: description: Specific page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 type: integer ConnectionId: description: The ID of the action connection in: path name: connection_id required: true schema: type: string RetentionFilterIdParam: description: The ID of the retention filter. in: path name: filter_id required: true schema: type: string RumRetentionFilterIDParameter: description: Retention filter ID. in: path name: rf_id required: true schema: type: string ConfluentResourceID: description: Confluent Account Resource ID. in: path name: resource_id required: true schema: type: string IncidentIncludeQueryParameter: description: Specifies which types of related objects should be included in the response. explode: false in: query name: include required: false schema: items: $ref: '#/components/schemas/IncidentRelatedObject' type: array FilterRelationByToRef: description: Filter relations by the reference of the second entity in the relation. example: service:shopping-cart explode: true in: query name: filter[to_ref] required: false schema: type: string FilterByExcludeSnapshot: description: Filter entities by excluding snapshotted entities. in: query name: filter[exclude_snapshot] required: false schema: type: string FilterByID: description: Filter entities by UUID. explode: true in: query name: filter[id] required: false schema: type: string APIKeyFilterCreatedAtEndParameter: description: Only include API keys created on or before the specified date. in: query name: filter[created_at][end] required: false schema: example: '2020-11-24T18:46:21+00:00' type: string x-merge-override: format: false FilterByRef: description: Filter entities by reference example: service:shopping-cart explode: true in: query name: filter[ref] required: false schema: type: string FileID: description: File ID. in: path name: file_id required: true schema: type: string FilterByOwner: description: Filter entities by owner. explode: true in: query name: filter[owner] required: false schema: type: string MicrosoftTeamsTenantBasedHandleIDPathParameter: description: Your tenant-based handle id. in: path name: handle_id required: true schema: type: string AWSAccountConfigIDPathParameter: description: 'Unique Datadog ID of the AWS Account Integration Config. To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations) endpoint and query by AWS Account ID.' in: path name: aws_account_config_id required: true schema: type: string APIKeyFilterCreatedAtStartParameter: description: Only include API keys created on or after the specified date. in: query name: filter[created_at][start] required: false schema: example: '2020-11-24T18:46:21+00:00' type: string x-merge-override: format: false OrgConfigName: description: The name of an Org Config. in: path name: org_config_name required: true schema: example: monitor_timezone type: string ReportID: description: The ID of the report job. in: path name: report_id required: true schema: type: string PageSize: description: Size for a given page. The maximum allowed value is 100. in: query name: page[size] required: false schema: default: 10 example: 10 format: int64 type: integer CloudWorkloadSecurityPathAgentPolicyID: description: The ID of the Agent policy example: 6517fcc1-cec7-4394-a655-8d6e9d085255 in: path name: policy_id required: true schema: type: string APIKeysSortParameter: description: 'API key attribute used to sort results. Sort order is ascending by default. In order to specify a descending sort, prefix the attribute with a minus sign.' in: query name: sort required: false schema: $ref: '#/components/schemas/APIKeysSort' MicrosoftTeamsWorkflowsWebhookHandleNameQueryParameter: description: Your Workflows webhook handle name. in: query name: name required: false schema: type: string ApplicationKeyFilterParameter: description: Filter application keys by the specified string. in: query name: filter required: false schema: type: string CaseIDPathParameter: description: Case's UUID or key example: f98a5a5b-e0ff-45d4-b2f5-afe6e74de504 in: path name: case_id required: true schema: type: string CloudWorkloadSecurityQueryAgentPolicyID: description: The ID of the Agent policy example: 6517fcc1-cec7-4394-a655-8d6e9d085255 in: query name: policy_id required: false schema: type: string RestrictionQueryUserID: description: The ID of the user. in: path name: user_id required: true schema: type: string responses: PreconditionFailedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Failed Precondition FindingsTooManyRequestsResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Too many requests: The rate limit set by the API has been exceeded.' NotAuthorizedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Authorized ForbiddenResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden SpansForbiddenResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Forbidden: Access denied.' SpansTooManyRequestsResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Too many requests: The rate limit set by the API has been exceeded.' TooManyRequestsResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests UnauthorizedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Unauthorized NotificationRulesList: content: application/json: schema: properties: data: items: $ref: '#/components/schemas/NotificationRule' type: