openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Lists API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Lists
paths:
  /api/v2/apicatalog/api:
    get:
      deprecated: true
      description: List APIs and their IDs.
      operationId: ListAPIs
      parameters:
      - description: Filter APIs by name
        in: query
        name: query
        required: false
        schema:
          example: payments
          type: string
        example: payments
      - description: Number of items per page.
        in: query
        name: page[limit]
        required: false
        schema:
          default: 20
          format: int64
          minimum: 1
          type: integer
        example: 42
      - description: Offset for pagination.
        in: query
        name: page[offset]
        required: false
        schema:
          default: 0
          format: int64
          minimum: 0
          type: integer
        example: 42
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAPIsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_api_catalog_read
      summary: Datadog List Apis
      tags:
      - Lists
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - apm_api_catalog_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/apm/config/retention-filters:
    get:
      description: Get the list of APM retention filters.
      operationId: ListApmRetentionFilters
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RetentionFiltersResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Apm Retention Filters
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - apm_retention_filter_read
        - apm_pipelines_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/app-builder/apps:
    get:
      description: List all apps, with optional filters and sorting. This endpoint is paginated. Only basic app information such as the app ID, name, and description is returned by this endpoint.
      operationId: ListApps
      parameters:
      - description: The number of apps to return per page.
        in: query
        name: limit
        required: false
        schema:
          format: int64
          type: integer
        example: 42
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          format: int64
          type: integer
        example: 42
      - description: Filter apps by the app creator. Usually the user's email.
        in: query
        name: filter[user_name]
        required: false
        schema:
          type: string
        example: Example Monitor
      - description: Filter apps by the app creator's UUID.
        example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
        in: query
        name: filter[user_uuid]
        required: false
        schema:
          format: uuid
          type: string
      - description: Filter by app name.
        in: query
        name: filter[name]
        required: false
        schema:
          type: string
        example: Example Monitor
      - description: Filter apps by the app name or the app creator.
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
        example: avg:system.cpu.user{*}
      - description: Filter apps by whether they are published.
        in: query
        name: filter[deployed]
        required: false
        schema:
          type: boolean
        example: true
      - description: Filter apps by tags.
        in: query
        name: filter[tags]
        required: false
        schema:
          type: string
        example: env:production
      - description: Filter apps by whether you have added them to your favorites.
        in: query
        name: filter[favorite]
        required: false
        schema:
          type: boolean
        example: true
      - description: Filter apps by whether they are enabled for self-service.
        in: query
        name: filter[self_service]
        required: false
        schema:
          type: boolean
        example: true
      - description: The fields and direction to sort apps by.
        explode: false
        in: query
        name: sort
        required: false
        schema:
          items:
            $ref: '#/components/schemas/AppsSortField'
          type: array
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAppsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Apps
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - apps_run
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/audit/events:
    get:
      description: 'List endpoint returns events that match a Audit Logs search query.

        [Results are paginated][1].


        Use this endpoint to see your latest Audit Logs events.


        [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination'
      operationId: ListAuditLogs
      parameters:
      - description: Search query following Audit Logs syntax.
        example: '@type:session @application_id:xxxx'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: Minimum timestamp for requested events.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: Maximum timestamp for requested events.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: Order of events in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/AuditLogsSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of events in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogsEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a List of Audit Logs Events
      tags:
      - Lists
      x-menu-order: 2
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - audit_logs_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/authn_mappings:
    x-merge-override:
      get: false
      post: false
    get:
      description: List all AuthN Mappings in the org.
      operationId: ListAuthNMappings
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - description: Sort AuthN Mappings depending on the given field.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/AuthNMappingsSort'
        example: example_value
      - description: Filter all mappings by the given string.
        in: query
        name: filter
        required: false
        schema:
          type: string
        example: example_value
      - description: Filter by mapping resource type. Defaults to "role" if not specified.
        in: query
        name: resource_type
        schema:
          $ref: '#/components/schemas/AuthNMappingResourceType'
        example: metric alert
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthNMappingsResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Authn Mappings
      tags:
      - Lists
      x-menu-order: 4
      x-permission:
        operator: OPEN
        permissions: []
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/catalog/entity:
    get:
      description: Get a list of entities from Software Catalog.
      operationId: ListCatalogEntity
      parameters:
      - $ref: '#/components/parameters/PageOffset'
      - description: Maximum number of entities in the response.
        example: 100
        in: query
        name: page[limit]
        required: false
        schema:
          default: 100
          format: int64
          type: integer
      - $ref: '#/components/parameters/FilterByID'
      - $ref: '#/components/parameters/FilterByRef'
      - $ref: '#/components/parameters/FilterByName'
      - $ref: '#/components/parameters/FilterByKind'
      - $ref: '#/components/parameters/FilterByOwner'
      - $ref: '#/components/parameters/FilterByRelationType'
      - $ref: '#/components/parameters/FilterByExcludeSnapshot'
      - $ref: '#/components/parameters/Include'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListEntityCatalogResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog Get a List of Entities
      tags:
      - Lists
      x-menu-order: 1
      x-pagination:
        limitParam: page[limit]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/catalog/relation:
    get:
      description: Get a list of entity relations from Software Catalog.
      operationId: ListCatalogRelation
      parameters:
      - $ref: '#/components/parameters/PageOffset'
      - description: Maximum number of relations in the response.
        example: 100
        in: query
        name: page[limit]
        required: false
        schema:
          default: 100
          format: int64
          type: integer
      - $ref: '#/components/parameters/FilterRelationByType'
      - $ref: '#/components/parameters/FilterRelationByFromRef'
      - $ref: '#/components/parameters/FilterRelationByToRef'
      - $ref: '#/components/parameters/RelationInclude'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRelationCatalogResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog Get a List of Entity Relations
      tags:
      - Lists
      x-menu-order: 3
      x-pagination:
        limitParam: page[limit]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ci/pipelines/events:
    get:
      description: 'List endpoint returns CI Visibility pipeline events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/).

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to see your latest pipeline events.'
      operationId: ListCIAppPipelineEvents
      parameters:
      - description: Search query following log syntax.
        example: '@ci.provider.name:github @ci.pipeline.name:Pull Request Labeler'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: Minimum timestamp for requested events.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: Maximum timestamp for requested events.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: Order of events in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/CIAppSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of events in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppPipelineEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Get a List of Pipelines Events
      tags:
      - Lists
      x-menu-order: 2
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ci/tests/events:
    get:
      description: 'List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/).

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to see your latest test events.'
      operationId: ListCIAppTestEvents
      parameters:
      - description: Search query following log syntax.
        example: '@test.name:test_foo @test.suite:github.com/DataDog/dd-go/model'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: Minimum timestamp for requested events.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: Maximum timestamp for requested events.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: Order of events in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/CIAppSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of events in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppTestEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Get a List of Tests Events
      tags:
      - Lists
      x-menu-order: 1
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cloud_security_management/resource_filters:
    get:
      description: List resource filters.
      operationId: GetResourceEvaluationFilters
      parameters:
      - $ref: '#/components/parameters/ResourceFilterProvider'
      - $ref: '#/components/parameters/ResourceFilterAccountID'
      - $ref: '#/components/parameters/SkipCache'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResourceEvaluationFiltersResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_read
      summary: Datadog List Resource Filters
      tags:
      - Lists
      x-menu-order: 26
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/aws_cur_config:
    get:
      description: List the AWS CUR configs.
      operationId: ListCostAWSCURConfigs
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AwsCURConfigsResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_read
      summary: Datadog List Cloud Cost Management Aws Cur Configs
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - cloud_cost_management_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/azure_uc_config:
    get:
      description: List the Azure configs.
      operationId: ListCostAzureUCConfigs
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureUCConfigsResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_read
      summary: Datadog List Cloud Cost Management Azure Configs
      tags:
      - Lists
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - cloud_cost_management_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/budgets:
    get:
      description: List budgets.
      operationId: ListBudgets
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BudgetArray'
          description: OK
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_read
      summary: Datadog List Budgets
      tags:
      - Lists
      x-menu-order: 17
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/custom_costs:
    get:
      description: List the Custom Costs files.
      operationId: ListCustomCostsFiles
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomCostsFileListResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_read
      summary: Datadog List Custom Costs Files
      tags:
      - Lists
      x-menu-order: 10
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/dashboard/lists/manual/{dashboard_list_id}/dashboards:
    delete:
      description: Delete dashboards from an existing dashboard list.
      operationId: DeleteDashboardListItems
      parameters:
      - description: ID of the dashboard list to delete items from.
        in: path
        name: dashboard_list_id
        required: true
        schema:
          format: int64
          type: integer
        example: 42
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DashboardListDeleteItemsRequest'
        description: Dashboards to delete from the dashboard list.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DashboardListDeleteItemsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete Items from a Dashboard List
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Fetch the dashboard list’s dashboard definitions.
      operationId: GetDashboardListItems
      parameters:
      - description: ID of the dashboard list to get items from.
        in: path
        name: dashboard_list_id
        required: true
        schema:
          format: int64
          type: integer
        example: 42
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DashboardListItems'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - dashboards_read
      summary: Datadog Get Items of a Dashboard List
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - dashboards_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Add dashboards to an existing dashboard list.
      operationId: CreateDashboardListItems
      parameters:
      - description: ID of the dashboard list to add items to.
        in: path
        name: dashboard_list_id
        required: true
        schema:
          format: int64
          type: integer
        example: 42
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DashboardListAddItemsRequest'
        description: Dashboards to add to the dashboard list.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DashboardListAddItemsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Add Items to a Dashboard List
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-given:
        dashboard_list_dashboard:
          parameters:
          - name: dashboard_list_id
            source: dashboard_list.id
          - name: body
            value: "{\n  \"dashboards\": [\n    {\n      \"id\": \"{{ dashboard.id }}\",\n      \"type\": \"custom_timeboard\"\n    }\n  ]\n}"
          step: the "dashboard_list" has the "dashboard"
        dashboard_list_screenboard_dashboard:
          parameters:
          - name: dashboard_list_id
            source: dashboard_list.id
          - name: body
            value: "{\n  \"dashboards\": [\n    {\n      \"id\": \"{{ screenboard_dashboard.id }}\",\n      \"type\": \"custom_screenboard\"\n    }\n  ]\n}"
          step: the "dashboard_list" has the "screenboard_dashboard"
      x-menu-order: 2
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: Update dashboards of an existing dashboard list.
      operationId: UpdateDashboardListItems
      parameters:
      - description: ID of the dashboard list to update items from.
        in: path
        name: dashboard_list_id
        required: true
        schema:
          format: int64
          type: integer
        example: 42
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DashboardListUpdateItemsRequest'
        description: New dashboards of the dashboard list.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DashboardListUpdateItemsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Items of a Dashboard List
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/dora/deployments:
    post:
      description: Use this API endpoint to get a list of deployment events.
      operationId: ListDORADeployments
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DORAListDeploymentsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DORAListResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      summary: Datadog Get a List of Deployment Events
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - dora_metrics_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/dora/failures:
    post:
      description: Use this API endpoint to get a list of failure events.
      operationId: ListDORAFailures
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DORAListFailuresRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DORAListResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      summary: Datadog Get a List of Failure Events
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - dora_metrics_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/events:
    x-merge-override:
      get: false
      post: false
    get:
      description: 'List endpoint returns events that match an events search query.

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to see your latest events.'
      operationId: ListEvents
      parameters:
      - description: Search query following events syntax.
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
        example: avg:system.cpu.user{*}
      - description: Minimum timestamp for requested events, in milliseconds.
        in: query
        name: filter[from]
        required: false
        schema:
          type: string
        example: example_value
      - description: Maximum timestamp for requested events, in milliseconds.
        in: query
        name: filter[to]
        required: false
        schema:
          type: string
        example: example_value
      - description: Order of events in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/EventsSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of events in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventsListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - events_read
      summary: Datadog Get a List of Events
      tags:
      - Lists
      x-menu-order: 1
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - events_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents:
    get:
      description: Get all incidents for the user's organization.
      operationId: ListIncidents
      parameters:
      - $ref: '#/components/parameters/IncidentIncludeQueryParameter'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Get a List of Incidents
      tags:
      - Lists
      x-menu-order: 5
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/config/types:
    get:
      description: Get all incident types.
      operationId: ListIncidentTypes
      parameters:
      - $ref: '#/components/parameters/IncidentTypeIncludeDeletedParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTypeListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Get a List of Incident Types
      tags:
      - Lists
      x-menu-order: 20
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/attachments:
    get:
      description: Get all attachments for a given incident.
      operationId: ListIncidentAttachments
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentAttachmentIncludeQueryParameter'
      - $ref: '#/components/parameters/IncidentAttachmentFilterQueryParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentAttachmentsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a List of Attachments
      tags:
      - Lists
      x-menu-order: 7
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/relationships/integrations:
    get:
      description: Get all integration metadata for an incident.
      operationId: ListIncidentIntegrations
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentIntegrationMetadataListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Get a List of an Incident's Integration Metadata
      tags:
      - Lists
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/relationships/todos:
    get:
      description: Get all todos for an incident.
      operationId: ListIncidentTodos
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTodoListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Get a List of an Incident's Todos
      tags:
      - Lists
      x-menu-order: 14
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/aws/accounts:
    get:
      description: Get a list of AWS Account Integration Configs.
      operationId: ListAWSAccounts
      parameters:
      - description: Optional query parameter to filter accounts by AWS Account ID. If not provided, all accounts are returned.
        example: '123456789012'
        in: query
        name: aws_account_id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSAccountsResponse'
          description: AWS Accounts List object
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Aws Integrations
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - aws_configuration_read
      x-undo:
        type: safe
      x-unstable: '**Note: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).**'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/aws/available_namespaces:
    get:
      description: Get a list of available AWS CloudWatch namespaces that can send metrics to Datadog.
      operationId: ListAWSNamespaces
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSNamespacesResponse'
          description: AWS Namespaces List object
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Available Namespaces
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - aws_configuration_read
      x-undo:
        type: safe
      x-unstable: '**Note: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).**'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/aws/logs/services:
    get:
      description: Get a list of AWS services that can send logs to Datadog.
      operationId: ListAWSLogsServices
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSLogsServicesResponse'
          description: AWS Logs Services List object
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get List of Aws Log Ready Services
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - aws_configuration_read
      x-undo:
        type: safe
      x-unstable: '**Note: This endpoint is in public beta. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).**'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/gcp/accounts:
    x-merge-override:
      get: false
      post: false
    get:
      description: List all GCP STS-enabled service accounts configured in your Datadog account.
      operationId: ListGCPSTSAccounts
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GCPSTSServiceAccountsResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Gcp Sts-enabled Service Accounts
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - gcp_configuration_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/gcp/sts_delegate:
    get:
      description: List your Datadog-GCP STS delegate account configured in your Datadog account.
      operationId: GetGCPSTSDelegate
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GCPSTSDelegateAccountResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Delegate Account
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - gcp_configuration_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/cloudflare/accounts:
    x-merge-override:
      get: true
    get:
      description: List Cloudflare accounts.
      operationId: ListCloudflareAccounts
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudflareAccountsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Cloudflare Accounts
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - integrations_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/confluent-cloud/accounts:
    get:
      description: List Confluent accounts.
      operationId: ListConfluentAccount
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfluentAccountsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Confluent Accounts
      tags:
      - Lists
      x-menu-order: 10
      x-permission:
        operator: OR
        permissions:
        - integrations_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/confluent-cloud/accounts/{account_id}/resources:
    get:
      description: Get a Confluent resource for the account associated with the provided ID.
      operationId: ListConfluentResource
      parameters:
      - $ref: '#/components/parameters/ConfluentAccountID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfluentResourcesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Confluent Account Resources
      tags:
      - Lists
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - integrations_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/fastly/accounts:
    x-merge-override:
      get: true
    get:
      description: List Fastly accounts.
      operationId: ListFastlyAccounts
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FastlyAccountsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Fastly Accounts
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - integrations_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/fastly/accounts/{account_id}/services:
    x-merge-override:
      get: true
      post: true
    get:
      description: List Fastly services for an account.
      operationId: ListFastlyServices
      parameters:
      - $ref: '#/components/parameters/FastlyAccountID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FastlyServicesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Fastly Services
      tags:
      - Lists
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - integrations_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/okta/accounts:
    x-merge-override:
      get: true
    get:
      description: List Okta accounts.
      operationId: ListOktaAccounts
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OktaAccountsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Okta Accounts
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - integrations_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/archives/{archive_id}/readers:
    get:
      description: Returns all read roles a given archive is restricted to.
      operationId: ListArchiveReadRoles
      parameters:
      - $ref: '#/components/parameters/ArchiveID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolesResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Read Roles for an Archive
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - logs_read_config
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/restriction_queries:
    get:
      description: Returns all restriction queries, including their names and IDs.
      operationId: ListRestrictionQueries
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestrictionQueryListResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Restriction Queries
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - logs_read_config
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/restriction_queries/{restriction_query_id}/roles:
    get:
      description: Returns all roles that have a given restriction query.
      operationId: ListRestrictionQueryRoles
      parameters:
      - $ref: '#/components/parameters/RestrictionQueryID'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestrictionQueryRolesResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Roles for a Restriction Query
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - logs_read_config
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/metrics:
    get:
      description: 'Returns all metrics that can be configured in the Metrics Summary page or with Metrics without Limits™ (matching additional filters if specified).

        Optionally, paginate by using the `page[cursor]` and/or `page[size]` query parameters.

        To fetch the first page, pass in a query parameter with either a valid `page[size]` or an empty cursor like `page[cursor]=`. To fetch the next page, pass in the `next_cursor` value from the response as the new `page[cursor]` value.

        Once the `meta.pagination.next_cursor` value is null, all pages have been retrieved.'
      operationId: ListTagConfigurations
      parameters:
      - description: Filter custom metrics that have configured tags.
        example: true
        in: query
        name: filter[configured]
        required: false
        schema:
          type: boolean
      - description: Filter tag configurations by configured tags.
        example: app
        in: query
        name: filter[tags_configured]
        required: false
        schema:
          description: Tag keys to filter by.
          type: string
      - description: Filter metrics by metric type.
        in: query
        name: filter[metric_type]
        required: false
        schema:
          $ref: '#/components/schemas/MetricTagConfigurationMetricTypeCategory'
        example: metric alert
      - description: 'Filter distributions with additional percentile

          aggregations enabled or disabled.'
        example: true
        in: query
        name: filter[include_percentiles]
        required: false
        schema:
          type: boolean
      - description: '(Preview) Filter custom metrics that have or have not been queried in the specified window[seconds].

          If no window is provided or the window is less than 2 hours, a default of 2 hours will be applied.'
        example: true
        in: query
        name: filter[queried]
        required: false
        schema:
          type: boolean
      - description: 'Filter metrics that have been submitted with the given tags. Supports boolean and wildcard expressions.

          Can only be combined with the filter[queried] filter.'
        example: env IN (staging,test) AND service:web
        in: query
        name: filter[tags]
        required: false
        schema:
          type: string
      - description: (Preview) Filter metrics that are used in dashboards, monitors, notebooks, SLOs.
        example: true
        in: query
        name: filter[related_assets]
        required: false
        schema:
          type: boolean
      - description: 'The number of seconds of look back (from now) to apply to a filter[tag] or filter[queried] query.

          Default value is 3600 (1 hour), maximum value is 2,592,000 (30 days).'
        example: 3600
        in: query
        name: window[seconds]
        required: false
        schema:
          format: int64
          type: integer
      - description: Maximum number of results returned.
        in: query
        name: page[size]
        required: false
        schema:
          default: 10000
          format: int32
          maximum: 10000
          minimum: 1
          type: integer
        example: 42
      - description: 'String to query the next page of results.

          This key is provided with each valid response from the API in `meta.pagination.next_cursor`.

          Once the `meta.pagination.next_cursor` key is null, all pages have been retrieved.'
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
        example: example_value
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricsAndMetricTagConfigurationsResponse'
          description: Success
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too Many Requests
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - metrics_read
      summary: Datadog Get a List of Metrics
      tags:
      - Lists
      x-menu-order: 5
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.pagination.next_cursor
        limitParam: page[size]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - metrics_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/metrics/{metric_name}/active-configurations:
    get:
      description: List tags and aggregations that are actively queried on dashboards, notebooks, monitors, the Metrics Explorer, and using the API for a given metric name.
      operationId: ListActiveMetricConfigurations
      parameters:
      - $ref: '#/components/parameters/MetricName'
      - description: 'The number of seconds of look back (from now).

          Default value is 604,800 (1 week), minimum value is 7200 (2 hours), maximum value is 2,630,000 (1 month).'
        example: 7200
        in: query
        name: window[seconds]
        required: false
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricSuggestedTagsAndAggregationsResponse'
          description: Success
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too Many Requests
      summary: Datadog List Active Tags and Aggregations
      tags:
      - Lists
      x-menu-order: 7
      x-permission:
        operator: OR
        permissions:
        - metrics_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/metrics/{metric_name}/all-tags:
    get:
      description: View indexed tag key-value pairs for a given metric name over the previous hour.
      operationId: ListTagsByMetricName
      parameters:
      - $ref: '#/components/parameters/MetricName'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricAllTagsResponse'
          description: Success
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too Many Requests
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - metrics_read
      summary: Datadog List Tags by Metric Name
      tags:
      - Lists
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - metrics_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/metrics/{metric_name}/tags:
    get:
      description: Returns the tag configuration for the given metric name.
      operationId: ListTagConfigurationByName
      parameters:
      - $ref: '#/components/parameters/MetricName'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricTagConfigurationResponse'
          description: Success
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too Many Requests
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - metrics_read
      summary: Datadog List Tag Configuration by Name
      tags:
      - Lists
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - metrics_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/metrics/{metric_name}/volumes:
    get:
      description: 'View distinct metrics volumes for the given metric name.


        Custom metrics generated in-app from other products will return `null` for ingested volumes.'
      operationId: ListVolumesByMetricName
      parameters:
      - $ref: '#/components/parameters/MetricName'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricVolumesResponse'
          description: Success
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too Many Requests
      summary: Datadog List Distinct Metric Volumes by Metric Name
      tags:
      - Lists
      x-menu-order: 8
      x-permission:
        operator: OPEN
        permissions: []
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ndm/devices:
    get:
      description: Get the list of devices.
      operationId: ListDevices
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - description: The field to sort the devices by.
        example: status
        in: query
        name: sort
        required: false
        schema:
          type: string
      - description: Filter devices by tag.
        example: status:ok
        in: query
        name: filter[tag]
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListDevicesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get the List of Devices
      tags:
      - Lists
      x-menu-order: 1
      x-pagination:
        limitParam: page[size]
        pageParam: page[number]
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ndm/interfaces:
    get:
      description: Get the list of interfaces of the device.
      operationId: GetInterfaces
      parameters:
      - description: The ID of the device to get interfaces from.
        example: example:1.2.3.4
        in: query
        name: device_id
        required: true
        schema:
          type: string
      - description: Whether to get the IP addresses of the interfaces.
        example: true
        in: query
        name: get_ip_addresses
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetInterfacesResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get the List of Interfaces of the Device
      tags:
      - Lists
      x-menu-order: 3
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ndm/tags/devices/{device_id}:
    get:
      description: Get the list of tags for a device.
      operationId: ListDeviceUserTags
      parameters:
      - description: The id of the device to fetch tags for.
        example: example:1.2.3.4
        in: path
        name: device_id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTagsResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get the List of Tags for a Device
      tags:
      - Lists
      x-menu-order: 4
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/org_configs:
    get:
      description: Returns all Org Configs (name, description, and value).
      operationId: ListOrgConfigs
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgConfigListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Org Configs
      tags:
      - Lists
      x-menu-order: 100
      x-permission:
        operator: OPEN
        permissions: []
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/permissions:
    get:
      description: Returns a list of all permissions, including name, description, and ID.
      operationId: ListPermissions
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_read
      summary: Datadog List Permissions
      tags:
      - Lists
      x-given:
        permission:
          source: data[4]
          step: there is a valid "permission" in the system
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - user_access_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/posture_management/findings:
    get:
      description: "Get a list of findings. These include both misconfigurations and identity risks.\n\n**Note**: To filter and return only identity risks, add the following query parameter: `?filter[tags]=dd_rule_type:ciem`\n\n### Filtering\n\nFilters can be applied by appending query parameters to the URL.\n\n  - Using a single filter: `?filter[attribute_key]=attribute_value`\n  - Chaining filters: `?filter[attribute_key]=attribute_value&filter[attribute_key]=attribute_value...`\n  - Filtering on tags: `?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2`\n\nHere, `attribute_key` can be any of the filter keys described further below.\n\nQuery parameters of type `integer` support comparison operators (`>`, `>=`, `<`, `<=`). This is particularly useful when filtering by `evaluation_changed_at` or `resource_discovery_timestamp`. For example: `?filter[evaluation_changed_at]=>20123123121`.\n\nYou can also use the negation operator on strings. For example, use `filter[resource_type]=-aws*` to filter for any non-AWS resources.\n\nThe operator must come after the equal sign. For example, to filter with the `>=` operator, add the operator after the equal sign: `filter[evaluation_changed_at]=>=1678809373257`.\n\nQuery parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. `filter[status]=low&filter[status]=info`) are not allowed.\n\n### Response\n\nThe response includes an array of finding objects, pagination metadata, and a count of items that match the query.\n\nEach finding object contains the following:\n\n- The finding ID that can be used in a `GetFinding` request to retrieve the full finding details.\n- Core attributes, including status, evaluation, high-level resource details, muted state, and rule details.\n- `evaluation_changed_at` and `resource_discovery_date` time stamps.\n- An array of associated tags.\n"
      operationId: ListFindings
      parameters:
      - description: Limit the number of findings returned. Must be <= 1000.
        example: 50
        in: query
        name: page[limit]
        required: false
        schema:
          default: 100
          format: int64
          maximum: 1000
          minimum: 1
          type: integer
      - description: Return findings for a given snapshot of time (Unix ms).
        example: 1678721573794
        in: query
        name: snapshot_timestamp
        required: false
        schema:
          format: int64
          minimum: 1
          type: integer
      - description: Return the next page of findings pointed to by the cursor.
        example: eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Return findings that have these associated tags (repeatable).
        example: filter[tags]=cloud_provider:aws&filter[tags]=aws_account:999999999999
        in: query
        name: filter[tags]
        required: false
        schema:
          type: string
      - description: Return findings that have changed from pass to fail or vice versa on a specified date (Unix ms) or date range (using comparison operators).
        example: '>=1678721573794'
        in: query
        name: filter[evaluation_changed_at]
        required: false
        schema:
          type: string
      - description: Set to `true` to return findings that are muted. Set to `false` to return unmuted findings.
        in: query
        name: filter[muted]
        required: false
        schema:
          type: boolean
        example: true
      - description: Return findings for the specified rule ID.
        in: query
        name: filter[rule_id]
        required: false
        schema:
          type: string
        example: abc-123-def
      - description: Return findings for the specified rule.
        in: query
        name: filter[rule_name]
        required: false
        schema:
          type: string
        example: Example Monitor
      - description: Return only findings for the specified resource type.
        in: query
        name: filter[resource_type]
        required: false
        schema:
          type: string
        example: metric alert
      - description: Return findings that were found on a specified date (Unix ms) or date range (using comparison operators).
        example: '>=1678721573794'
        in: query
        name: filter[discovery_timestamp]
        required: false
        schema:
          type: string
      - description: Return only `pass` or `fail` findings.
        example: pass
        in: query
        name: filter[evaluation]
        required: false
        schema:
          $ref: '#/components/schemas/FindingEvaluation'
      - description: Return only findings with the specified status.
        example: critical
        in: query
        name: filter[status]
        required: false
        schema:
          $ref: '#/components/schemas/FindingStatus'
      - description: Return findings that match the selected vulnerability types (repeatable).
        example:
        - misconfiguration
        explode: true
        in: query
        name: filter[vulnerability_type]
        required: false
        schema:
          items:
            $ref: '#/components/schemas/FindingVulnerabilityType'
          type: array
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListFindingsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/FindingsBadRequestResponse'
        '403':
          $ref: '#/components/responses/FindingsForbiddenResponse'
        '404':
          $ref: '#/components/responses/FindingsNotFoundResponse'
        '429':
          $ref: '#/components/responses/FindingsTooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_findings_read
      summary: Datadog List Findings
      tags:
      - Lists
      x-menu-order: 1
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.cursor
        limitParam: page[limit]
        resultsPath: data
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/custom_rules:
    get:
      description: Retrieve a list of WAF custom rule.
      operationId: ListApplicationSecurityWAFCustomRules
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Waf Custom Rules
      tags:
      - Lists
      x-menu-order: 13
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/exclusion_filters:
    get:
      description: Retrieve a list of WAF exclusion filters.
      operationId: ListApplicationSecurityWafExclusionFilters
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafExclusionFiltersResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Waf Exclusion Filters
      tags:
      - Lists
      x-menu-order: 3
      x-permission:
        operator: AND
        permissions:
        - appsec_protect_read
      x-terraform-resource: appsec_waf_exclusion_filter
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/obs_pipelines/pipelines:
    get:
      description: Retrieve a list of pipelines.
      operationId: ListPipelines
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPipelinesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Pipelines
      tags:
      - Lists
      x-menu-order: 0
      x-permission:
        operator: OR
        permissions:
        - observability_pipelines_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/roles:
    get:
      description: Returns all roles, including their names and their unique identifiers.
      operationId: ListRoles
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - description: 'Sort roles depending on the given field. Sort order is **ascending** by default.

          Sort order is **descending** if the field is prefixed by a negative sign, for example:

          `sort=-name`.'
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/RolesSort'
        example: example_value
      - description: Filter all roles by the given string.
        in: query
        name: filter
        required: false
        schema:
          type: string
        example: example_value
      - description: Filter all roles by the given list of role IDs.
        in: query
        name: filter[id]
        required: false
        schema:
          type: string
        example: abc-123-def
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolesResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_read
      summary: Datadog List Roles
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - user_access_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/roles/{role_id}/permissions:
    x-merge-override:
      delete: true
      get: true
      post: true
    get:
      description: Returns a list of all permissions for a single role.
      operationId: ListRolePermissions
      parameters:
      - $ref: '#/components/parameters/RoleID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionsResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_read
      summary: Datadog List Permissions for a Role
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/applications:
    x-merge-override:
      get: false
      post: false
    get:
      description: List all the RUM applications in your organization.
      operationId: GetRUMApplications
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RUMApplicationsResponse'
          description: OK
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All the Rum Applications
      tags:
      - Lists
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - rum_apps_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/events:
    get:
      description: 'List endpoint returns events that match a RUM search query.

        [Results are paginated][1].


        Use this endpoint to see your latest RUM events.


        [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination'
      operationId: ListRUMEvents
      parameters:
      - description: Search query following RUM syntax.
        example: '@type:session @application_id:xxxx'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: Minimum timestamp for requested events.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: Maximum timestamp for requested events.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: Order of events in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/RUMSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of events in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RUMEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Get a List of Rum Events
      tags:
      - Lists
      x-menu-order: 2
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OPEN
        permissions: []
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scim/Groups:
    get:
      description: 'List groups in the organization.

        Results are paginated by `startIndex` and `count` parameters.

        Results can be narrowed down by the `filter` parameter.'
      operationId: ListSCIMGroups
      parameters:
      - description: Specifies the start index to fetch the results (1-indexed).
        in: query
        name: startIndex
        required: false
        schema:
          default: 1
          example: 1
          format: int64
          type: integer
        example: 1
      - description: Specifies the number of groups to be returned.
        in: query
        name: count
        required: false
        schema:
          default: 20
          example: 20
          format: int64
          type: integer
        example: 20
      - description: 'Specifies the url encoded filter to use to narrow down the results.

          Filters can be in the form of `displayName eq <group name>` or `externalId eq <external id of group>`

          or `id eq <group id> and members eq <user uuid>` or `members eq <user uuid> and id eq <group id>`.'
        in: query
        name: filter
        required: false
        schema:
          type: string
        example: example_value
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListExternalUserGroupResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - bearerAuth: []
      summary: Datadog List Groups
      tags:
      - Lists
      x-menu-order: 7
      x-permission:
        operator: AND
        permissions:
        - user_access_invite
        - user_access_manage
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scim/Users:
    get:
      description: 'List users in the organization.

        Results are paginated by `startIndex` and `count` parameters.

        Results can be narrowed down by the `filter` parameter.'
      operationId: ListSCIMUsers
      parameters:
      - description: Specifies the start index to fetch the results (1-indexed).
        in: query
        name: startIndex
        required: false
        schema:
          default: 1
          example: 1
          format: int64
          type: integer
        example: 1
      - description: Specifies the number of users to be returned.
        in: query
        name: count
        required: false
        schema:
          default: 20
          example: 20
          format: int64
          type: integer
        example: 20
      - description: 'Specifies the url encoded filter to use to narrow down the results.

          Filter should be of the form `userName eq <user name>`.'
        in: query
        name: filter
        required: false
        schema:
          type: string
        example: example_value
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListExternalUsersResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - bearerAuth: []
      summary: Datadog List Users
      tags:
      - Lists
      x-menu-order: 1
      x-permission:
        operator: AND
        permissions:
        - user_access_invite
        - user_access_manage
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/outcomes:
    get:
      description: Fetches all rule outcomes.
      operationId: ListScorecardOutcomes
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - description: Include related rule details in the response.
        in: query
        name: include
        required: false
        schema:
          example: rule
          type: string
        example: rule
      - description: Return only specified values in the outcome attributes.
        in: query
        name: fields[outcome]
        required: false
        schema:
          example: state, service_name
          type: string
        example: state, service_name
      - description: Return only specified values in the included rule details.
        in: query
        name: fields[rule]
        required: false
        schema:
          example: name
          type: string
        example: name
      - description: Filter the outcomes on a specific service name.
        in: query
        name: filter[outcome][service_name]
        required: false
        schema:
          example: web-store
          type: string
        example: web-store
      - description: Filter the outcomes by a specific state.
        in: query
        name: filter[outcome][state]
        required: false
        schema:
          example: fail
          type: string
        example: fail
      - description: Filter outcomes on whether a rule is enabled/disabled.
        in: query
        name: filter[rule][enabled]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter outcomes based on rule ID.
        in: query
        name: filter[rule][id]
        required: false
        schema:
          example: f4485c79-0762-449c-96cf-c31e54a659f6
          type: string
        example: f4485c79-0762-449c-96cf-c31e54a659f6
      - description: Filter outcomes based on rule name.
        in: query
        name: filter[rule][name]
        required: false
        schema:
          example: SLOs Defined
          type: string
        example: SLOs Defined
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutcomesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog List All Rule Outcomes
      tags:
      - Lists
      x-menu-order: 2
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules:
    get:
      description: Fetch all rules.
      operationId: ListScorecardRules
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - description: Include related scorecard details in the response.
        in: query
        name: include
        required: false
        schema:
          example: scorecard
          type: string
        example: scorecard
      - description: Filter the rules on a rule ID.
        in: query
        name: filter[rule][id]
        required: false
        schema:
          example: 37d2f990-c885-4972-949b-8b798213a166
          type: string
        example: 37d2f990-c885-4972-949b-8b798213a166
      - description: Filter for enabled rules only.
        in: query
        name: filter[rule][enabled]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter for custom rules only.
        in: query
        name: filter[rule][custom]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter rules on the rule name.
        in: query
        name: filter[rule][name]
        required: false
        schema:
          example: Code Repos Defined
          type: string
        example: Code Repos Defined
      - description: Filter rules on the rule description.
        in: query
        name: filter[rule][description]
        required: false
        schema:
          example: Identifying
          type: string
        example: Identifying
      - description: Return only specific fields in the response for rule attributes.
        in: query
        name: fields[rule]
        required: false
        schema:
          example: name, description
          type: string
        example: name, description
      - description: Return only specific fields in the included response for scorecard attributes.
        in: query
        name: fields[scorecard]
        required: false
        schema:
          example: name
          type: string
        example: name
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRulesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog List All Rules
      tags:
      - Lists
      x-menu-order: 2
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/assets:
    get:
      description: 'Get a list of vulnerable assets.


        ### Pagination


        Please review the [Pagination section for the "List Vulnerabilities"](#pagination) endpoint.


        ### Filtering


        Please review the [Filtering section for the "List Vulnerabilities"](#filtering) endpoint.


        ### Metadata


        Please review the [Metadata section for the "List Vulnerabilities"](#metadata) endpoint.

        '
      operationId: ListVulnerableAssets
      parameters:
      - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it.
        example: b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
        in: query
        name: page[token]
        required: false
        schema:
          type: string
      - description: The page number to be retrieved. It should be equal or greater than `1`
        example: 1
        in: query
        name: page[number]
        required: false
        schema:
          format: int64
          minimum: 1
          type: integer
      - description: Filter by name.
        example: datadog-agent
        in: query
        name: filter[name]
        required: false
        schema:
          type: string
      - description: Filter by type.
        example: Host
        in: query
        name: filter[type]
        required: false
        schema:
          $ref: '#/components/schemas/AssetType'
      - description: Filter by the first version of the asset since it has been vulnerable.
        example: v1.15.1
        in: query
        name: filter[version.first]
        required: false
        schema:
          type: string
      - description: Filter by the last detected version of the asset.
        example: v1.15.1
        in: query
        name: filter[version.last]
        required: false
        schema:
          type: string
      - description: Filter by the repository url associated to the asset.
        example: github.com/DataDog/datadog-agent.git
        in: query
        name: filter[repository_url]
        required: false
        schema:
          type: string
      - description: Filter whether the asset is in production or not.
        example: false
        in: query
        name: filter[risks.in_production]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset (Service) is under attack or not.
        example: false
        in: query
        name: filter[risks.under_attack]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset (Host) is publicly accessible or not.
        example: false
        in: query
        name: filter[risks.is_publicly_accessible]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset (Host) has privileged access or not.
        example: false
        in: query
        name: filter[risks.has_privileged_access]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset (Host)  has access to sensitive data or not.
        example: false
        in: query
        name: filter[risks.has_access_to_sensitive_data]
        required: false
        schema:
          type: boolean
      - description: Filter by environment.
        example: staging
        in: query
        name: filter[environments]
        required: false
        schema:
          type: string
      - description: Filter by architecture.
        example: arm64
        in: query
        name: filter[arch]
        required: false
        schema:
          type: string
      - description: Filter by operating system name.
        example: ubuntu
        in: query
        name: filter[operating_system.name]
        required: false
        schema:
          type: string
      - description: Filter by operating system version.
        example: '24.04'
        in: query
        name: filter[operating_system.version]
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListVulnerableAssetsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Bad request: The server cannot process the request due to invalid syntax in the request.'
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Forbidden: Access denied'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Not found: There is no request associated with the provided token.'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - appsec_vm_read
      summary: Datadog List Vulnerable Assets
      tags:
      - Lists
      x-menu-order: 26
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is a private preview.