array type: object description: The list of notification rules. FindingsNotFoundResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Not Found: The requested finding cannot be found.' NotFoundResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found FindingsBadRequestResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Bad Request: The server cannot process the request due to invalid syntax in the request.' SpansBadRequestResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request. ConflictResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Conflict SpansUnprocessableEntityResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Unprocessable Entity. FindingsForbiddenResponse: content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: 'Forbidden: Access denied' BadRequestResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request securitySchemes: AuthZ: description: This API uses OAuth 2 with the implicit grant flow. flows: authorizationCode: authorizationUrl: /oauth2/v1/authorize scopes: apm_api_catalog_read: View API catalog and API definitions. apm_api_catalog_write: Add, modify, and delete API catalog definitions. apm_read: Read and query APM and Trace Analytics. apm_service_catalog_read: View service catalog and service definitions. apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog. appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source. cases_read: View Cases. cases_write: Create and update cases. ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API. ci_visibility_read: View CI Visibility. cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs. cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs. code_analysis_read: View Code Analysis. continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO). create_webhooks: Create webhooks integrations. dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'. dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'. dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally. dashboards_read: View dashboards. dashboards_write: Create and change dashboards. data_scanner_read: View Data Scanner configurations. data_scanner_write: Edit Data Scanner configurations. embeddable_graphs_share: Generate public links to share embeddable graphs externally. events_read: Read Events data. hosts_read: List hosts and their attributes. incident_notification_settings_write: Configure Incidents Notification settings. incident_read: View incidents in Datadog. incident_settings_write: Configure Incident Settings. incident_write: Create, view, and manage incidents in Datadog. metrics_read: View custom metrics. monitor_config_policy_write: Edit and delete monitor configuration. monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes. monitors_read: View monitors. monitors_write: Edit, delete, and resolve individual monitors. org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization. security_comments_read: Read comments of vulnerabilities. security_monitoring_filters_read: Read Security Filters. security_monitoring_filters_write: Create, edit, and delete Security Filters. security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks. security_monitoring_notification_profiles_read: View Rule Security Notification rules. security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules. security_monitoring_rules_read: Read Detection Rules. security_monitoring_rules_write: Create and edit Detection Rules. security_monitoring_signals_read: View Security Signals. security_monitoring_suppressions_read: Read Rule Suppressions. security_monitoring_suppressions_write: Write Rule Suppressions. security_pipelines_read: View Security Pipelines. security_pipelines_write: Create, edit, and delete CSM Security Pipelines. slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs. slos_read: View SLOs and status corrections. slos_write: Create, edit, and delete SLOs. synthetics_global_variable_read: View, search, and use Synthetics global variables. synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics. synthetics_private_location_read: View, search, and use Synthetics private locations. synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines. synthetics_read: List and view configured Synthetic tests and test results. synthetics_write: Create, edit, and delete Synthetic tests. teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission. teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team. test_optimization_read: View Test Optimization. timeseries_query: Query Timeseries data. usage_read: View your organization's usage and usage attribution. user_access_invite: Invite other users to your organization. user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries. user_access_read: View users and their roles and settings. workflows_read: View workflows. workflows_run: Run workflows. workflows_write: Create, edit, and delete workflows. tokenUrl: /oauth2/v1/token type: oauth2 apiKeyAuth: description: Your Datadog API Key. in: header name: DD-API-KEY type: apiKey x-env-name: DD_API_KEY appKeyAuth: description: Your Datadog APP Key. in: header name: DD-APPLICATION-KEY type: apiKey x-env-name: DD_APP_KEY bearerAuth: scheme: bearer type: http x-env-name: DD_BEARER_TOKEN x-group-parameters: true x-merge-override: paths: false