        If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/signals/notification_rules:
    get:
      description: Returns the list of notification rules for security signals.
      operationId: GetSignalNotificationRules
      responses:
        '200':
          $ref: '#/components/responses/NotificationRulesList'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get the List of Signal-based Notification Rules
      tags:
      - Lists
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities:
    get:
      description: "Get a list of vulnerabilities.\n\n### Pagination\n\nPagination is enabled by default in both `vulnerabilities` and `assets`. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response.\n\nThis endpoint will return paginated responses. The pages are stored in the links section of the response:\n\n```JSON\n{\n  \"data\": [...],\n  \"meta\": {...},\n  \"links\": {\n    \"self\": \"https://.../api/v2/security/vulnerabilities\",\n    \"first\": \"https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc\",\n    \"last\": \"https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc\",\n    \"next\": \"https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc\"\n  }\n}\n```\n\n\n- `links.previous` is empty if the first page is requested.\n- `links.next` is empty if the last page is requested.\n\n#### Token\n\nVulnerabilities can be created, updated or deleted at any point in time.\n\nUpon the first request, a token is created to ensure consistency across subsequent paginated requests.\n\nA token is valid only for 24 hours.\n\n#### First request\n\nWe consider a request to be the first request when there is no `page[token]` parameter.\n\nThe response of this first request contains the newly created token in the `links` section.\n\nThis token can then be used in the subsequent paginated requests.\n\n#### Subsequent requests\n\nAny request containing valid `page[token]` and `page[number]` parameters will be considered a subsequent request.\n\nIf the `token` is invalid, a `404` response will be returned.\n\nIf the page `number` is invalid, a `400` response will be returned.\n\n### Filtering\n\nThe request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the [JSON:API format](https://jsonapi.org/format/#fetching-filtering): `filter[$prop_name]`, where `prop_name` is the property name in the entity being filtered by.\n\nAll filters can include multiple values, where data will be filtered with an OR clause: `filter[title]=Title1,Title2` will filter all vulnerabilities where title is equal to `Title1` OR `Title2`.\n\nString filters are case sensitive.\n\nBoolean filters accept `true` or `false` as values.\n\nNumber filters must include an operator as a second filter input: `filter[$prop_name][$operator]`. For example, for the vulnerabilities endpoint: `filter[cvss.base.score][lte]=8`.\n\nAvailable operators are: `eq` (==), `lt` (<), `lte` (<=), `gt` (>) and `gte` (>=).\n\n### Metadata\n\nFollowing [JSON:API format](https://jsonapi.org/format/#document-meta), object including non-standard meta-information.\n\nThis endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables.\n\n```JSON\n{\n  \"data\": [...],\n  \"meta\": {\n    \"total\": 1500,\n    \"count\": 18732,\n    \"token\": \"some_token\"\n  },\n  \"links\": {...}\n}\n```\n"
      operationId: ListVulnerabilities
      parameters:
      - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it.
        example: b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
        in: query
        name: page[token]
        required: false
        schema:
          type: string
      - description: The page number to be retrieved. It should be equal or greater than `1`
        example: 1
        in: query
        name: page[number]
        required: false
        schema:
          format: int64
          minimum: 1
          type: integer
      - description: Filter by vulnerability type.
        example: WeakCipher
        in: query
        name: filter[type]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityType'
      - description: Filter by vulnerability base (i.e. from the original advisory) severity score.
        example: 5.5
        in: query
        name: filter[cvss.base.score][`$op`]
        required: false
        schema:
          format: double
          maximum: 10
          minimum: 0
          type: number
      - description: Filter by vulnerability base severity.
        example: Medium
        in: query
        name: filter[cvss.base.severity]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      - description: Filter by vulnerability base CVSS vector.
        example: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
        in: query
        name: filter[cvss.base.vector]
        required: false
        schema:
          type: string
      - description: Filter by vulnerability Datadog severity score.
        example: 4.3
        in: query
        name: filter[cvss.datadog.score][`$op`]
        required: false
        schema:
          format: double
          maximum: 10
          minimum: 0
          type: number
      - description: Filter by vulnerability Datadog severity.
        example: Medium
        in: query
        name: filter[cvss.datadog.severity]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      - description: Filter by vulnerability Datadog CVSS vector.
        example: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:X/RC:X/CR:X/IR:X/AR:X/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:N/MI:N/MA:H
        in: query
        name: filter[cvss.datadog.vector]
        required: false
        schema:
          type: string
      - description: Filter by the status of the vulnerability.
        example: Open
        in: query
        name: filter[status]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityStatus'
      - description: Filter by the tool of the vulnerability.
        example: SCA
        in: query
        name: filter[tool]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityTool'
      - description: Filter by library name.
        example: linux-aws-5.15
        in: query
        name: filter[library.name]
        required: false
        schema:
          type: string
      - description: Filter by library version.
        example: 5.15.0
        in: query
        name: filter[library.version]
        required: false
        schema:
          type: string
      - description: Filter by advisory ID.
        example: TRIVY-CVE-2023-0615
        in: query
        name: filter[advisory_id]
        required: false
        schema:
          type: string
      - description: Filter by exploitation probability.
        example: false
        in: query
        name: filter[risks.exploitation_probability]
        required: false
        schema:
          type: boolean
      - description: Filter by POC exploit availability.
        example: false
        in: query
        name: filter[risks.poc_exploit_available]
        required: false
        schema:
          type: boolean
      - description: Filter by public exploit availability.
        example: false
        in: query
        name: filter[risks.exploit_available]
        required: false
        schema:
          type: boolean
      - description: Filter by vulnerability [EPSS](https://www.first.org/epss/) severity score.
        example: 0.00042
        in: query
        name: filter[risks.epss.score][`$op`]
        required: false
        schema:
          format: double
          maximum: 1
          minimum: 0
          type: number
      - description: Filter by vulnerability [EPSS](https://www.first.org/epss/) severity.
        example: Low
        in: query
        name: filter[risks.epss.severity]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      - description: Filter by language.
        example: ubuntu
        in: query
        name: filter[language]
        required: false
        schema:
          type: string
      - description: Filter by ecosystem.
        example: Deb
        in: query
        name: filter[ecosystem]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityEcosystem'
      - description: Filter by vulnerability location.
        example: com.example.Class:100
        in: query
        name: filter[code_location.location]
        required: false
        schema:
          type: string
      - description: Filter by vulnerability file path.
        example: src/Class.java:100
        in: query
        name: filter[code_location.file_path]
        required: false
        schema:
          type: string
      - description: Filter by method.
        example: FooBar
        in: query
        name: filter[code_location.method]
        required: false
        schema:
          type: string
      - description: Filter by fix availability.
        example: false
        in: query
        name: filter[fix_available]
        required: false
        schema:
          type: boolean
      - description: Filter by vulnerability `repo_digest` (when the vulnerability is related to `Image` asset).
        example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7
        in: query
        name: filter[repo_digests]
        required: false
        schema:
          type: string
      - description: Filter by asset name.
        example: datadog-agent
        in: query
        name: filter[asset.name]
        required: false
        schema:
          type: string
      - description: Filter by asset type.
        example: Host
        in: query
        name: filter[asset.type]
        required: false
        schema:
          $ref: '#/components/schemas/AssetType'
      - description: Filter by the first version of the asset this vulnerability has been detected on.
        example: v1.15.1
        in: query
        name: filter[asset.version.first]
        required: false
        schema:
          type: string
      - description: Filter by the last version of the asset this vulnerability has been detected on.
        example: v1.15.1
        in: query
        name: filter[asset.version.last]
        required: false
        schema:
          type: string
      - description: Filter by the repository url associated to the asset.
        example: github.com/DataDog/datadog-agent.git
        in: query
        name: filter[asset.repository_url]
        required: false
        schema:
          type: string
      - description: Filter whether the asset is in production or not.
        example: false
        in: query
        name: filter[asset.risks.in_production]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset is under attack or not.
        example: false
        in: query
        name: filter[asset.risks.under_attack]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset is publicly accessible or not.
        example: false
        in: query
        name: filter[asset.risks.is_publicly_accessible]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset is publicly accessible or not.
        example: false
        in: query
        name: filter[asset.risks.has_privileged_access]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset  has access to sensitive data or not.
        example: false
        in: query
        name: filter[asset.risks.has_access_to_sensitive_data]
        required: false
        schema:
          type: boolean
      - description: Filter by asset environments.
        example: staging
        in: query
        name: filter[asset.environments]
        required: false
        schema:
          type: string
      - description: Filter by asset architecture.
        example: arm64
        in: query
        name: filter[asset.arch]
        required: false
        schema:
          type: string
      - description: Filter by asset operating system name.
        example: ubuntu
        in: query
        name: filter[asset.operating_system.name]
        required: false
        schema:
          type: string
      - description: Filter by asset operating system version.
        example: '24.04'
        in: query
        name: filter[asset.operating_system.version]
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListVulnerabilitiesResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Bad request: The server cannot process the request due to invalid syntax in the request.'
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Forbidden: Access denied'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Not found: There is no request associated with the provided token.'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - appsec_vm_read
      summary: Datadog List Vulnerabilities
      tags:
      - Lists
      x-menu-order: 25
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is a private preview.

        If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities/notification_rules:
    get:
      description: Returns the list of notification rules for security vulnerabilities.
      operationId: GetVulnerabilityNotificationRules
      responses:
        '200':
          $ref: '#/components/responses/NotificationRulesList'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get the List of Vulnerability Notification Rules
      tags:
      - Lists
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules:
    get:
      description: List rules.
      operationId: ListSecurityMonitoringRules
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringListRulesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_read
      summary: Datadog List Rules
      tags:
      - Lists
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/signals:
    get:
      description: 'The list endpoint returns security signals that match a search query.

        Both this endpoint and the POST endpoint can be used interchangeably when listing

        security signals.'
      operationId: ListSecurityMonitoringSignals
      parameters:
      - description: The search query for security signals.
        example: security:attack status:high
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: The minimum timestamp for requested security signals.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: The maximum timestamp for requested security signals.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: The order of the security signals in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/SecurityMonitoringSignalsSort'
        example: example_value
      - description: A list of results using the cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: The maximum number of security signals in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_signals_read
      summary: Datadog Get a Quick List of Security Signals
      tags:
      - Lists
      x-menu-order: 14
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_signals_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/signals/search:
    post:
      description: 'Returns security signals that match a search query.

        Both this endpoint and the GET endpoint can be used interchangeably for listing

        security signals.'
      operationId: SearchSecurityMonitoringSignals
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringSignalListRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_signals_read
      summary: Datadog Get a List of Security Signals
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 13
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_signals_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config:
    get:
      description: List all the Scanning groups in your organization.
      operationId: ListScanningGroups
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerGetConfigResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Scanning Groups
      tags:
      - Lists
      x-given:
        configuration:
          step: a valid "configuration" in the system
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - data_scanner_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config/standard-patterns:
    get:
      description: Returns all standard patterns.
      operationId: ListStandardPatterns
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerStandardPatternsResponseData'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Standard Patterns
      tags:
      - Lists
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - data_scanner_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/service_accounts/{service_account_id}/application_keys:
    x-merge-override:
      get: false
    get:
      description: List all application keys available for this service account.
      operationId: ListServiceAccountApplicationKeys
      parameters:
      - $ref: '#/components/parameters/ServiceAccountID'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - $ref: '#/components/parameters/ApplicationKeysSortParameter'
      - $ref: '#/components/parameters/ApplicationKeyFilterParameter'
      - $ref: '#/components/parameters/ApplicationKeyFilterCreatedAtStartParameter'
      - $ref: '#/components/parameters/ApplicationKeyFilterCreatedAtEndParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListApplicationKeysResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List Application Keys for This Service Account
      tags:
      - Lists
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - service_account_write
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/services:
    get:
      deprecated: true
      description: Get all incident services uploaded for the requesting user's organization. If the `include[users]` query parameter is provided, the included attribute will contain the users related to these incident services.
      operationId: ListIncidentServices
      parameters:
      - $ref: '#/components/parameters/IncidentServiceIncludeQueryParameter'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - $ref: '#/components/parameters/IncidentServiceSearchQueryParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentServicesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Get a List of All Incident Services
      tags:
      - Lists
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/siem-historical-detections/jobs:
    get:
      description: List historical jobs.
      operationId: ListHistoricalJobs
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - description: The order of the jobs in results.
        example: status
        in: query
        name: sort
        required: false
        schema:
          type: string
      - description: Query used to filter items from the fetched list.
        example: security:attack status:high
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListHistoricalJobsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog List Historical Jobs
      tags:
      - Lists
      x-menu-order: 20
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/spans/events:
    get:
      description: 'List endpoint returns spans that match a span search query.

        [Results are paginated][1].


        Use this endpoint to see your latest spans.

        This endpoint is rate limited to `300` requests per hour.


        [1]: /logs/guide/collect-multiple-logs-with-pagination?tab=v2api'
      operationId: ListSpansGet
      parameters:
      - description: Search query following spans syntax.
        example: '@datacenter:us @role:db'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: Minimum timestamp for requested spans. Supports date-time ISO8601, date math, and regular timestamps (milliseconds).
        example: '2023-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          type: string
      - description: Maximum timestamp for requested spans. Supports date-time ISO8601, date math, and regular timestamps (milliseconds).
        example: '2023-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          type: string
      - description: Order of spans in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/SpansSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of spans in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpansListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/SpansBadRequestResponse'
        '403':
          $ref: '#/components/responses/SpansForbiddenResponse'
        '422':
          $ref: '#/components/responses/SpansUnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/SpansTooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_read
      summary: Datadog Get a List of Spans
      tags:
      - Lists
      x-menu-order: 1
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/teams:
    get:
      deprecated: true
      description: Get all incident teams for the requesting user's organization. If the `include[users]` query parameter is provided, the included attribute will contain the users related to these incident teams.
      operationId: ListIncidentTeams
      parameters:
      - $ref: '#/components/parameters/IncidentTeamIncludeQueryParameter'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - $ref: '#/components/parameters/IncidentTeamSearchQueryParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTeamsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Get a List of All Incident Teams
      tags:
      - Lists
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/users:
    get:
      description: 'Get the list of all users in the organization. This list includes

        all users even if they are deactivated or unverified.'
      operationId: ListUsers
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - description: 'User attribute to order results by. Sort order is ascending by default.

          Sort order is descending if the field

          is prefixed by a negative sign, for example `sort=-name`. Options: `name`,

          `modified_at`, `user_count`.'
        in: query
        name: sort
        required: false
        schema:
          default: name
          example: name
          type: string
        example: name
      - description: 'Direction of sort. Options: `asc`, `desc`.'
        in: query
        name: sort_dir
        required: false
        schema:
          $ref: '#/components/schemas/QuerySortOrder'
        example: example_value
      - description: Filter all users by the given string. Defaults to no filtering.
        in: query
        name: filter
        required: false
        schema:
          type: string
        example: example_value
      - description: 'Filter on status attribute.

          Comma separated list, with possible values `Active`, `Pending`, and `Disabled`.

          Defaults to no filtering.'
        in: query
        name: filter[status]
        required: false
        schema:
          example: Active
          type: string
        example: Active
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_read
      summary: Datadog List All Users
      tags:
      - Lists
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-pagination:
        limitParam: page[size]
        pageParam: page[number]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - user_access_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/workflows/{workflow_id}/instances:
    get:
      description: List all instances of a given workflow. This API requires an application key scoped with the workflows_read permission.
      operationId: ListWorkflowInstances
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowListInstancesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - workflows_read
      summary: Datadog List Workflow Instances
      tags:
      - Lists
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - workflows_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringSignalListRequestFilter:
      description: Search filters for listing security signals.
      properties:
        from:
          description: The minimum timestamp for requested security signals.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
        query:
          description: Search query for listing security signals.
          example: security:attack status:high
          type: string
        to:
          description: The maximum timestamp for requested security signals.
          example: '2019-01-03T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    AuditLogsResponsePage:
      description: Paging attributes.
      properties:
        after:
          description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    AWSMetricsConfig:
      description: AWS Metrics Collection config.
      properties:
        automute_enabled:
          description: Enable EC2 automute for AWS metrics. Defaults to `true`.
          example: true
          type: boolean
        collect_cloudwatch_alarms:
          description: Enable CloudWatch alarms collection. Defaults to `false`.
          example: false
          type: boolean
        collect_custom_metrics:
          description: Enable custom metrics collection. Defaults to `false`.
          example: false
          type: boolean
        enabled:
          description: Enable AWS metrics collection. Defaults to `true`.
          example: true
          type: boolean
        namespace_filters:
          $ref: '#/components/schemas/AWSNamespaceFilters'
        tag_filters:
          description: AWS Metrics collection tag filters list. Defaults to `[]`.
          items:
            $ref: '#/components/schemas/AWSNamespaceTagFilter'
          type: array
      type: object
    RuleName:
      description: Name of the notification rule.
      example: Rule 1
      type: string
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    ObservabilityPipelineSplunkHecDestinationEncoding:
      description: Encoding format for log events.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    FindingMute:
      additionalProperties: false
      description: Information about the mute status of this finding.
      properties:
        description:
          description: Additional information about the reason why this finding is muted or unmuted.
          example: To be resolved later
          type: string
        expiration_date:
          description: The expiration date of the mute or unmute action (Unix ms).
          example: 1778721573794
          format: int64
          type: integer
        muted:
          description: Whether this finding is muted or unmuted.
          example: true
          type: boolean
        reason:
          $ref: '#/components/schemas/FindingMuteReason'
        start_date:
          description: The start of the mute period.
          example: 1678721573794
          format: int64
          type: integer
        uuid:
          description: The ID of the user who muted or unmuted this finding.
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
      type: object
    MetricDistinctVolume:
      description: Object for a single metric's distinct volume.
      properties:
        attributes:
          $ref: '#/components/schemas/MetricDistinctVolumeAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricDistinctVolumeType'
      type: object
    ObservabilityPipelineRenameFieldsProcessorType:
      default: rename_fields
      description: The processor type. The value should always be `rename_fields`.
      enum:
      - rename_fields
      example: rename_fields
      type: string
      x-enum-varnames:
      - RENAME_FIELDS
    SecurityMonitoringSignalType:
      default: signal
      description: The type of event.
      enum:
      - signal
      example: signal
      type: string
      x-enum-varnames:
      - SIGNAL
    VulnerabilityRelationshipsAffectsData:
      description: Asset affected by this vulnerability.
      properties:
        id:
          description: The unique ID for this related asset.
          example: Repository|github.com/DataDog/datadog-agent.git
          type: string
        type:
          $ref: '#/components/schemas/AssetEntityType'
      required:
      - id
      - type
      type: object
    EntityV3:
      description: Entity schema v3.
      oneOf:
      - $ref: '#/components/schemas/EntityV3Service'
      - $ref: '#/components/schemas/EntityV3Datastore'
      - $ref: '#/components/schemas/EntityV3Queue'
      - $ref: '#/components/schemas/EntityV3System'
      - $ref: '#/components/schemas/EntityV3API'
    ListRulesResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: Link for the next set of rules.
          example: /api/v2/scorecard/rules?page%5Blimit%5D=2&page%5Boffset%5D=2&page%5Bsize%5D=2
          type: string
      type: object
    RelationshipToIncidentUserDefinedFields:
      description: Relationship to incident user defined fields.
      properties:
        data:
          description: An array of user defined fields.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFieldData'
          type: array
      required:
      - data
      type: object
    OrganizationAttributes:
      description: Attributes of the organization.
      properties:
        created_at:
          description: Creation time of the organization.
          format: date-time
          type: string
          example: example_value
        description:
          description: Description of the organization.
          type: string
          example: example_value
        disabled:
          description: Whether or not the organization is disabled.
          type: boolean
          example: true
        modified_at:
          description: Time of last organization modification.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the organization.
          type: string
          example: Example Monitor
        public_id:
          description: Public ID of the organization.
          type: string
          example: abc-123-def
        sharing:
          description: Sharing type of the organization.
          type: string
          example: example_value
        url:
          description: URL of the site that this organization exists at.
          type: string
          example: https://app.datadoghq.com
      type: object
    ListTagsResponse:
      description: List tags response.
      properties:
        data:
          $ref: '#/components/schemas/ListTagsResponseData'
      type: object
    DependencyLocation:
      description: Static library vulnerability location.
      properties:
        column_end:
          description: Location column end.
          example: 140
          format: int64
          type: integer
        column_start:
          description: Location column start.
          example: 5
          format: int64
          type: integer
        file_name:
          description: Location file name.
          example: src/go.mod
          type: string
        line_end:
          description: Location line end.
          example: 10
          format: int64
          type: integer
        line_start:
          description: Location line start.
          example: 1
          format: int64
          type: integer
      required:
      - file_name
      - line_start
      - line_end
      - column_start
      - column_end
      type: object
    OrgConfigReadAttributes:
      description: Readable attributes of an Org Config.
      properties:
        description:
          description: The description of an Org Config.
          example: Frobulate the turbo encabulator manifold
          type: string
        modified_at:
          description: The timestamp of the last Org Config update (if any).
          format: date-time
          nullable: true
          type: string
          example: example_value
        name:
          description: The machine-friendly name of an Org Config.
          example: monitor_timezone
          type: string
        value:
          description: The value of an Org Config.
          example: example_value
        value_type:
          description: The type of an Org Config value.
          example: bool
          type: string
      required:
      - name
      - description
      - value_type
      - value
      type: object
    IncidentIntegrationMetadataType:
      default: incident_integrations
      description: Integration metadata resource type.
      enum:
      - incident_integrations
      example: incident_integrations
      type: string
      x-enum-varnames:
      - INCIDENT_INTEGRATIONS
    DeploymentAttributes:
      description: The attributes object containing the version ID of the published app.
      properties:
        app_version_id:
          description: The version ID of the app that was published. For an unpublished app, this is always the nil UUID (`00000000-0000-0000-0000-000000000000`).
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
      type: object
    VulnerabilityAttributes:
      description: The JSON:API attributes of the vulnerability.
      properties:
        advisory_id:
          description: Vulnerability advisory ID.
          example: TRIVY-CVE-2023-0615
          type: string
        code_location:
          $ref: '#/components/schemas/CodeLocation'
        cve_list:
          description: Vulnerability CVE list.
          example:
          - CVE-2023-0615
          items:
            example: CVE-2023-0615
            type: string
          type: array
        cvss:
          $ref: '#/components/schemas/VulnerabilityCvss'
        dependency_locations:
          $ref: '#/components/schemas/VulnerabilityDependencyLocations'
        description:
          description: Vulnerability description.
          example: LDAP Injection is a security vulnerability that occurs when untrusted user input is improperly handled and directly incorporated into LDAP queries without appropriate sanitization or validation. This vulnerability enables attackers to manipulate LDAP queries and potentially gain unauthorized access, modify data, or extract sensitive information from the directory server. By exploiting the LDAP injection vulnerability, attackers can execute malicious commands, bypass authentication mechanisms, and perform unauthorized actions within the directory service.
          type: string
        ecosystem:
          $ref: '#/components/schemas/VulnerabilityEcosystem'
        exposure_time:
          description: Vulnerability exposure time in seconds.
          example: 5618604
          format: int64
          type: integer
        first_detection:
          description: First detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format
          example: '2024-09-19T21:23:08.000Z'
          type: string
        fix_available:
          description: Whether the vulnerability has a remediation or not.
          example: false
          type: boolean
        language:
          description: Vulnerability language.
          example: ubuntu
          type: string
        last_detection:
          description: Last detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format
          example: '2024-09-01T21:23:08.000Z'
          type: string
        library:
          $ref: '#/components/schemas/Library'
        remediations:
          description: List of remediations.
          items:
            $ref: '#/components/schemas/Remediation'
          type: array
        repo_digests:
          description: Vulnerability `repo_digest` list (when the vulnerability is related to `Image` asset).
          items:
            example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7
            type: string
          type: array
        risks:
          $ref: '#/components/schemas/VulnerabilityRisks'
        status:
          $ref: '#/components/schemas/VulnerabilityStatus'
        title:
          description: Vulnerability title.
          example: LDAP Injection
          type: string
        tool:
          $ref: '#/components/schemas/VulnerabilityTool'
        type:
          $ref: '#/components/schemas/VulnerabilityType'
      required:
      - type
      - cvss
      - status
      - tool
      - title
      - description
      - cve_list
      - risks
      - language
      - first_detection
      - last_detection
      - exposure_time
      - remediations
      - fix_available
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction:
      description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content.
      enum:
      - hash
      example: hash
      type: string
      x-enum-varnames:
      - HASH
    RelationshipToRuleDataObject:
      description: Rule relationship data.
      properties:
        id:
          description: The unique ID for a scorecard.
          example: q8MQxk8TCqrHnWkp
          type: string
        type:
          $ref: '#/components/schemas/ScorecardType'
      type: object
    OrgConfigListResponse:
      description: A response with multiple Org Configs.
      properties:
        data:
          description: An array of Org Configs.
          items:
            $ref: '#/components/schemas/OrgConfigRead'
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineHttpClientSourceType:
      default: http_client
      description: The source type. The value should always be `http_client`.
      enum:
      - http_client
      example: http_client
      type: string
      x-enum-varnames:
      - HTTP_CLIENT
    ObservabilityPipelineSensitiveDataScannerProcessorRule:
      description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take.
      properties:
        keyword_options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions'
        name:
          description: A name identifying the rule.
          example: Redact Credit Card Numbers
          type: string
        on_match:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction'
        pattern:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern'
        scope:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope'
        tags:
          description: Tags assigned to this rule for filtering and classification.
          example:
          - pii
          - ccn
          items:
            type: string
          type: array
      required:
      - name
      - tags
      - pattern
      - scope
      - on_match
      type: object
    DeploymentRelationship:
      description: Information pointing to the app's publication status.
      properties:
        data:
          $ref: '#/components/schemas/DeploymentRelationshipData'
        meta:
          $ref: '#/components/schemas/DeploymentMetadata'
      type: object
    IncidentServicesResponse:
      description: Response with a list of incident service payloads.
      properties:
        data:
          description: An array of incident services.
          example:
          - id: 00000000-0000-0000-0000-000000000000
            type: services
          items:
            $ref: '#/components/schemas/IncidentServiceResponseData'
          type: array
        included:
          description: Included related resources which the user requested.
          items:
            $ref: '#/components/schemas/IncidentServiceIncludedItems'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentResponseMeta'
      required:
      - data
      type: object
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    UserResponseIncludedItem:
      description: An object related to a user.
      oneOf:
      - $ref: '#/components/schemas/Organization'
      - $ref: '#/components/schemas/Permission'
      - $ref: '#/components/schemas/Role'
    AuditLogsEventType:
      default: audit
      description: Type of the event.
      enum:
      - audit
      example: audit
      type: string
      x-enum-varnames:
      - Audit
    IncidentNotificationHandle:
      description: A notification handle that will be notified at incident creation.
      properties:
        display_name:
          description: The name of the notified handle.
          example: Jane Doe
          type: string
        handle:
          description: The handle used for the notification. This includes an email address, Slack channel, or workflow.
          example: '@test.user@test.com'
          type: string
      type: object
    DORAListDeploymentsRequestDataType:
      description: The definition of `DORAListDeploymentsRequestDataType` object.
      enum:
      - dora_deployments_list_request
      type: string
      x-enum-varnames:
      - DORA_DEPLOYMENTS_LIST_REQUEST
    MetricTagConfigurationMetricTypeCategory:
      default: distribution
      description: The metric's type category.
      enum:
      - non_distribution
      - distribution
      example: distribution
      type: string
      x-enum-varnames:
      - NON_DISTRIBUTION
      - DISTRIBUTION
    FastlyServiceType:
      default: fastly-services
      description: The JSON:API type for this API. Should always be `fastly-services`.
      enum:
      - fastly-services
      example: fastly-services
      type: string
      x-enum-varnames:
      - FASTLY_SERVICES
    DashboardListAddItemsRequest:
      description: Request containing a list of dashboards to add.
      properties:
        dashboards:
          description: List of dashboards to add the dashboard list.
          items:
            $ref: '#/components/schemas/DashboardListItemRequest'
          type: array
      type: object
    DashboardListDeleteItemsRequest:
      description: Request containing a list of dashboards to delete.
      properties:
        dashboards:
          description: List of dashboards to delete from the dashboard list.
          items:
            $ref: '#/components/schemas/DashboardListItemRequest'
          type: array
      type: object
    ObservabilityPipelineRsyslogSourceType:
      default: rsyslog
      description: The source type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    ApplicationSecurityWafExclusionFilterOnMatch:
      description: The action taken when the exclusion filter matches. When set to `monitor`, security traces are emitted but the requests are not blocked. By default, security traces are not emitted and the requests are not blocked.
      enum:
      - monitor
      type: string
      x-enum-varnames:
      - MONITOR
    JiraIntegrationMetadataIssuesItem:
      description: Item in the Jira integration metadata issue array.
      properties:
        account:
          description: URL of issue's Jira account.
          example: https://example.atlassian.net
          type: string
        issue_key:
          description: Jira issue's issue key.
          example: PROJ-123
          type: string
        issuetype_id:
          description: Jira issue's issue type.
          example: '1000'
          type: string
        project_key:
          description: Jira issue's project keys.
          example: PROJ
          type: string
        redirect_url:
          description: URL redirecting to the Jira issue.
          example: https://example.atlassian.net/browse/PROJ-123
          type: string
      required:
      - project_key
      - account
      type: object
    RelationIncludeType:
      description: Supported include types for relations.
      enum:
      - entity
      - schema
      type: string
      x-enum-varnames:
      - ENTITY
      - SCHEMA
    FindingAttributes:
      description: The JSON:API attributes of the finding.
      properties:
        evaluation:
          $ref: '#/components/schemas/FindingEvaluation'
        evaluation_changed_at:
          $ref: '#/components/schemas/FindingEvaluationChangedAt'
        mute:
          $ref: '#/components/schemas/FindingMute'
        resource:
          $ref: '#/components/schemas/FindingResource'
        resource_discovery_date:
          $ref: '#/components/schemas/FindingResourceDiscoveryDate'
        resource_type:
          $ref: '#/components/schemas/FindingResourceType'
        rule:
          $ref: '#/components/schemas/FindingRule'
        status:
          $ref: '#/components/schemas/FindingStatus'
        tags:
          $ref: '#/components/schemas/FindingTags'
        vulnerability_type:
          $ref: '#/components/schemas/FindingVulnerabilityType'
      type: object
    AccountFilteringConfig:
      description: The account filtering configuration.
      properties:
        excluded_accounts:
          description: The AWS account IDs to be excluded from your billing dataset. This field is used when `include_new_accounts` is `true`.
          example:
          - '123456789123'
          - '123456789143'
          items:
            type: string
          type: array
        include_new_accounts:
          description: Whether or not to automatically include new member accounts by default in your billing dataset.
          example: true
          type: boolean
        included_accounts:
          description: The AWS account IDs to be included in your billing dataset. This field is used when `include_new_accounts` is `false`.
          example:
          - '123456789123'
          - '123456789143'
          items:
            type: string
          type: array
      type: object
    ObservabilityPipelineOcsfMappingLibrary:
      description: Predefined library mappings for common log formats.
      enum:
      - CloudTrail Account Change
      - GCP Cloud Audit CreateBucket
      - GCP Cloud Audit CreateSink
      - GCP Cloud Audit SetIamPolicy
      - GCP Cloud Audit UpdateSink
      - Github Audit Log API Activity
      - Google Workspace Admin Audit addPrivilege
      - Microsoft 365 Defender Incident
      - Microsoft 365 Defender UserLoggedIn
      - Okta System Log Authentication
      - Palo Alto Networks Firewall Traffic
      example: CloudTrail Account Change
      type: string
      x-enum-varnames:
      - CLOUDTRAIL_ACCOUNT_CHANGE
      - GCP_CLOUD_AUDIT_CREATEBUCKET
      - GCP_CLOUD_AUDIT_CREATESINK
      - GCP_CLOUD_AUDIT_SETIAMPOLICY
      - GCP_CLOUD_AUDIT_UPDATESINK
      - GITHUB_AUDIT_LOG_API_ACTIVITY
      - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE
      - MICROSOFT_365_DEFENDER_INCIDENT
      - MICROSOFT_365_DEFENDER_USERLOGGEDIN
      - OKTA_SYSTEM_LOG_AUTHENTICATION
      - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC
    AuthNMappingResourceType:
      description: The type of resource being mapped to.
      enum:
      - role
      - team
      type: string
      x-enum-varnames:
      - ROLE
      - TEAM
    ApplicationSecurityWafCustomRuleListResponse:
      description: Response object that includes a list of WAF custom rules.
      properties:
        data:
          description: The WAF custom rule data.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData'
          type: array
      type: object
    EntityToOncalls:
      description: Entity to oncalls relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipArray'
      type: object
    ApplicationSecurityWafCustomRuleConditionInputAddress:
      description: Input from the request on which the condition should apply.
      enum:
      - server.db.statement
      - server.io.fs.file
      - server.io.net.url
      - server.sys.shell.cmd
      - server.request.method
      - server.request.uri.raw
      - server.request.path_params
      - server.request.query
      - server.request.headers.no_cookies
      - server.request.cookies
      - server.request.trailers
      - server.request.body
      - server.response.status
      - server.response.headers.no_cookies
      - server.response.trailers
      - grpc.server.request.metadata
      - grpc.server.request.message
      - grpc.server.method
      - graphql.server.all_resolvers
      - usr.id
      - http.client_ip
      example: server.db.statement
      type: string
      x-enum-varnames:
      - SERVER_DB_STATEMENT
      - SERVER_IO_FS_FILE
      - SERVER_IO_NET_URL
      - SERVER_SYS_SHELL_CMD
      - SERVER_REQUEST_METHOD
      - SERVER_REQUEST_URI_RAW
      - SERVER_REQUEST_PATH_PARAMS
      - SERVER_REQUEST_QUERY
      - SERVER_REQUEST_HEADERS_NO_COOKIES
      - SERVER_REQUEST_COOKIES
      - SERVER_REQUEST_TRAILERS
      - SERVER_REQUEST_BODY
      - SERVER_RESPONSE_STATUS
      - SERVER_RESPONSE_HEADERS_NO_COOKIES
      - SERVER_RESPONSE_TRAILERS
      - GRPC_SERVER_REQUEST_METADATA
      - GRPC_SERVER_REQUEST_MESSAGE
      - GRPC_SERVER_METHOD
      - GRAPHQL_SERVER_ALL_RESOLVERS
      - USR_ID
      - HTTP_CLIENT_IP
    RuleSeverity:
      description: Severity of a security rule.
      enum:
      - critical
      - high
      - medium
      - low
      - unknown
      - info
      example: critical
      type: string
      x-enum-varnames:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - UNKNOWN
      - INFO
    CIAppPipelineEventTypeName:
      description: Type of the event.
      enum:
      - cipipeline
      example: cipipeline
      type: string
      x-enum-varnames:
      - CIPIPELINE
    RelationshipToUser:
      description: Relationship to user.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToUserData'
      required:
      - data
      type: object
    RelationshipToTeamData:
      description: Relationship to Team object.
      properties:
        id:
          description: The unique identifier of the team.
          example: f9bb8444-af7f-11ec-ac2c-da7ad0900001
          type: string
        type:
          $ref: '#/components/schemas/TeamType'
      type: object
      x-merge-override:
        required: false
    CodeLocation:
      description: Code vulnerability location.
      properties:
        file_path:
          description: Vulnerability location file path.
          example: src/Class.java:100
          type: string
        location:
          description: Vulnerability extracted location.
          example: com.example.Class:100
          type: string
        method:
          description: Vulnerability location method.
          example: FooBar
          type: string
      required:
      - location
      type: object
    CIAppWarning:
      description: A warning message indicating something that went wrong with the query.
      properties:
        code:
          description: A unique code for this type of warning.
          example: unknown_index
          type: string
        detail:
          description: A detailed explanation of this specific warning.
          example: 'indexes: foo, bar'
          type: string
        title:
          description: A short human-readable summary of the warning.
          example: One or several indexes are missing or invalid, results hold data from the other indexes
          type: string
      type: object
    AWSAccountID:
      description: AWS Account ID.
      example: '123456789012'
      type: string
    Version:
      description: Version of the notification rule. It is updated when the rule is modified.
      example: 1
      format: int64
      type: integer
    DeviceAttributesInterfaceStatuses:
      description: Count of the device interfaces by status
      example:
        down: 1
        'off': 2
        up: 12
        warning: 5
      properties:
        down:
          description: The number of interfaces that are down
          format: int64
          type: integer
          example: 42
        'off':
          description: The number of interfaces that are off
          format: int64
          type: integer
          example: 42
        up:
          description: The number of interfaces that are up
          format: int64
          type: integer
          example: 42
        warning:
          description: The number of interfaces that are in a warning state
          format: int64
          type: integer
          example: 42
      type: object
    GCPSTSDelegateAccountAttributes:
      description: Your delegate account attributes.
      properties:
        delegate_account_email:
          description: Your organization's Datadog principal email address.
          example: ddgci-1a19n28hb1a812221893@datadog-gci-sts-us5-prod.iam.gserviceaccount.com
          type: string
      type: object
    CustomCostListResponseMeta:
      description: Meta for the response from the List Custom Costs endpoints.
      properties:
        total_filtered_count:
          description: Number of Custom Costs files returned by the List Custom Costs endpoint
          format: int64
          type: integer
          example: 42
        version:
          description: Version of Custom Costs file
          type: string
          example: example_value
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy:
      description: Uses a numeric field in the log event as the metric increment.
      enum:
      - increment_by_field
      example: increment_by_field
      type: string
      x-enum-varnames:
      - INCREMENT_BY_FIELD
    RelationshipToPermissionData:
      description: Relationship to permission object.
      properties:
        id:
          description: ID of the permission.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/PermissionsType'
      type: object
      x-merge-override:
        required: false
    SpansWarning:
      description: A warning message indicating something that went wrong with the query.
      properties:
        code:
          description: A unique code for this type of warning.
          example: unknown_index
          type: string
        detail:
          description: A detailed explanation of this specific warning.
          example: 'indexes: foo, bar'
          type: string
        title:
          description: A short human-readable summary of the warning.
          example: One or several indexes are missing or invalid, results hold data from the other indexes
          type: string
      type: object
    IncidentFieldAttributesSingleValueType:
      default: dropdown
      description: Type of the single value field definitions.
      enum:
      - dropdown
      - textbox
      example: dropdown
      type: string
      x-enum-varnames:
      - DROPDOWN
      - TEXTBOX
    RUMApplicationsResponse:
      description: RUM applications response.
      properties:
        data:
          description: RUM applications array response.
          items:
            $ref: '#/components/schemas/RUMApplicationList'
          type: array
      type: object
    DashboardListUpdateItemsResponse:
      description: Response containing a list of updated dashboards.
      properties:
        dashboards:
          description: List of dashboards in the dashboard list.
          items:
            $ref: '#/components/schemas/DashboardListItemResponse'
          type: array
      type: object
    AwsCURConfig:
      description: AWS CUR config.
      properties:
        attributes:
          $ref: '#/components/schemas/AwsCURConfigAttributes'
        id:
          description: The ID of the AWS CUR config.
          format: int64
          type: integer
          example: 42
        type:
          $ref: '#/components/schemas/AwsCURConfigType'
      required:
      - attributes
      - type
      type: object
      x-merge-override:
        required: false
    SensitiveDataScannerStandardPatternData:
      description: A standard pattern.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPattern'
      type: object
    MetricMetaPage:
      description: Paging attributes. Only present if pagination query parameters were provided.
      properties:
        cursor:
          description: The cursor used to get the current results, if any.
          nullable: true
          type: string
          example: example_value
        limit:
          description: Number of results returned
          format: int32
          maximum: 20000
          minimum: 0
          type: integer
          example: 42
        next_cursor:
          description: The cursor used to get the next results, if any.
          nullable: true
          type: string
          example: example_value
        type:
          $ref: '#/components/schemas/MetricMetaPageType'
      type: object
    AWSNamespacesResponse:
      description: AWS Namespaces response body.
      properties:
        data:
          $ref: '#/components/schemas/AWSNamespacesResponseData'
      required:
      - data
      type: object
    InterfaceAttributes:
      description: The interface attributes
      properties:
        alias:
          description: The interface alias
          example: interface_0
          type: string
        description:
          description: The interface description
          example: a network interface
          type: string
        index:
          description: The interface index
          example: 0
          format: int64
          type: integer
        ip_addresses:
          description: The interface IP addresses
          example:
          - 1.1.1.1
          - 1.1.1.2
          items:
            type: string
          type: array
        mac_address:
          description: The interface MAC address
          example: 00:00:00:00:00:00
          type: string
        name:
          description: The interface name
          example: if0
          type: string
        status:
          $ref: '#/components/schemas/InterfaceAttributesStatus'
      type: object
    ObservabilityPipelineDedupeProcessorMode:
      description: The deduplication mode to apply to the fields.
      enum:
      - match
      - ignore
      example: match
      type: string
      x-enum-varnames:
      - MATCH
      - IGNORE
    IncidentResponseMetaPagination:
      description: Pagination properties.
      properties:
        next_offset:
          description: The index of the first element in the next page of results. Equal to page size added to the current offset.
          example: 1000
          format: int64
          type: integer
        offset:
          description: The index of the first element in the results.
          example: 10
          format: int64
          type: integer
        size:
          description: Maximum size of pages to return.
          example: 1000
          format: int64
          type: integer
      type: object
    EPSS:
      description: Vulnerability EPSS severity.
      properties:
        score:
          description: Vulnerability EPSS severity score.
          example: 0.2
          format: double
          type: number
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      required:
      - score
      - severity
      type: object
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    ConfluentResourceType:
      default: confluent-cloud-resources
      description: The JSON:API type for this request.
      enum:
      - confluent-cloud-resources
      example: confluent-cloud-resources
      type: string
      x-enum-varnames:
      - CONFLUENT_CLOUD_RESOURCES
    ObservabilityPipelineAmazonDataFirehoseSource:
      description: The `amazon_data_firehose` source ingests logs from AWS Data Firehose.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAwsAuth'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: amazon-firehose-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSourceType'
      required:
      - id
      - type
      type: object
    VulnerabilityEcosystem:
      description: The related vulnerability asset ecosystem.
      enum:
      - PyPI
      - Maven
      - NuGet
      - Npm
      - RubyGems
      - Go
      - Packagist
      - Ddeb
      - Rpm
      - Apk
      - Windows
      type: string
      x-enum-varnames:
      - PYPI
      - MAVEN
      - NUGET
      - NPM
      - RUBY_GEMS
      - GO
      - PACKAGIST
      - D_DEB
      - RPM
      - APK
      - WINDOWS
    ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget:
      description: Applies the rule only to included fields.
      enum:
      - include
      example: include
      type: string
      x-enum-varnames:
      - INCLUDE
    HistoricalJobOptions:
      description: Job options.
      properties:
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    ListDevicesResponseMetadata:
      description: Object describing meta attributes of response.
      properties:
        page:
          $ref: '#/components/schemas/ListDevicesResponseMetadataPage'
      type: object
    UsersResponse:
      description: Response containing information about multiple users.
      properties:
        data:
          description: Array of returned users.
          items:
            $ref: '#/components/schemas/User'
          type: array
        included:
          description: Array of objects related to the users.
          items:
            $ref: '#/components/schemas/UserResponseIncludedItem'
          type: array
        meta:
          $ref: '#/components/schemas/ResponseMetaAttributes'
      readOnly: true
      type: object
    EntityResponseIncludedOncall:
      description: Included oncall.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityResponseIncludedRelatedOncallAttributes'
        id:
          description: Oncall ID.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/EntityResponseIncludedOncallType'
      type: object
    OutcomesBatchResponseAttributes:
      description: The JSON:API attributes for an outcome.
      properties:
        created_at:
          description: Creation time of the rule outcome.
          format: date-time
          type: string
          example: example_value
        modified_at:
          description: Time of last rule outcome modification.
          format: date-time
          type: string
          example: example_value
        remarks:
          description: Any remarks regarding the scorecard rule's evaluation, and supports HTML hyperlinks.
          example: 'See: <a href="https://app.datadoghq.com/services">Services</a>'
          type: string
        service_name:
          description: The unique name for a service in the catalog.
          example: my-service
          type: string
        state:
          $ref: '#/components/schemas/State'
      type: object
    CIAppResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    Deployment:
      description: The version of the app that was published.
      properties:
        attributes:
          $ref: '#/components/schemas/DeploymentAttributes'
        id:
          description: The deployment ID.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        meta:
          $ref: '#/components/schemas/DeploymentMetadata'
        type:
          $ref: '#/components/schemas/AppDeploymentType'
      type: object
    JiraIntegrationMetadata:
      description: Incident integration metadata for the Jira integration.
      properties:
        issues:
          description: Array of Jira issues in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/JiraIntegrationMetadataIssuesItem'
          type: array
      required:
      - issues
      type: object
    EntityV3DatastoreDatadog:
      additionalProperties: false
      description: Datadog product integrations for the datastore entity.
      properties:
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
      type: object
      x-ignore-duplicate-object: true
    AWSLogsServicesResponseDataType:
      default: logs_services
      description: The `AWSLogsServicesResponseData` `type`.
      enum:
      - logs_services
      example: logs_services
      type: string
      x-enum-varnames:
      - LOGS_SERVICES
    ObservabilityPipelineFilterProcessor:
      description: The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: filter-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFilterProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    DeploymentMetadata:
      description: Metadata object containing the publication creation information.
      properties:
        created_at:
          description: Timestamp of when the app was published.
          format: date-time
          type: string
          example: example_value
        user_id:
          description: The ID of the user who published the app.
          format: int64
          type: integer
          example: 42
        user_name:
          description: The name (or email address) of the user who published the app.
          type: string
          example: Example Monitor
        user_uuid:
          description: The UUID of the user who published the app.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
      type: object
    IncidentResponseMeta:
      description: The metadata object containing pagination metadata.
      properties:
        pagination:
          $ref: '#/components/schemas/IncidentResponseMetaPagination'
      readOnly: true
      type: object
    Enabled:
      description: Field used to enable or disable the rule.
      example: true
      type: boolean
    HistoricalJobQuery:
      description: Query for selecting logs analyzed by the historical job.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    RelationResponse:
      description: Relation response data.
      properties:
        attributes:
          $ref: '#/components/schemas/RelationAttributes'
        id:
          description: Relation ID.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/RelationMeta'
        relationships:
          $ref: '#/components/schemas/RelationRelationships'
        subtype:
          description: Relation subtype.
          type: string
          example: metric alert
        type:
          $ref: '#/components/schemas/RelationResponseType'
      type: object
    JobDefinition:
      description: Definition of a historical job.
      properties:
        calculatedFields:
          description: Calculated fields.
          items:
            $ref: '#/components/schemas/CalculatedField'
          type: array
        cases:
          description: Cases used for generating job results.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        from:
          description: Starting time of data analyzed by the job.
          example: 1729843470000
          format: int64
          type: integer
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        index:
          description: Index used to load the data.
          example: cloud_siem
          type: string
        message:
          description: Message for generated results.
          example: A large number of failed login attempts.
          type: string
        name:
          description: Job name.
          example: Excessive number of failed attempts.
          type: string
        options:
          $ref: '#/components/schemas/HistoricalJobOptions'
        queries:
          description: Queries for selecting logs analyzed by the job.
          items:
            $ref: '#/components/schemas/HistoricalJobQuery'
          type: array
        referenceTables:
          description: Reference tables used in the queries.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating results from third-party detection method. Only available for third-party detection method.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        to:
          description: Ending time of data analyzed by the job.
          example: 1729847070000
          format: int64
          type: integer
        type:
          description: Job type.
          type: string
          example: metric alert
      required:
      - from
      - to
      - index
      - name
      - cases
      - queries
      - message
      type: object
    EventsSort:
      description: The sort parameters when querying events.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    AzureStorageDestinationType:
      default: azure_storage
      description: The destination type. The value should always be `azure_storage`.
      enum:
      - azure_storage
      example: azure_storage
      type: string
      x-enum-varnames:
      - AZURE_STORAGE
    EventStatusType:
      description: 'If an alert event is enabled, its status is one of the following:

        `failure`, `error`, `warning`, `info`, `success`, `user_update`,

        `recommendation`, or `snapshot`.'
      enum:
      - failure
      - error
      - warning
      - info
      - success
      - user_update
      - recommendation
      - snapshot
      example: info
      type: string
      x-enum-varnames:
      - FAILURE
      - ERROR
      - WARNING
      - INFO
      - SUCCESS
      - USER_UPDATE
      - RECOMMENDATION
      - SNAPSHOT
    ObservabilityPipelineRsyslogDestination:
      description: The `rsyslog` destination forwards logs to an external `rsyslog` server over TCP or UDP using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component.
          example: rsyslog-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        keepalive:
          description: Optional socket keepalive duration in milliseconds.
          example: 60000
          format: int64
          minimum: 0
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    Targets:
      description: 'List of recipients to notify when a notification rule is triggered. Many different target types are supported,

        such as email addresses, Slack channels, and PagerDuty services.

        The appropriate integrations need to be properly configured to send notifications to the specified targets.'
      example:
      - '@john.doe@email.com'
      items:
        description: Recipients to notify.
        type: string
      type: array
    DORAListDeploymentsRequestAttributes:
      description: Attributes to get a list of deployments.
      properties:
        from:
          description: Minimum timestamp for requested events.
          format: date-time
          type: string
          example: example_value
        limit:
          default: 10
          description: Maximum number of events in the response.
          format: int32
          maximum: 1000
          type: integer
          example: 42
        query:
          description: Search query with event platform syntax.
          type: string
          example: avg:system.cpu.user{*}
        sort:
          description: Sort order (prefixed with `-` for descending).
          type: string
          example: example_value
        to:
          description: Maximum timestamp for requested events.
          format: date-time
          type: string
          example: example_value
      type: object
    ObservabilityPipelineMetadataEntry:
      description: A custom metadata entry.
      properties:
        name:
          description: The metadata key.
          example: environment
          type: string
        value:
          description: The metadata value.
          example: production
          type: string
      required:
      - name
      - value
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionHash:
      description: Configuration for hashing matched sensitive values.
      properties:
        action:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction'
        options:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionHash` `options`.
          type: object
      required:
      - action
      type: object
    WorkflowListInstancesResponseMetaPage:
      additionalProperties: {}
      description: Page information for the list instances response.
      properties:
        totalCount:
          description: The total count of items.
          format: int64
          type: integer
          example: 42
      type: object
    ObservabilityPipelineParseGrokProcessor:
      description: The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns.
      properties:
        disable_library_rules:
          default: false
          description: If set to `true`, disables the default Grok rules provided by Datadog.
          example: true
          type: boolean
        id:
          description: A unique identifier for this processor.
          example: parse-grok-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        rules:
          description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    IncidentTypeAttributes:
      description: Incident type's attributes.
      properties:
        createdAt:
          description: Timestamp when the incident type was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        createdBy:
          description: A unique identifier that represents the user that created the incident type.
          example: 00000000-0000-0000-0000-000000000000
          readOnly: true
          type: string
        description:
          description: Text that describes the incident type.
          example: Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data.
          type: string
        is_default:
          default: false
          description: If true, this incident type will be used as the default incident type if a type is not specified during the creation of incident resources.
          example: false
          type: boolean
        lastModifiedBy:
          description: A unique identifier that represents the user that last modified the incident type.
          example: 00000000-0000-0000-0000-000000000000
          readOnly: true
          type: string
        modifiedAt:
          description: Timestamp when the incident type was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: The name of the incident type.
          example: Security Incident
          type: string
        prefix:
          description: The string that will be prepended to the incident title across the Datadog app.
          example: IR
          readOnly: true
          type: string
      required:
      - name
      type: object
    ObservabilityPipelineSumoLogicDestinationType:
      default: sumo_logic
      description: The destination type. The value should always be `sumo_logic`.
      enum:
      - sumo_logic
      example: sumo_logic
      type: string
      x-enum-varnames:
      - SUMO_LOGIC
    DashboardListUpdateItemsRequest:
      description: Request containing the list of dashboards to update to.
      properties:
        dashboards:
          description: List of dashboards to update the dashboard list to.
          items:
            $ref: '#/components/schemas/DashboardListItemRequest'
          type: array
      type: object
    EntityResponseIncludedRelatedOncallAttributes:
      description: Included related oncall attributes.
      properties:
        escalations:
          $ref: '#/components/schemas/EntityResponseIncludedRelatedOncallEscalations'
        provider:
          description: Oncall provider.
          type: string
          example: abc-123-def
      type: object
    CloudflareAccountResponseData:
      description: Data object of a Cloudflare account.
      properties:
        attributes:
          $ref: '#/components/schemas/CloudflareAccountResponseAttributes'
        id:
          description: The ID of the Cloudflare account, a hash of the account name.
          example: c1a8e059bfd1e911cf10b626340c9a54
          type: string
        type:
          $ref: '#/components/schemas/CloudflareAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    MetricDistinctVolumeAttributes:
      description: Object containing the definition of a metric's distinct volume.
      properties:
        distinct_volume:
          description: Distinct volume for the given metric.
          example: 10
          format: int64
          type: integer
      type: object
    Permission:
      description: Permission object.
      properties:
        attributes:
          $ref: '#/components/schemas/PermissionAttributes'
        id:
          description: ID of the permission.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/PermissionsType'
      required:
      - type
      type: object
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    ListAPIsResponseDataAttributes:
      description: Attributes for `ListAPIsResponseData`.
      properties:
        name:
          description: API name.
          example: Payments API
          type: string
      type: object
    OutcomesResponseIncludedRuleAttributes:
      description: Details of a rule.
      properties:
        name:
          description: Name of the rule.
          example: Team Defined
          type: string
        scorecard_name:
          description: The scorecard name to which this rule must belong.
          example: Observability Best Practices
          type: string
      type: object
    GCPSTSServiceAccountAttributes:
      description: Attributes associated with your service account.
      properties:
        account_tags:
          description: Tags to be associated with GCP metrics and service checks from your account.
          items:
            description: Account Level Tag
            type: string
          type: array
        automute:
          description: Silence monitors for expected GCE instance shutdowns.
          type: boolean
          example: true
        client_email:
          description: Your service account email address.
          example: datadog-service-account@test-project.iam.gserviceaccount.com
          type: string
        cloud_run_revision_filters:
          description: 'List of filters to limit the Cloud Run revisions that are pulled into Datadog by using tags.

            Only Cloud Run revision resources that apply to specified filters are imported into Datadog.'
          example:
          - $KEY:$VALUE
          items:
            description: Cloud Run Filters
            type: string
          type: array
        host_filters:
          description: Your Host Filters.
          items:
            description: Host Filters
            type: string
          type: array
        is_cspm_enabled:
          description: 'When enabled, Datadog will activate the Cloud Security Monitoring product for this service account. Note: This requires resource_collection_enabled to be set to true.'
          type: boolean
          example: true
        is_per_project_quota_enabled:
          default: false
          description: When enabled, Datadog applies the `X-Goog-User-Project` header, attributing Google Cloud billing and quota usage to the project being monitored rather than the default service account project.
          example: true
          type: boolean
        is_resource_change_collection_enabled:
          default: false
          description: When enabled, Datadog scans for all resource change data in your Google Cloud environment.
          example: true
          type: boolean
        is_security_command_center_enabled:
          default: false
          description: 'When enabled, Datadog will attempt to collect Security Command Center Findings. Note: This requires additional permissions on the service account.'
          example: true
          type: boolean
        metric_namespace_configs:
          description: Configurations for GCP metric namespaces.
          example:
          - disabled: true
            id: aiplatform
          items:
            $ref: '#/components/schemas/GCPMetricNamespaceConfig'
          type: array
        resource_collection_enabled:
          description: When enabled, Datadog scans for all resources in your GCP environment.
          type: boolean
          example: true
      type: object
      x-merge-override:
        required: false
    AzureUCConfigPair:
      description: Azure config pair.
      properties:
        attributes:
          $ref: '#/components/schemas/AzureUCConfigPairAttributes'
        id:
          description: The ID of Cloud Cost Management account.
          format: int64
          type: integer
          example: 42
        type:
          $ref: '#/components/schemas/AzureUCConfigPairType'
      required:
      - attributes
      - type
      type: object
      x-merge-override:
        required: false
    OktaAccountResponseData:
      description: Data object of an Okta account
      properties:
        attributes:
          $ref: '#/components/schemas/OktaAccountAttributes'
        id:
          description: The ID of the Okta account, a UUID hash of the account name.
          example: f749daaf-682e-4208-a38d-c9b43162c609
          type: string
        type:
          $ref: '#/components/schemas/OktaAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineSyslogNgDestinationType:
      default: syslog_ng
      description: The destination type. The value should always be `syslog_ng`.
      enum:
      - syslog_ng
      example: syslog_ng
      type: string
      x-enum-varnames:
      - SYSLOG_NG
    ListVulnerableAssetsResponse:
      description: The expected response schema when listing vulnerable assets.
      properties:
        data:
          description: List of vulnerable assets.
          items:
            $ref: '#/components/schemas/Asset'
          type: array
        links:
          $ref: '#/components/schemas/Links'
        meta:
          $ref: '#/components/schemas/Metadata'
      required:
      - data
      type: object
    ObservabilityPipelineEnrichmentTableFileEncodingType:
      description: Specifies the encoding format (e.g., CSV) used for enrichment tables.
      enum:
      - csv
      example: csv
      type: string
      x-enum-varnames:
      - CSV
    EntityResponseIncludedRelatedIncidentAttributes:
      description: Incident attributes.
      properties:
        createdAt:
          description: Incident creation time.
          format: date-time
          type: string
          example: example_value
        htmlURL:
          description: Incident URL.
          type: string
          example: https://app.datadoghq.com
        provider:
          description: Incident provider.
          type: string
          example: abc-123-def
        status:
          description: Incident status.
          type: string
          example: OK
        title:
          description: Incident title.
          type: string
          example: Example Monitor
      type: object
    Finding:
      description: A single finding without the message and resource configuration.
      properties:
        attributes:
          $ref: '#/components/schemas/FindingAttributes'
        id:
          $ref: '#/components/schemas/FindingID'
        type:
          $ref: '#/components/schemas/FindingType'
      type: object
    ListExternalUserGroupResponseResourcesItemsMembersItems:
      description: The definition of a member belonging to a group in the List groups response.
      properties:
        $ref:
          description: The URI corresponding to a resource that is a member of this group.
          example: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          type: string
        display:
          description: Full name of the user.
          example: John Doe
          type: string
        type:
          description: A label indicating the type of resource. Only supported value is "User".
          example: User
          type: string
        value:
          description: The identifier of the member of this group.
          example: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          type: string
      type: object
    ObservabilityPipelineElasticsearchDestinationType:
      default: elasticsearch
      description: The destination type. The value should always be `elasticsearch`.
      enum:
      - elasticsearch
      example: elasticsearch
      type: string
      x-enum-varnames:
      - ELASTICSEARCH
    QuerySortOrder:
      default: desc
      description: Direction of sort.
      enum:
      - asc
      - desc
      type: string
      x-enum-varnames:
      - ASC
      - DESC
    AWSNamespacesResponseData:
      description: AWS Namespaces response data.
      properties:
        attributes:
          $ref: '#/components/schemas/AWSNamespacesResponseAttributes'
        id:
          default: namespaces
          description: The `AWSNamespacesResponseData` `id`.
          example: namespaces
          type: string
        type:
          $ref: '#/components/schemas/AWSNamespacesResponseDataType'
      required:
      - id
      - type
      type: object
    EntityAttributes:
      description: Entity attributes.
      properties:
        apiVersion:
          description: The API version.
          type: string
          example: example_value
        description:
          description: The description.
          type: string
          example: example_value
        displayName:
          description: The display name.
          type: string
          example: Example Monitor
        kind:
          description: The kind.
          type: string
          example: example_value
        name:
          description: The name.
          type: string
          example: Example Monitor
        namespace:
          description: The namespace.
          type: string
          example: Example Monitor
        owner:
          description: The owner.
          type: string
          example: example_value
        tags:
          description: The tags.
          items:
            type: string
          type: array
      type: object
    RUMApplicationList:
      description: RUM application list.
      properties:
        attributes:
          $ref: '#/components/schemas/RUMApplicationListAttributes'
        id:
          description: RUM application ID.
          example: abcd1234-0000-0000-abcd-1234abcd5678
          type: string
          x-merge-override:
            format: false
        type:
          $ref: '#/components/schemas/RUMApplicationListType'
      required:
      - attributes
      - type
      type: object
      x-merge-override:
        required: false
    AuthNMappingRelationships:
      description: All relationships associated with AuthN Mapping.
      properties:
        role:
          $ref: '#/components/schemas/RelationshipToRole'
        saml_assertion_attribute:
          $ref: '#/components/schemas/RelationshipToSAMLAssertionAttribute'
        team:
          $ref: '#/components/schemas/RelationshipToTeam'
      type: object
    ObservabilityPipelineFluentdSourceType:
      default: fluentd
      description: The source type. The value should always be `fluentd.
      enum:
      - fluentd
      example: fluentd
      type: string
      x-enum-varnames:
      - FLUENTD
    RetentionFilterAll:
      description: The definition of the retention filter.
      properties:
        attributes:
          $ref: '#/components/schemas/RetentionFilterAllAttributes'
        id:
          description: The ID of the retention filter.
          example: 7RBOb7dLSYWI01yc3pIH8w
          type: string
        type:
          $ref: '#/components/schemas/ApmRetentionFilterType'
      required:
      - id
      - type
      - attributes
      type: object
    DORAListFailuresRequestAttributes:
      description: Attributes to get a list of failures.
      properties:
        from:
          description: Minimum timestamp for requested events.
          format: date-time
          type: string
          example: example_value
        limit:
          default: 10
          description: Maximum number of events in the response.
          format: int32
          maximum: 1000
          type: integer
          example: 42
        query:
          description: Search query with event platform syntax.
          type: string
          example: avg:system.cpu.user{*}
        sort:
          description: Sort order (prefixed with `-` for descending).
          type: string
          example: example_value
        to:
          description: Maximum timestamp for requested events.
          format: date-time
          type: string
          example: example_value
      type: object
    RelationResponseMeta:
      description: Relation response metadata.
      properties:
        count:
          description: Total relations count.
          format: int64
          type: integer
          example: 42
        includeCount:
          description: Total included data count.
          format: int64
          type: integer
          example: 42
      type: object
    AWSNamespacesResponseDataType:
      default: namespaces
      description: The `AWSNamespacesResponseData` `type`.
      enum:
      - namespaces
      example: namespaces
      type: string
      x-enum-varnames:
      - NAMESPACES
    FindingEvaluationChangedAt:
      description: The date on which the evaluation for this finding changed (Unix ms).
      example: 1678721573794
      format: int64
      minimum: 1
      type: integer
    SecurityMonitoringListRulesResponse:
      description: List of rules.
      properties:
        data:
          description: Array containing the list of rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          type: array
        meta:
          $ref: '#/components/schemas/ResponseMetaAttributes'
      type: object
    ListFindingsMeta:
      additionalProperties: false
      description: Metadata for pagination.
      properties:
        page:
          $ref: '#/components/schemas/ListFindingsPage'
        snapshot_timestamp:
          description: The point in time corresponding to the listed findings.
          example: 1678721573794
          format: int64
          minimum: 1
          type: integer
      type: object
    ConfluentResourcesResponse:
      description: Response schema when interacting with a list of Confluent resources.
      properties:
        data:
          description: The JSON:API data attribute.
          items:
            $ref: '#/components/schemas/ConfluentResourceResponseData'
          type: array
      type: object
    ListFindingsPage:
      additionalProperties: false
      description: Pagination and findings count information.
      properties:
        cursor:
          description: The cursor used to paginate requests.
          example: eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=
          type: string
        total_filtered_count:
          description: The total count of findings after the filter has been applied.
          example: 213
          format: int64
          type: integer
      type: object
    ObservabilityPipelineOcsfMapperProcessorMappingMapping:
      description: Defines a single mapping rule for transforming logs into the OCSF schema.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineOcsfMappingLibrary'
    ObservabilityPipelineSplunkHecSource:
      description: 'The `splunk_hec` source implements the Splunk HTTP Event Collector (HEC) API.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-hec-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSourceType'
      required:
      - id
      - type
      type: object
    Event:
      description: The metadata associated with a request.
      properties:
        id:
          description: Event ID.
          example: '6509751066204996294'
          type: string
        name:
          description: The event name.
          type: string
          example: Example Monitor
        source_id:
          description: Event source ID.
          example: 36
          format: int64
          type: integer
        type:
          description: Event type.
          example: error_tracking_alert
          type: string
      type: object
    CustomCostsFileMetadata:
      description: Schema of a Custom Costs metadata.
      properties:
        billed_cost:
          description: Total cost in the cost file.
          example: 100.5
          format: double
          type: number
        billing_currency:
          description: Currency used in the Custom Costs file.
          example: USD
          type: string
        charge_period:
          $ref: '#/components/schemas/CustomCostsFileUsageChargePeriod'
        name:
          description: Name of the Custom Costs file.
          example: my_file.json
          type: string
        provider_names:
          description: Providers contained in the Custom Costs file.
          items:
            description: Name of the provider.
            example: my_provider
            type: string
          type: array
        status:
          description: Status of the Custom Costs file.
          example: active
          type: string
        uploaded_at:
          description: Timestamp, in millisecond, of the upload time of the Custom Costs file.
          example: 1704067200000
          format: double
          type: number
        uploaded_by:
          $ref: '#/components/schemas/CustomCostsUser'
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    ListAPIsResponseMetaPagination:
      description: Pagination metadata information for `ListAPIsResponse`.
      properties:
        limit:
          description: Number of items in the current page.
          example: 20
          format: int64
          type: integer
        offset:
          description: Offset for pagination.
          example: 0
          format: int64
          type: integer
        total_count:
          description: Total number of items.
          example: 35
          format: int64
          type: integer
      type: object
    XRayServicesIncludeAll:
      description: Include all services.
      properties:
        include_all:
          description: Include all services.
          example: false
          type: boolean
      required:
      - include_all
      type: object
    RelationResponseType:
      description: Relation type.
      enum:
      - relation
      type: string
      x-enum-varnames:
      - RELATION
    ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions:
      description: Configuration for keywords used to reinforce sensitive data pattern detection.
      properties:
        keywords:
          description: A list of keywords to match near the sensitive pattern.
          example:
          - ssn
          - card
          - account
          items:
            type: string
          type: array
        proximity:
          description: Maximum number of tokens between a keyword and a sensitive value match.
          example: 5
          format: int64
          type: integer
      required:
      - keywords
      - proximity
      type: object
    ObservabilityPipelineAmazonOpenSearchDestination:
      description: The `amazon_opensearch` destination writes logs to Amazon OpenSearch.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuth'
        bulk_index:
          description: The index to write logs to.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: elasticsearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationType'
      required:
      - id
      - type
      - inputs
      - auth
      type: object
    ObservabilityPipelineAmazonS3SourceType:
      default: amazon_s3
      description: The source type. Always `amazon_s3`.
      enum:
      - amazon_s3
      example: amazon_s3
      type: string
      x-enum-varnames:
      - AMAZON_S3
    ObservabilityPipelineSumoLogicSourceType:
      default: sumo_logic
      description: The source type. The value should always be `sumo_logic`.
      enum:
      - sumo_logic
      example: sumo_logic
      type: string
      x-enum-varnames:
      - SUMO_LOGIC
    MSTeamsIntegrationMetadataTeamsItem:
      description: Item in the Microsoft Teams integration metadata teams array.
      properties:
        ms_channel_id:
          description: Microsoft Teams channel ID.
          example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2
          type: string
        ms_channel_name:
          description: Microsoft Teams channel name.
          example: incident-0001-example
          type: string
        ms_tenant_id:
          description: Microsoft Teams tenant ID.
          example: 00000000-abcd-0005-0000-000000000000
          type: string
        redirect_url:
          description: URL redirecting to the Microsoft Teams channel.
          example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000
          type: string
      required:
      - ms_tenant_id
      - ms_channel_id
      - ms_channel_name
      - redirect_url
      type: object
    EventResponse:
      description: The object description of an event after being processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/EventResponseAttributes'
        id:
          description: the unique ID of the event.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/EventType'
      type: object
    IncidentTodoAttributes:
      description: Incident todo's attributes.
      properties:
        assignees:
          $ref: '#/components/schemas/IncidentTodoAssigneeArray'
        completed:
          description: Timestamp when the todo was completed.
          example: '2023-03-06T22:00:00.000000+00:00'
          nullable: true
          type: string
        content:
          description: The follow-up task's content.
          example: Restore lost data.
          type: string
        created:
          description: Timestamp when the incident todo was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        due_date:
          description: Timestamp when the todo should be completed by.
          example: '2023-07-10T05:00:00.000000+00:00'
          nullable: true
          type: string
        incident_id:
          description: UUID of the incident this todo is connected to.
          example: 00000000-aaaa-0000-0000-000000000000
          type: string
        modified:
          description: Timestamp when the incident todo was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - content
      - assignees
      type: object
    ListEntityCatalogResponse:
      description: List entity response.
      properties:
        data:
          $ref: '#/components/schemas/EntityResponseData'
        included:
          $ref: '#/components/schemas/ListEntityCatalogResponseIncluded'
        links:
          $ref: '#/components/schemas/ListEntityCatalogResponseLinks'
        meta:
          $ref: '#/components/schemas/EntityResponseMeta'
      type: object
    ObservabilityPipelineEnrichmentTableGeoIp:
      description: Uses a GeoIP database to enrich logs based on an IP field.
      properties:
        key_field:
          description: Path to the IP field in the log.
          example: log.source.ip
          type: string
        locale:
          description: Locale used to resolve geographical names.
          example: en
          type: string
        path:
          description: Path to the GeoIP database file.
          example: /etc/geoip/GeoLite2-City.mmdb
          type: string
      required:
      - key_field
      - locale
      - path
      type: object
    ListHistoricalJobsResponse:
      description: List of historical jobs.
      properties:
        data:
          description: Array containing the list of historical jobs.
          items:
            $ref: '#/components/schemas/HistoricalJobResponseData'
          type: array
        meta:
          $ref: '#/components/schemas/HistoricalJobListMeta'
      type: object
    IncidentResponseAttributes:
      description: The incident's attributes from a response.
      properties:
        archived:
          description: Timestamp of when the incident was archived.
          format: date-time
          nullable: true
          readOnly: true
          type: string
          example: example_value
        case_id:
          description: The incident case id.
          format: int64
          nullable: true
          type: integer
          example: 42
        created:
          description: Timestamp when the incident was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        customer_impact_duration:
          description: 'Length of the incident''s customer impact in seconds.

            Equals the difference between `customer_impact_start` and `customer_impact_end`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        customer_impact_end:
          description: Timestamp when customers were no longer impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impact_scope:
          description: A summary of the impact customers experienced during the incident.
          example: An example customer impact scope
          nullable: true
          type: string
        customer_impact_start:
          description: Timestamp when customers began being impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impacted:
          description: A flag indicating whether the incident caused customer impact.
          example: false
          type: boolean
        detected:
          description: Timestamp when the incident was detected.
          format: date-time
          nullable: true
          type: string
          example: example_value
        fields:
          additionalProperties:
            $ref: '#/components/schemas/IncidentFieldAttributes'
          description: A condensed view of the user-defined fields attached to incidents.
          example:
            severity:
              type: dropdown
              value: SEV-5
          type: object
        incident_type_uuid:
          description: A unique identifier that represents an incident type.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        modified:
          description: Timestamp when the incident was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        non_datadog_creator:
          $ref: '#/components/schemas/IncidentNonDatadogCreator'
        notification_handles:
          description: Notification handles that will be notified of the incident during update.
          example:
          - display_name: Jane Doe
            handle: '@user@email.com'
          - display_name: Slack Channel
            handle: '@slack-channel'
          - display_name: Incident Workflow
            handle: '@workflow-from-incident'
          items:
            $ref: '#/components/schemas/IncidentNotificationHandle'
          nullable: true
          type: array
        public_id:
          description: The monotonically increasing integer ID for the incident.
          example: 1
          format: int64
          type: integer
        resolved:
          description: Timestamp when the incident's state was last changed from active or stable to resolved or completed.
          format: date-time
          nullable: true
          type: string
          example: example_value
        severity:
          $ref: '#/components/schemas/IncidentSeverity'
        state:
          description: The state incident.
          nullable: true
          type: string
          example: example_value
        time_to_detect:
          description: 'The amount of time in seconds to detect the incident.

            Equals the difference between `customer_impact_start` and `detected`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_internal_response:
          description: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_repair:
          description: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_resolve:
          description: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        title:
          description: The title of the incident, which summarizes what happened.
          example: A test incident title
          type: string
        visibility:
          description: The incident visibility status.
          nullable: true
          type: string
          example: example_value
      required:
      - title
      type: object
    Library:
      description: Vulnerability library.
      properties:
        name:
          description: Vulnerability library name.
          example: linux-aws-5.15
          type: string
        version:
          description: Vulnerability library version.
          example: 5.15.0
          type: string
      required:
      - name
      type: object
    CloudConfigurationRuleComplianceSignalOptions:
      description: How to generate compliance signals. Useful for cloud_configuration rules only.
      properties:
        defaultActivationStatus:
          description: The default activation status.
          nullable: true
          type: boolean
          example: true
        defaultGroupByFields:
          description: The default group by fields.
          items:
            type: string
          nullable: true
          type: array
        userActivationStatus:
          description: Whether signals will be sent.
          nullable: true
          type: boolean
          example: true
        userGroupByFields:
          description: Fields to use to group findings by when sending signals.
          items:
            type: string
          nullable: true
          type: array
      type: object
    ApplicationSecurityWafCustomRuleConditionInput:
      description: Input from the request on which the condition should apply.
      properties:
        address:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress'
        key_path:
          description: Specific path for the input.
          items:
            type: string
          type: array
      required:
      - address
      type: object
    State:
      description: The state of the rule evaluation.
      enum:
      - pass
      - fail
      - skip
      example: pass
      type: string
      x-enum-varnames:
      - PASS
      - FAIL
      - SKIP
    AWSLogsServicesResponse:
      description: AWS Logs Services response body
      properties:
        data:
          $ref: '#/components/schemas/AWSLogsServicesResponseData'
      required:
      - data
      type: object
    FastlyAccounResponseAttributes:
      description: Attributes object of a Fastly account.
      properties:
        name:
          description: The name of the Fastly account.
          example: test-name
          type: string
        services:
          description: A list of services belonging to the parent account.
          items:
            $ref: '#/components/schemas/FastlyService'
          type: array
      required:
      - name
      type: object
    AWSNamespaceTagFilter:
      description: 'AWS Metrics Collection tag filters list. Defaults to `[]`.

        The array of custom AWS resource tags (in the form `key:value`) defines a filter that Datadog uses when collecting metrics from a specified service.

        Wildcards, such as `?` (match a single character) and `*` (match multiple characters), and exclusion using `!` before the tag are supported.

        For EC2, only hosts that match one of the defined tags will be imported into Datadog. The rest will be ignored.

        For example, `env:production,instance-type:c?.*,!region:us-east-1`.'
      properties:
        namespace:
          description: The AWS service for which the tag filters defined in `tags` will be applied.
          example: AWS/EC2
          type: string
        tags:
          description: The AWS resource tags to filter on for the service specified by `namespace`.
          items:
            description: Tag in the form `key:value`.
            example: datadog:true
            type: string
          nullable: true
          type: array
      type: object
    EntityV3MetadataAdditionalOwnersItems:
      description: The definition of Entity V3 Metadata Additional Owners Items object.
      properties:
        name:
          description: Team name.
          example: ''
          type: string
        type:
          description: Team type.
          type: string
          example: metric alert
      required:
      - name
      type: object
    ApplicationSecurityWafCustomRuleActionParameters:
      description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object.
      properties:
        location:
          description: The location to redirect to when the WAF custom rule triggers.
          example: /blocking
          type: string
        status_code:
          default: 403
          description: The status code to return when the WAF custom rule triggers.
          example: 403
          format: int64
          type: integer
      type: object
    ObservabilityPipelineSentinelOneDestinationType:
      default: sentinel_one
      description: The destination type. The value should always be `sentinel_one`.
      enum:
      - sentinel_one
      example: sentinel_one
      type: string
      x-enum-varnames:
      - SENTINEL_ONE
    ObservabilityPipelineGoogleCloudStorageDestinationType:
      default: google_cloud_storage
      description: The destination type. Always `google_cloud_storage`.
      enum:
      - google_cloud_storage
      example: google_cloud_storage
      type: string
      x-enum-varnames:
      - GOOGLE_CLOUD_STORAGE
    ApplicationSecurityWafCustomRuleScope:
      description: The scope of the WAF custom rule.
      properties:
        env:
          description: The environment scope for the WAF custom rule.
          example: prod
          type: string
        service:
          description: The service scope for the WAF custom rule.
          example: billing-service
          type: string
      required:
      - service
      - env
      type: object
    AWSAuthConfigKeys:
      description: AWS Authentication config to integrate your account using an access key pair.
      properties:
        access_key_id:
          description: AWS Access Key ID.
          example: AKIAIOSFODNN7EXAMPLE
          type: string
        secret_access_key:
          description: AWS Secret Access Key.
          example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
          minLength: 1
          type: string
          writeOnly: true
      required:
      - access_key_id
      type: object
    XRayServicesList:
      description: AWS X-Ray services to collect traces from. Defaults to `include_only`.
      oneOf:
      - $ref: '#/components/schemas/XRayServicesIncludeAll'
      - $ref: '#/components/schemas/XRayServicesIncludeOnly'
    SecurityMonitoringThirdPartyRuleCase:
      description: Case when signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    SensitiveDataScannerRuleType:
      default: sensitive_data_scanner_rule
      description: Sensitive Data Scanner rule type.
      enum:
      - sensitive_data_scanner_rule
      example: sensitive_data_scanner_rule
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_RULE
    IncidentFieldAttributes:
      description: Dynamic fields for which selections can be made, with field names as keys.
      oneOf:
      - $ref: '#/components/schemas/IncidentFieldAttributesSingleValue'
      - $ref: '#/components/schemas/IncidentFieldAttributesMultipleValue'
    RelationshipToSAMLAssertionAttribute:
      description: AuthN Mapping relationship to SAML Assertion Attribute.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToSAMLAssertionAttributeData'
      required:
      - data
      type: object
    AuditLogsSort:
      description: Sort parameters when querying events.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    SpansAttributes:
      description: JSON object containing all span attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from your span.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        custom:
          additionalProperties: {}
          description: JSON object of custom spans data.
          type: object
        end_timestamp:
          description: End timestamp of your span.
          example: '2023-01-02T09:42:36.420Z'
          format: date-time
          type: string
        env:
          description: Name of the environment from where the spans are being sent.
          example: prod
          type: string
        host:
          description: Name of the machine from where the spans are being sent.
          example: i-0123
          type: string
        ingestion_reason:
          description: The reason why the span was ingested.
          example: rule
          type: string
        parent_id:
          description: Id of the span that's parent of this span.
          example: '0'
          type: string
        resource_hash:
          description: Unique identifier of the resource.
          example: a12345678b91c23d
          type: string
        resource_name:
          description: The name of the resource.
          example: agent
          type: string
        retained_by:
          description: The reason why the span was indexed.
          example: retention_filter
          type: string
        service:
          description: 'The name of the application or service generating the span events.

            It is used to switch from APM to Logs, so make sure you define the same

            value when you use both products.'
          example: agent
          type: string
        single_span:
          description: Whether or not the span was collected as a stand-alone span. Always associated to "single_span" ingestion_reason if true.
          example: true
          type: boolean
        span_id:
          description: Id of the span.
          example: '1234567890987654321'
          type: string
        start_timestamp:
          description: Start timestamp of your span.
          example: '2023-01-02T09:42:36.320Z'
          format: date-time
          type: string
        tags:
          description: Array of tags associated with your span.
          example:
          - team:A
          items:
            description: Tag associated with your span.
            type: string
          type: array
        trace_id:
          description: Id of the trace to which the span belongs.
          example: '1234567890987654321'
          type: string
        type:
          description: The type of the span.
          example: web
          type: string
      type: object
    AWSNamespaceFilters:
      description: AWS Metrics namespace filters. Defaults to `exclude_only`.
      oneOf:
      - $ref: '#/components/schemas/AWSNamespaceFiltersExcludeOnly'
      - $ref: '#/components/schemas/AWSNamespaceFiltersIncludeOnly'
    EventsResponseMetadata:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: The time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/EventsResponseMetadataPage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          description: The request status.
          example: done
          type: string
        warnings:
          description: 'A list of warnings (non-fatal errors) encountered. Partial results might be returned if

            warnings are present in the response.'
          items:
            $ref: '#/components/schemas/EventsWarning'
          type: array
      type: object
    ObservabilityPipelineThrottleProcessor:
      description: The `throttle` processor limits the number of events that pass through over a given time window.
      properties:
        group_by:
          description: Optional list of fields used to group events before the threshold has been reached.
          example:
          - log.user.id
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: throttle-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: env:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        threshold:
          description: the number of events allowed in a given time window. Events sent after the threshold has been reached, are dropped.
          example: 1000
          format: int64
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessorType'
        window:
          description: The time window in seconds over which the threshold applies.
          example: 60
          format: double
          type: number
      required:
      - id
      - type
      - include
      - inputs
      - threshold
      - window
      type: object
    ListExternalUserGroupResponseResourcesItems:
      description: Resources returned in response to a List groups request.
      properties:
        displayName:
          description: A human-readable name for the group.
          example: My test group
          type: string
        externalId:
          description: An identifier for the resource as defined by the provisioning client.
          example: 346af543-e5ab-4855-937d-133231cd59ed
          type: string
        id:
          description: The identifier of the resource. Not required when creating a group.
          example: 0e80d350-9519-4771-9aa8-ce849fc36c20
          type: string
        members:
          description: A list of members belonging to the team.
          items:
            $ref: '#/components/schemas/ListExternalUserGroupResponseResourcesItemsMembersItems'
          type: array
        meta:
          $ref: '#/components/schemas/ExternalUserGroupMeta'
        schemas:
          description: Group JSON Schemas.
          example:
          - urn:ietf:params:scim:schemas:core:2.0:Group
          items:
            type: string
          type: array
      type: object
    IncludeType:
      description: Supported include types.
      enum:
      - schema
      - raw_schema
      - oncall
      - incident
      - relation
      type: string
      x-enum-varnames:
      - SCHEMA
      - RAW_SCHEMA
      - ONCALL
      - INCIDENT
      - RELATION
    SensitiveDataScannerConfigurationData:
      description: A Sensitive Data Scanner configuration data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerConfiguration'
      type: object
    EntityV3DatadogPipelines:
      additionalProperties: false
      description: CI Pipelines association.
      properties:
        fingerprints:
          description: A list of CI Fingerprints that associate CI Pipelines with the entity.
          items:
            type: string
          type: array
      type: object
    ApplicationSecurityWafExclusionFilterScope:
      description: Deploy on services based on their environment and/or service name.
      properties:
        env:
          description: Deploy on this environment.
          example: www
          type: string
        service:
          description: Deploy on this service.
          example: prod
          type: string
      type: object
    GCPSTSDelegateAccountResponse:
      description: Your delegate service account response data.
      properties:
        data:
          $ref: '#/components/schemas/GCPSTSDelegateAccount'
      type: object
    AWSAccountsResponse:
      description: AWS Accounts response body.
      properties:
        data:
          description: List of AWS Account Integration Configs.
          items:
            $ref: '#/components/schemas/AWSAccountResponseData'
          type: array
      required:
      - data
      type: object
    IncidentTodoAssigneeHandle:
      description: Assignee's @-handle.
      example: '@test.user@test.com'
      type: string
    EntityV3System:
      additionalProperties: false
      description: Schema for system entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3SystemDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3SystemKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3SystemSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem:
      description: Single key-value pair used as a custom log header for Sumo Logic.
      properties:
        name:
          description: The header field name.
          example: X-Sumo-Category
          type: string
        value:
          description: The header field value.
          example: my-app-logs
          type: string
      required:
      - name
      - value
      type: object
    RuleId:
      description: The unique ID for a scorecard rule.
      example: q8MQxk8TCqrHnWkx
      type: string
    EntityV3MetadataLinksItems:
      additionalProperties: false
      description: The definition of Entity V3 Metadata Links Items object.
      properties:
        name:
          description: Link name.
          example: mylink
          type: string
        provider:
          description: Link provider.
          type: string
          example: abc-123-def
        type:
          default: other
          description: Link type.
          example: link
          type: string
        url:
          description: Link URL.
          example: https://mylink
          type: string
      required:
      - name
      - type
      - url
      type: object
    RelationshipToOrganizations:
      description: Relationship to organizations.
      properties:
        data:
          description: Relationships to organization objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToOrganizationData'
          type: array
      required:
      - data
      type: object
    LeakedKeyType:
      default: leaked_keys
      description: The definition of LeakedKeyType object.
      enum:
      - leaked_keys
      example: leaked_keys
      type: string
      x-enum-varnames:
      - LEAKED_KEYS
    ObservabilityPipelineQuotaProcessorLimitEnforceType:
      description: Unit for quota enforcement in bytes for data size or events for count.
      enum:
      - bytes
      - events
      example: bytes
      type: string
      x-enum-varnames:
      - BYTES
      - EVENTS
    DORAEvent:
      description: A DORA event.
      properties:
        attributes:
          description: The attributes of the event.
          type: object
        id:
          description: The ID of the event.
          type: string
          example: abc-123-def
        type:
          description: The type of the event.
          type: string
          example: metric alert
      type: object
    IncidentTodoType:
      default: incident_todos
      description: Todo resource type.
      enum:
      - incident_todos
      example: incident_todos
      type: string
      x-enum-varnames:
      - INCIDENT_TODOS
    NullableRelationshipToUser:
      description: Relationship to user.
      nullable: true
      properties:
        data:
          $ref: '#/components/schemas/NullableRelationshipToUserData'
      required:
      - data
      type: object
    CIAppResponsePage:
      description: Paging attributes.
      properties:
        after:
          description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    RUMApplicationListAttributes:
      description: RUM application list attributes.
      properties:
        application_id:
          description: ID of the RUM application.
          example: abcd1234-0000-0000-abcd-1234abcd5678
          type: string
          x-merge-override:
            format: false
        created_at:
          description: Timestamp in ms of the creation date.
          example: 1659479836169
          format: int64
          type: integer
        created_by_handle:
          description: Handle of the creator user.
          example: john.doe
          type: string
        hash:
          description: Hash of the RUM application. Optional.
          type: string
          example: example_value
        is_active:
          description: Indicates if the RUM application is active.
          example: true
          type: boolean
        name:
          description: Name of the RUM application.
          example: my_rum_application
          type: string
        org_id:
          description: Org ID of the RUM application.
          example: 999
          format: int32
          maximum: 2147483647
          type: integer
        type:
          description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`.
          example: browser
          type: string
        updated_at:
          description: Timestamp in ms of the last update date.
          example: 1659479836169
          format: int64
          type: integer
        updated_by_handle:
          description: Handle of the updater user.
          example: jane.doe
          type: string
      required:
      - application_id
      - created_at
      - created_by_handle
      - name
      - org_id
      - type
      - updated_at
      - updated_by_handle
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningDuration:
      default: 0
      description: 'The duration in days during which values are learned, and after which signals will be generated for values that

        weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.'
      enum:
      - 0
      - 1
      - 7
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_DAYS
      - ONE_DAY
      - SEVEN_DAYS
    PermissionsResponse:
      description: Payload with API-returned permissions.
      properties:
        data:
          description: Array of permissions.
          items:
            $ref: '#/components/schemas/Permission'
          type: array
      type: object
    DORAListFailuresRequestData:
      description: The JSON:API data.
      properties:
        attributes:
          $ref: '#/components/schemas/DORAListFailuresRequestAttributes'
        type:
          $ref: '#/components/schemas/DORAListFailuresRequestDataType'
      required:
      - attributes
      type: object
    AWSResourcesConfig:
      description: AWS Resources Collection config.
      properties:
        cloud_security_posture_management_collection:
          description: Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations, identity risks, and compliance violations. Defaults to `false`. Requires `extended_collection` to be set to `true`.
          example: false
          type: boolean
        extended_collection:
          description: Whether Datadog collects additional attributes and configuration information about the resources in your AWS account. Defaults to `true`. Required for `cloud_security_posture_management_collection`.
          example: true
          type: boolean
      type: object
    Selectors:
      description: 'Selectors are used to filter security issues for which notifications should be generated.

        Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.

        Only the trigger_source field is required.'
      properties:
        query:
          $ref: '#/components/schemas/NotificationRuleQuery'
        rule_types:
          $ref: '#/components/schemas/RuleTypes'
        severities:
          description: The security rules severities to consider.
          items:
            $ref: '#/components/schemas/RuleSeverity'
          type: array
        trigger_source:
          $ref: '#/components/schemas/TriggerSource'
      required:
      - trigger_source
      type: object
    ObservabilityPipelineRsyslogDestinationType:
      default: rsyslog
      description: The destination type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    SecurityMonitoringRuleNewValueOptions:
      description: Options on new value detection method.
      properties:
        forgetAfter:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
        learningDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
        learningMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod'
        learningThreshold:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold'
      type: object
    EventsListResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'Link for the next set of results. Note that the request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/events?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    AWSAccountResponseAttributes:
      description: AWS Account response attributes.
      properties:
        account_tags:
          $ref: '#/components/schemas/AWSAccountTags'
        auth_config:
          $ref: '#/components/schemas/AWSAuthConfig'
        aws_account_id:
          $ref: '#/components/schemas/AWSAccountID'
        aws_partition:
          $ref: '#/components/schemas/AWSAccountPartition'
        aws_regions:
          $ref: '#/components/schemas/AWSRegions'
        created_at:
          description: Timestamp of when the account integration was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        logs_config:
          $ref: '#/components/schemas/AWSLogsConfig'
        metrics_config:
          $ref: '#/components/schemas/AWSMetricsConfig'
        modified_at:
          description: Timestamp of when the account integration was updated.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        resources_config:
          $ref: '#/components/schemas/AWSResourcesConfig'
        traces_config:
          $ref: '#/components/schemas/AWSTracesConfig'
      required:
      - aws_account_id
      type: object
    RolesResponse:
      description: Response containing information about multiple roles.
      properties:
        data:
          description: Array of returned roles.
          items:
            $ref: '#/components/schemas/Role'
          type: array
        meta:
          $ref: '#/components/schemas/ResponseMetaAttributes'
      type: object
    ListExternalUserGroupResponse:
      description: List groups response object.
      example:
        Resources:
        - displayName: Group 1
          externalId: group1
          id: e43536e9-33fe-43f8-90b8-d3e39a7dd6ad
          members:
          - $ref: https://app.datadoghq.com/api/scim/v2/Users/d34a5f93-5690-4d3f-a293-f2ad5c7a82a4
            display: John Doe
            type: User
            value: d34a5f93-5690-4d3f-a293-f2ad5c7a82a4
          - $ref: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
            display: Jane Doe
            type: User
            value: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          meta:
            created: '2024-11-22T15:05:52.055138963Z'
            lastModified: '2024-11-22T15:05:52.055139017Z'
            location: https://app.datadoghq.com/api/scim/v2/Groups/e43536e9-33fe-43f8-90b8-d3e39a7dd6ad
            resourceType: Group
          schemas:
          - urn:ietf:params:scim:schemas:core:2.0:Group
        - displayName: Group 2
          externalId: group2
          id: 79ef0d28-f257-4829-97e6-d23d2a26cb1a
          members:
          - $ref: https://app.datadoghq.com/api/scim/v2/Users/29da9fb7-8fca-4e87-bf58-86652253deae
            display: Alice Smith
            type: User
            value: 29da9fb7-8fca-4e87-bf58-86652253deae
          - $ref: https://app.datadoghq.com/api/scim/v2/Users/f85e3868-ad7b-47e3-a8a9-ff1eade2bbf9
            display: Bob Smith
            type: User
            value: f85e3868-ad7b-47e3-a8a9-ff1eade2bbf9
          meta:
            created: '2024-11-22T15:05:52.055139748Z'
            lastModified: '2024-11-22T15:05:52.055139813Z'
            location: https://app.datadoghq.com/api/scim/v2/Groups/79ef0d28-f257-4829-97e6-d23d2a26cb1a
            resourceType: Group
          schemas:
          - urn:ietf:params:scim:schemas:core:2.0:Group
        itemsPerPage: 2
        schemas:
        - urn:ietf:params:scim:api:messages:2.0:ListResponse
        startIndex: 1
        totalResults: 2
      properties:
        Resources:
          description: List of groups matching the request criteria.
          items:
            $ref: '#/components/schemas/ListExternalUserGroupResponseResourcesItems'
          type: array
        itemsPerPage:
          description: Number of groups returned per page.
          format: int64
          maximum: 4294967295
          minimum: 0
          type: integer
          example: 42
        schemas:
          description: List response JSON Schemas.
          example:
          - urn:ietf:params:scim:api:messages:2.0:ListResponse
          items:
            type: string
          type: array
        startIndex:
          description: Starting index of the groups for this page (1-indexed).
          format: int64
          maximum: 4294967295
          minimum: 0
          type: integer
          example: 42
        totalResults:
          description: Total number of groups matching the request criteria.
          format: int64
          maximum: 4294967295
          minimum: 0
          type: integer
          example: 42
      type: object
    RetentionFiltersResponse:
      description: An ordered list of retention filters.
      properties:
        data:
          description: A list of retention filters objects.
          items:
            $ref: '#/components/schemas/RetentionFilterAll'
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineQuotaProcessorOverflowAction:
      description: 'The action to take when the quota is exceeded. Options:

        - `drop`: Drop the event.

        - `no_action`: Let the event pass through.

        - `overflow_routing`: Route to an overflow destination.

        '
      enum:
      - drop
      - no_action
      - overflow_routing
      example: drop
      type: string
      x-enum-varnames:
      - DROP
      - NO_ACTION
      - OVERFLOW_ROUTING
    ResponseMetaAttributes:
      description: Object describing meta attributes of response.
      properties:
        page:
          $ref: '#/components/schemas/Pagination'
      type: object
      x-merge-override:
        properties: false
    CIAppResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'Link for the next set of results. The request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/ci/tests/events?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    SensitiveDataScannerRule:
      description: Rule item included in the group.
      properties:
        id:
          description: ID of the rule.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      type: object
    ObservabilityPipelineSplunkHecSourceType:
      default: splunk_hec
      description: The source type. Always `splunk_hec`.
      enum:
      - splunk_hec
      example: splunk_hec
      type: string
      x-enum-varnames:
      - SPLUNK_HEC
    EntityV3Metadata:
      additionalProperties: false
      description: The definition of Entity V3 Metadata object.
      properties:
        additionalOwners:
          additionalProperties: false
          description: The additional owners of the entity, usually a team.
          items:
            $ref: '#/components/schemas/EntityV3MetadataAdditionalOwnersItems'
          type: array
        contacts:
          additionalProperties: false
          description: A list of contacts for the entity.
          items:
            $ref: '#/components/schemas/EntityV3MetadataContactsItems'
          type: array
        description:
          description: Short description of the entity. The UI can leverage the description for display.
          type: string
          example: example_value
        displayName:
          description: User friendly name of the entity. The UI can leverage the display name for display.
          type: string
          example: Example Monitor
        id:
          description: A read-only globally unique identifier for the entity generated by Datadog.  User supplied values are ignored.
          example: 4b163705-23c0-4573-b2fb-f6cea2163fcb
          minLength: 1
          type: string
        inheritFrom:
          description: The entity reference from which to inherit metadata
          example: application:default/myapp
          type: string
        links:
          additionalProperties: false
          description: A list of links for the entity.
          items:
            $ref: '#/components/schemas/EntityV3MetadataLinksItems'
          type: array
        managed:
          additionalProperties: {}
          description: A read-only set of Datadog managed attributes generated by Datadog.  User supplied values are ignored.
          type: object
        name:
          description: Unique name given to an entity under the kind/namespace.
          example: myService
          minLength: 1
          type: string
        namespace:
          description: Namespace is a part of unique identifier. It has a default value of 'default'.
          example: default
          minLength: 1
          type: string
        owner:
          description: The owner of the entity, usually a team.
          type: string
          example: example_value
        tags:
          description: A set of custom tags.
          example:
          - this:tag
          - that:tag
          items:
            type: string
          type: array
      required:
      - name
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget:
      description: Applies the rule to all fields.
      enum:
      - all
      example: all
      type: string
      x-enum-varnames:
      - ALL
    ObservabilityPipelineSumoLogicDestinationEncoding:
      description: The output encoding format.
      enum:
      - json
      - raw_message
      - logfmt
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
      - LOGFMT
    ApplicationSecurityWafCustomRuleType:
      default: custom_rule
      description: The type of the resource. The value should always be `custom_rule`.
      enum:
      - custom_rule
      example: custom_rule
      type: string
      x-enum-varnames:
      - CUSTOM_RULE
    NotificationRuleQuery:
      description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
      example: (source:production_service OR env:prod)
      type: string
    AWSAccountConfigID:
      description: 'Unique Datadog ID of the AWS Account Integration Config.

        To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations)

        endpoint and query by AWS Account ID.'
      example: 00000000-abcd-0001-0000-000000000000
      type: string
    ObservabilityPipelineParseGrokProcessorType:
      default: parse_grok
      description: The processor type. The value should always be `parse_grok`.
      enum:
      - parse_grok
      example: parse_grok
      type: string
      x-enum-varnames:
      - PARSE_GROK
    RUMResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    RestrictionQueryWithoutRelationships:
      description: Restriction query object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/RestrictionQueryAttributes'
        id:
          description: ID of the restriction query.
          example: 79a0e60a-644a-11ea-ad29-43329f7f58b5
          type: string
        type:
          default: logs_restriction_queries
          description: Restriction queries type.
          example: logs_restriction_queries
          readOnly: true
          type: string
      type: object
    FastlyServiceAttributes:
      description: Attributes object for Fastly service requests.
      properties:
        tags:
          description: A list of tags for the Fastly service.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      type: object
    ObservabilityPipelineAmazonOpenSearchDestinationType:
      default: amazon_opensearch
      description: The destination type. The value should always be `amazon_opensearch`.
      enum:
      - amazon_opensearch
      example: amazon_opensearch
      type: string
      x-enum-varnames:
      - AMAZON_OPENSEARCH
    ExternalUserGroupMeta:
      description: Metadata associated with a group.
      properties:
        created:
          description: The date and time the group was created.
          example: '2024-10-17T12:53:35.793Z'
          format: date-time
          type: string
        lastModified:
          description: The date and time the group was last changed.
          example: '2024-10-19T12:53:35.793Z'
          format: date-time
          type: string
        location:
          description: URL identifying the resource.
          example: https://app.datadoghq.com/api/scim/v2/Groups/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          type: string
        resourceType:
          description: Type of resource.
          example: Group
          type: string
      type: object
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    ObservabilityPipelineRsyslogSource:
      description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rsyslog-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType'
      required:
      - id
      - type
      - mode
      type: object
    IncidentAttachmentAttributes:
      description: The attributes object for an attachment.
      oneOf:
      - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes'
      - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes'
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    IncidentAttachmentRelatedObject:
      description: The object related to an incident attachment.
      enum:
      - users
      type: string
      x-enum-varnames:
      - USERS
    AuthNMappingIncluded:
      description: Included data in the AuthN Mapping response.
      oneOf:
      - $ref: '#/components/schemas/SAMLAssertionAttribute'
      - $ref: '#/components/schemas/Role'
      - $ref: '#/components/schemas/AuthNMappingTeam'
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    ObservabilityPipelineLogstashSourceType:
      default: logstash
      description: The source type. The value should always be `logstash`.
      enum:
      - logstash
      example: logstash
      type: string
      x-enum-varnames:
      - LOGSTASH
    SensitiveDataScannerMeta:
      description: Meta response containing information about the API.
      properties:
        count_limit:
          description: Maximum number of scanning rules allowed for the org.
          format: int64
          type: integer
          example: 42
        group_count_limit:
          description: Maximum number of scanning groups allowed for the org.
          format: int64
          type: integer
          example: 42
        has_highlight_enabled:
          default: true
          deprecated: true
          description: (Deprecated) Whether or not scanned events are highlighted in Logs or RUM for the org.
          type: boolean
          example: true
        has_multi_pass_enabled:
          deprecated: true
          description: (Deprecated) Whether or not scanned events have multi-pass enabled.
          type: boolean
          example: true
        is_pci_compliant:
          description: Whether or not the org is compliant to the payment card industry standard.
          type: boolean
          example: true
        version:
          description: Version of the API.
          example: 0
          format: int64
          minimum: 0
          type: integer
      type: object
    MetricCustomAggregations:
      description: Deprecated. You no longer need to configure specific time and space aggregations for Metrics Without Limits.
      example:
      - space: sum
        time: sum
      - space: sum
        time: count
      items:
        $ref: '#/components/schemas/MetricCustomAggregation'
      type: array
    RestrictionQueryAttributes:
      description: Attributes of the restriction query.
      properties:
        created_at:
          description: Creation time of the restriction query.
          example: '2020-03-17T21:06:44.000Z'
          format: date-time
          readOnly: true
          type: string
        modified_at:
          description: Time of last restriction query modification.
          example: '2020-03-17T21:15:15.000Z'
          format: date-time
          readOnly: true
          type: string
        restriction_query:
          description: The query that defines the restriction. Only the content matching the query can be returned.
          example: env:sandbox
          type: string
      type: object
    RuleTypesItems:
      description: 'Security rule type which can be used in security rules.

        Signal-based notification rules can filter signals based on rule types application_security, log_detection,

        workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.

        Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,

        application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, and api_security.'
      enum:
      - application_security
      - log_detection
      - workload_security
      - signal_correlation
      - cloud_configuration
      - infrastructure_configuration
      - application_code_vulnerability
      - application_library_vulnerability
      - attack_path
      - container_image_vulnerability
      - identity_risk
      - misconfiguration
      - api_security
      type: string
      x-enum-varnames:
      - APPLICATION_SECURITY
      - LOG_DETECTION
      - WORKLOAD_SECURITY
      - SIGNAL_CORRELATION
      - CLOUD_CONFIGURATION
      - INFRASTRUCTURE_CONFIGURATION
      - APPLICATION_CODE_VULNERABILITY
      - APPLICATION_LIBRARY_VULNERABILITY
      - ATTACK_PATH
      - CONTAINER_IMAGE_VULNERABILITY
      - IDENTITY_RISK
      - MISCONFIGURATION
      - API_SECURITY
    AWSLogsServicesResponseData:
      description: AWS Logs Services response body
      properties:
        attributes:
          $ref: '#/components/schemas/AWSLogsServicesResponseAttributes'
        id:
          default: logs_services
          description: The `AWSLogsServicesResponseData` `id`.
          example: logs_services
          type: string
        type:
          $ref: '#/components/schemas/AWSLogsServicesResponseDataType'
      required:
      - id
      - type
      type: object
    LeakedKeyAttributes:
      description: The definition of LeakedKeyAttributes object.
      properties:
        date:
          description: The LeakedKeyAttributes date.
          example: '2017-07-21T17:32:28Z'
          format: date-time
          type: string
        leak_source:
          description: The LeakedKeyAttributes leak_source.
          type: string
          example: example_value
      required:
      - date
      type: object
    EventResponseAttributes:
      description: The object description of an event response attribute.
      properties:
        attributes:
          $ref: '#/components/schemas/EventAttributes'
        message:
          description: The message of the event.
          type: string
          example: CPU usage is high on {{host.name}}
        tags:
          description: An array of tags associated with the event.
          example:
          - team:A
          items:
            description: The tag associated with the event.
            type: string
          type: array
        timestamp:
          description: The timestamp of the event.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    ObservabilityPipelineGeneratedMetric:
      description: 'Defines a log-based custom metric, including its name, type, filter, value computation strategy,

        and optional grouping fields.

        '
      properties:
        group_by:
          description: Optional fields used to group the metric series.
          example:
          - service
          - env
          items:
            type: string
          type: array
        include:
          description: Datadog filter query to match logs for metric generation.
          example: service:billing
          type: string
        metric_type:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType'
        name:
          description: Name of the custom metric to be created.
          example: logs.processed
          type: string
        value:
          $ref: '#/components/schemas/ObservabilityPipelineMetricValue'
      required:
      - name
      - include
      - metric_type
      - value
      type: object
    VulnerabilityTool:
      description: The vulnerability tool.
      enum:
      - IAST
      - SCA
      - Infra
      example: SCA
      type: string
      x-enum-varnames:
      - IAST
      - SCA
      - INFRA
    IncidentResponseRelationships:
      description: The incident's relationships from a response.
      properties:
        attachments:
          $ref: '#/components/schemas/RelationshipToIncidentAttachment'
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        impacts:
          $ref: '#/components/schemas/RelationshipToIncidentImpacts'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        responders:
          $ref: '#/components/schemas/RelationshipToIncidentResponders'
        user_defined_fields:
          $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields'
      type: object
    SensitiveDataScannerRuleAttributes:
      description: Attributes of the Sensitive Data Scanner rule.
      properties:
        description:
          description: Description of the rule.
          type: string
          example: example_value
        excluded_namespaces:
          description: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array.
          example:
          - admin.name
          items:
            type: string
          type: array
        included_keyword_configuration:
          $ref: '#/components/schemas/SensitiveDataScannerIncludedKeywordConfiguration'
        is_enabled:
          description: Whether or not the rule is enabled.
          type: boolean
          example: true
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        namespaces:
          description: 'Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned.

            If both are missing the whole event is scanned.'
          example:
          - admin
          items:
            type: string
          type: array
        pattern:
          description: Not included if there is a relationship to a standard pattern.
          type: string
          example: example_value
        priority:
          description: Integer from 1 (high) to 5 (low) indicating rule issue severity.
          format: int64
          maximum: 5
          minimum: 1
          type: integer
          example: 42
        tags:
          description: List of tags.
          items:
            type: string
          type: array
        text_replacement:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacement'
      type: object
    AWSRegionsIncludeAll:
      description: Include all regions. Defaults to `true`.
      properties:
        include_all:
          description: Include all regions.
          example: true
          type: boolean
      required:
      - include_all
      type: object
    ObservabilityPipelineGoogleChronicleDestination:
      description: The `google_chronicle` destination sends logs to Google Chronicle.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        customer_id:
          description: The Google Chronicle customer ID.
          example: abcdefg123456789
          type: string
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding'
        id:
          description: The unique identifier for this component.
          example: google-chronicle-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        log_type:
          description: The log type metadata associated with the Chronicle destination.
          example: nginx_logs
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType'
      required:
      - id
      - type
      - inputs
      - auth
      - customer_id
      type: object
    IncidentTodoAnonymousAssigneeSource:
      default: slack
      description: The source of the anonymous assignee.
      enum:
      - slack
      - microsoft_teams
      example: slack
      type: string
      x-enum-varnames:
      - SLACK
      - MICROSOFT_TEAMS
    MetricTagConfigurationType:
      default: manage_tags
      description: The metric tag configuration resource type.
      enum:
      - manage_tags
      example: manage_tags
      type: string
      x-enum-varnames:
      - MANAGE_TAGS
    AWSRegions:
      description: AWS Regions to collect data from. Defaults to `include_all`.
      oneOf:
      - $ref: '#/components/schemas/AWSRegionsIncludeAll'
      - $ref: '#/components/schemas/AWSRegionsIncludeOnly'
    ApiID:
      description: API identifier.
      example: 90646597-5fdb-4a17-a240-647003f8c028
      format: uuid
      type: string
    ObservabilityPipelineEnrichmentTableFileKeyItemsComparison:
      description: Defines how to compare key fields for enrichment table lookups.
      enum:
      - equals
      example: equals
      type: string
      x-enum-varnames:
      - EQUALS
    SecurityMonitoringStandardRuleQuery:
      description: Query for matching rule.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metric:
          deprecated: true
          description: '(Deprecated) The target field to aggregate over when using the sum or max

            aggregations. `metrics` field should be used instead.'
          type: string
          example: example_value
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    SecurityMonitoringSignalRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    FindingResourceType:
      description: The resource type of this finding.
      example: azure_storage_account
      type: string
    EntityV3APISpecInterfaceDefinition:
      additionalProperties: false
      description: The definition of `EntityV3APISpecInterfaceDefinition` object.
      properties:
        definition:
          description: The API definition.
          type: object
      type: object
    RetentionFilterAllAttributes:
      description: The attributes of the retention filter.
      properties:
        created_at:
          description: The creation timestamp of the retention filter.
          format: int64
          type: integer
          example: 42
        created_by:
          description: The creator of the retention filter.
          type: string
          example: example_value
        editable:
          description: Shows whether the filter can be edited.
          example: true
          type: boolean
        enabled:
          description: The status of the retention filter (Enabled/Disabled).
          example: true
          type: boolean
        execution_order:
          description: The execution order of the retention filter.
          format: int64
          type: integer
          example: 42
        filter:
          $ref: '#/components/schemas/SpansFilter'
        filter_type:
          $ref: '#/components/schemas/RetentionFilterAllType'
        modified_at:
          description: The modification timestamp of the retention filter.
          format: int64
          type: integer
          example: 42
        modified_by:
          description: The modifier of the retention filter.
          type: string
          example: example_value
        name:
          description: The name of the retention filter.
          example: my retention filter
          type: string
        rate:
          description: 'Sample rate to apply to spans going through this retention filter.

            A value of 1.0 keeps all spans matching the query.'
          example: 1
          format: double
          type: number
        trace_rate:
          description: 'Sample rate to apply to traces containing spans going through this retention filter.

            A value of 1.0 keeps all traces with spans matching the query.'
          example: 1
          format: double
          type: number
      type: object
    AuditLogsResponseMetadata:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: Time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/AuditLogsResponsePage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          $ref: '#/components/schemas/AuditLogsResponseStatus'
        warnings:
          description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if

            warnings are present in the response.'
          items:
            $ref: '#/components/schemas/AuditLogsWarning'
          type: array
      type: object
    ObservabilityPipelineParseGrokProcessorRuleMatchRule:
      description: 'Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns.

        Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field.

        '
      properties:
        name:
          description: The name of the rule.
          example: MyParsingRule
          type: string
        rule:
          description: The definition of the Grok rule.
          example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
          type: string
      required:
      - name
      - rule
      type: object
    ObservabilityPipelineKafkaSource:
      description: The `kafka` source ingests data from Apache Kafka topics.
      properties:
        group_id:
          description: Consumer group ID used by the Kafka client.
          example: consumer-group-0
          type: string
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: kafka-source
          type: string
        librdkafka_options:
          description: Optional list of advanced Kafka client configuration options, defined as key-value pairs.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceLibrdkafkaOption'
          type: array
        sasl:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceSasl'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        topics:
          description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified.
          example:
          - topic1
          - topic2
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceType'
      required:
      - id
      - type
      - group_id
      - topics
      type: object
    RUMResponseMetadata:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: The time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/RUMResponsePage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          $ref: '#/components/schemas/RUMResponseStatus'
        warnings:
          description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if

            warnings are present in the response.'
          items:
            $ref: '#/components/schemas/RUMWarning'
          type: array
      type: object
    ListTagsResponseDataAttributes:
      description: The definition of ListTagsResponseDataAttributes object.
      properties:
        tags:
          description: The list of tags
          example:
          - tag:test
          - tag:testbis
          items:
            type: string
          type: array
      type: object
    EntityV3APISpecInterfaceFileRef:
      additionalProperties: false
      description: The definition of `EntityV3APISpecInterfaceFileRef` object.
      properties:
        fileRef:
          description: The reference to the API definition file.
          type: string
          example: example_value
      type: object
    SecurityMonitoringSignalListRequestPage:
      description: The paging attributes for listing security signals.
      properties:
        cursor:
          description: A list of results using the cursor provided in the previous query.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
        limit:
          default: 10
          description: The maximum number of security signals in the response.
          example: 25
          format: int32
          maximum: 1000
          type: integer
      type: object
    RelationAttributes:
      description: Relation attributes.
      properties:
        from:
          $ref: '#/components/schemas/RelationEntity'
        to:
          $ref: '#/components/schemas/RelationEntity'
        type:
          $ref: '#/components/schemas/RelationType'
      type: object
    ListAppsResponseDataItems:
      description: An app definition object. This contains only basic information about the app such as ID, name, and tags.
      properties:
        attributes:
          $ref: '#/components/schemas/ListAppsResponseDataItemsAttributes'
        id:
          description: The ID of the app.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        meta:
          $ref: '#/components/schemas/AppMeta'
        relationships:
          $ref: '#/components/schemas/ListAppsResponseDataItemsRelationships'
        type:
          $ref: '#/components/schemas/AppDefinitionType'
      required:
      - id
      - type
      - attributes
      type: object
    ListExternalUsersResponseResourcesItems:
      description: Resources returned in response to a List users request.
      properties:
        active:
          description: A Boolean value indicating the User's administrative status.
          type: boolean
          example: true
        emails:
          description: Email addresses for the user.
          items:
            $ref: '#/components/schemas/ExternalUserEmailType'
          type: array
        id:
          description: The identifier of the resource. Not required when creating a user.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/ExternalUserMeta'
        name:
          $ref: '#/components/schemas/ExternalUserNameType'
        schemas:
          description: User JSON Schemas.
          example:
          - urn:ietf:params:scim:schemas:core:2.0:User
          items:
            type: string
          type: array
        title:
          description: The user's title.
          type: string
          example: Example Monitor
        userName:
          description: Unique identifier for the User.
          type: string
          example: Example Monitor
      type: object
    OktaAccountsResponse:
      description: The expected response schema when getting Okta accounts.
      properties:
        data:
          description: List of Okta accounts.
          items:
            $ref: '#/components/schemas/OktaAccountResponseData'
          type: array
      type: object
    CustomCostsFileMetadataHighLevel:
      description: JSON API format for a Custom Costs file.
      properties:
        attributes:
          $ref: '#/components/schemas/CustomCostsFileMetadata'
        id:
          description: ID of the Custom Costs metadata.
          type: string
          example: abc-123-def
        type:
          description: Type of the Custom Costs file metadata.
          type: string
          example: metric alert
      type: object
    AWSLambdaForwarderConfig:
      description: 'Log Autosubscription configuration for Datadog Forwarder Lambda functions. Automatically set up triggers for existing

        and new logs for some services, ensuring no logs from new resources are missed and saving time spent on manual configuration.'
      properties:
        lambdas:
          description: List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to `[]`.
          items:
            example: arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder
            type: string
          type: array
        sources:
          description: 'List of service IDs set to enable automatic log collection. Discover the list of available services with the

            [Get list of AWS log ready services](https://docs.datadoghq.com/api/latest/aws-logs-integration/#get-list-of-aws-log-ready-services) endpoint.'
          items:
            example: s3
            type: string
          type: array
      type: object
    MetricCustomSpaceAggregation:
      description: A space aggregation for use in query.
      enum:
      - avg
      - max
      - min
      - sum
      example: sum
      type: string
      x-enum-varnames:
      - AVG
      - MAX
      - MIN
      - SUM
    ObservabilityPipelineSplunkTcpSource:
      description: 'The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.

        TLS is supported for secure transmission.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-tcp-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineParseJSONProcessor:
      description: The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string.
      properties:
        field:
          description: The name of the log field that contains a JSON string.
          example: message
          type: string
        id:
          description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: parse-json-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessorType'
      required:
      - id
      - type
      - include
      - field
      - inputs
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType:
      description: Indicates that a predefined library pattern is used.
      enum:
      - library
      example: library
      type: string
      x-enum-varnames:
      - LIBRARY
    AppsSortField:
      description: The field and direction to sort apps by
      enum:
      - name
      - created_at
      - updated_at
      - user_name
      - -name
      - -created_at
      - -updated_at
      - -user_name
      example: -created_at
      type: string
      x-enum-varnames:
      - NAME
      - CREATED_AT
      - UPDATED_AT
      - USER_NAME
      - NAME_DESC
      - CREATED_AT_DESC
      - UPDATED_AT_DESC
      - USER_NAME_DESC
    SensitiveDataScannerGroupItem:
      description: Data related to a Sensitive Data Scanner Group.
      properties:
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    SensitiveDataScannerStandardPatternsResponseData:
      description: List Standard patterns response data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternsResponse'
      type: object
    VulnerabilitiesType:
      description: The JSON:API type.
      enum:
      - vulnerabilities
      example: vulnerabilities
      type: string
      x-enum-varnames:
      - VULNERABILITIES
    MetricIngestedIndexedVolumeType:
      default: metric_volumes
      description: The metric ingested and indexed volume type.
      enum:
      - metric_volumes
      example: metric_volumes
      type: string
      x-enum-varnames:
      - METRIC_VOLUMES
    EntityV3MetadataContactsItems:
      additionalProperties: false
      description: The definition of Entity V3 Metadata Contacts Items object.
      properties:
        contact:
          description: Contact value.
          example: https://slack/
          type: string
        name:
          description: Contact name.
          minLength: 2
          type: string
          example: Example Monitor
        type:
          description: Contact type.
          example: slack
          type: string
      required:
      - type
      - contact
      type: object
    EntityResponseIncludedRelatedEntityAttributes:
      description: Related entity attributes.
      properties:
        kind:
          description: Entity kind.
          type: string
          example: example_value
        name:
          description: Entity name.
          type: string
          example: Example Monitor
        namespace:
          description: Entity namespace.
          type: string
          example: Example Monitor
        type:
          description: Entity relation type to the associated entity.
          type: string
          example: metric alert
      type: object
    SensitiveDataScannerStandardPatternAttributes:
      description: Attributes of the Sensitive Data Scanner standard pattern.
      properties:
        description:
          description: Description of the standard pattern.
          type: string
          example: example_value
        included_keywords:
          description: List of included keywords.
          items:
            type: string
          type: array
        name:
          description: Name of the standard pattern.
          type: string
          example: Example Monitor
        pattern:
          deprecated: true
          description: (Deprecated) Regex to match, optionally documented for older standard rules. Refer to the `description` field to understand what the rule does.
          type: string
          example: example_value
        priority:
          description: Integer from 1 (high) to 5 (low) indicating standard pattern issue severity.
          format: int64
          maximum: 5
          minimum: 1
          type: integer
          example: 42
        tags:
          description: List of tags.
          items:
            type: string
          type: array
      type: object
    RelationshipToOrganization:
      description: Relationship to an organization.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToOrganizationData'
      required:
      - data
      type: object
    ObservabilityPipelineElasticsearchDestination:
      description: The `elasticsearch` destination writes logs to an Elasticsearch cluster.
      properties:
        api_version:
          $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationApiVersion'
        bulk_index:
          description: The index to write logs to in Elasticsearch.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: elasticsearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    IncidentTeamResponseAttributes:
      description: The incident team's attributes from a response.
      properties:
        created:
          description: Timestamp of when the incident team was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified:
          description: Timestamp of when the incident team was modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the incident team.
          example: team name
          type: string
      type: object
    ObservabilityPipelineHttpClientSource:
      description: The `http_client` source scrapes logs from HTTP endpoints at regular intervals.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: http-client-source
          type: string
        scrape_interval_secs:
          description: The interval (in seconds) between HTTP scrape requests.
          example: 60
          format: int64
          type: integer
        scrape_timeout_secs:
          description: The timeout (in seconds) for each scrape request.
          example: 10
          format: int64
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceType'
      required:
      - id
      - type
      - decoding
      type: object
    ApplicationKeyResponseIncludedItem:
      description: An object related to an application key.
      oneOf:
      - $ref: '#/components/schemas/User'
      - $ref: '#/components/schemas/Role'
      - $ref: '#/components/schemas/LeakedKey'
    IncidentTypeObject:
      description: Incident type response data.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTypeAttributes'
        id:
          description: The incident type's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentTypeType'
      required:
      - id
      - type
      type: object
    IncidentAttachmentLinkAttachmentType:
      default: link
      description: The type of link attachment attributes.
      enum:
      - link
      example: link
      type: string
      x-enum-varnames:
      - LINK
    SensitiveDataScannerGroupList:
      description: List of groups, ordered.
      properties:
        data:
          description: List of groups. The order is important.
          items:
            $ref: '#/components/schemas/SensitiveDataScannerGroupItem'
          type: array
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType:
      description: Indicates a custom regular expression is used for matching.
      enum:
      - custom
      example: custom
      type: string
      x-enum-varnames:
      - CUSTOM
    IncidentTodoRelationships:
      description: The incident's relationships from a response.
      properties:
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    AuditLogsEventAttributes:
      description: JSON object containing all event attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from Audit Logs events.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        message:
          description: Message of the event.
          type: string
          example: CPU usage is high on {{host.name}}
        service:
          description: 'Name of the application or service generating Audit Logs events.

            This name is used to correlate Audit Logs to APM, so make sure you specify the same

            value when you use both products.'
          example: web-app
          type: string
        tags:
          description: Array of tags associated with your event.
          example:
          - team:A
          items:
            description: Tag associated with your event.
            type: string
          type: array
        timestamp:
          description: Timestamp of your event.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    ObservabilityPipelineReduceProcessorMergeStrategy:
      description: Defines how a specific field should be merged across grouped events.
      properties:
        path:
          description: The field path in the log event.
          example: log.user.roles
          type: string
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategyStrategy'
      required:
      - path
      - strategy
      type: object
    EventPriority:
      description: The priority of the event's monitor. For example, `normal` or `low`.
      enum:
      - normal
      - low
      example: normal
      nullable: true
      type: string
      x-enum-varnames:
      - NORMAL
      - LOW
    ObservabilityPipelineGcpAuth:
      description: 'GCP credentials used to authenticate with Google Cloud Storage.

        '
      properties:
        credentials_file:
          description: Path to the GCP service account key file.
          example: /var/secrets/gcp-credentials.json
          type: string
      required:
      - credentials_file
      type: object
    GCPSTSDelegateAccount:
      description: Datadog principal service account info.
      properties:
        attributes:
          $ref: '#/components/schemas/GCPSTSDelegateAccountAttributes'
        id:
          description: The ID of the delegate service account.
          example: ddgci-1a19n28hb1a812221893@datadog-gci-sts-us5-prod.iam.gserviceaccount.com
          type: string
        type:
          $ref: '#/components/schemas/GCPSTSDelegateAccountType'
      type: object
    OutcomesResponseData:
      description: List of rule outcomes.
      items:
        $ref: '#/components/schemas/OutcomesResponseDataItem'
      type: array
    EntityResponseIncludedRawSchemaType:
      description: Raw schema type.
      enum:
      - rawSchema
      type: string
      x-enum-varnames:
      - RAW_SCHEMA
    HistoricalJobListMeta:
      description: Metadata about the list of jobs.
      properties:
        totalCount:
          description: Number of jobs in the list.
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
      type: object
    AwsCURConfigsResponse:
      description: List of AWS CUR configs.
      properties:
        data:
          description: An AWS CUR config.
          items:
            $ref: '#/components/schemas/AwsCURConfig'
          type: array
      type: object
    ObservabilityPipelineRenameFieldsProcessor:
      description: The `rename_fields` processor changes field names.
      properties:
        fields:
          description: A list of rename rules specifying which fields to rename in the event, what to rename them to, and whether to preserve the original fields.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorField'
          type: array
        id:
          description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rename-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    IncidentTeamIncludedItems:
      description: An object related to an incident team which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    ObservabilityPipelineAmazonDataFirehoseSourceType:
      default: amazon_data_firehose
      description: The source type. The value should always be `amazon_data_firehose`.
      enum:
      - amazon_data_firehose
      example: amazon_data_firehose
      type: string
      x-enum-varnames:
      - AMAZON_DATA_FIREHOSE
    ListAppsResponseDataItemsAttributes:
      description: Basic information about the app such as name, description, and tags.
      properties:
        description:
          description: A human-readable description for the app.
          type: string
          example: example_value
        favorite:
          description: Whether the app is marked as a favorite by the current user.
          type: boolean
          example: true
        name:
          description: The name of the app.
          type: string
          example: Example Monitor
        selfService:
          description: Whether the app is enabled for use in the Datadog self-service hub.
          type: boolean
          example: true
        tags:
          description: A list of tags for the app, which can be used to filter apps.
          example:
          - service:webshop-backend
          - team:webshop
          items:
            description: An individual tag for the app.
            type: string
          type: array
      type: object
    ApplicationSecurityWafCustomRuleData:
      description: Object for a single WAF custom rule.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAttributes'
        id:
          description: The ID of the custom rule.
          example: 2857c47d-1e3a-4300-8b2f-dc24089c084b
          readOnly: true
          type: string
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType'
      type: object
    TriggerSource:
      description: 'The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",

        while notification rules based on security vulnerabilities need to use the trigger source "security_findings".'
      enum:
      - security_findings
      - security_signals
      example: security_findings
      type: string
      x-enum-varnames:
      - SECURITY_FINDINGS
      - SECURITY_SIGNALS
    DORAListDeploymentsRequestData:
      description: The JSON:API data.
      properties:
        attributes:
          $ref: '#/components/schemas/DORAListDeploymentsRequestAttributes'
        type:
          $ref: '#/components/schemas/DORAListDeploymentsRequestDataType'
      required:
      - attributes
      type: object
    HistoricalJobResponseAttributes:
      description: Historical job attributes.
      properties:
        createdAt:
          description: Time when the job was created.
          type: string
          example: example_value
        createdByHandle:
          description: The handle of the user who created the job.
          type: string
          example: example_value
        createdByName:
          description: The name of the user who created the job.
          type: string
          example: Example Monitor
        createdFromRuleId:
          description: ID of the rule used to create the job (if it is created from a rule).
          type: string
          example: abc-123-def
        jobDefinition:
          $ref: '#/components/schemas/JobDefinition'
        jobName:
          description: Job name.
          type: string
          example: Example Monitor
        jobStatus:
          description: Job status.
          type: string
          example: OK
        modifiedAt:
          description: Last modification time of the job.
          type: string
          example: example_value
      type: object
    SecurityMonitoringRuleOptions:
      description: Options.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
        decreaseCriticalityBasedOnEnv:
          $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv'
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        hardcodedEvaluatorType:
          $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    TeamType:
      default: team
      description: Team type
      enum:
      - team
      example: team
      type: string
      x-enum-varnames:
      - TEAM
    SensitiveDataScannerGetConfigResponseData:
      description: Response data related to the scanning groups.
      properties:
        attributes:
          additionalProperties: {}
          description: Attributes of the Sensitive Data configuration.
          type: object
        id:
          description: ID of the configuration.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerConfigurationRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerConfigurationType'
      type: object
    SAMLAssertionAttributeAttributes:
      description: Key/Value pair of attributes used in SAML assertion attributes.
      properties:
        attribute_key:
          description: Key portion of a key/value pair of the attribute sent from the Identity Provider.
          example: member-of
          type: string
        attribute_value:
          description: Value portion of a key/value pair of the attribute sent from the Identity Provider.
          example: Development
          type: string
      type: object
    ObservabilityPipelineThrottleProcessorType:
      default: throttle
      description: The processor type. The value should always be `throttle`.
      enum:
      - throttle
      example: throttle
      type: string
      x-enum-varnames:
      - THROTTLE
    EntityResponseData:
      description: List of entity data.
      items:
        $ref: '#/components/schemas/EntityData'
      type: array
    DashboardListItemResponse:
      description: A dashboard within a list.
      properties:
        id:
          description: ID of the dashboard.
          example: q5j-nti-fv6
          readOnly: true
          type: string
        type:
          $ref: '#/components/schemas/DashboardType'
      required:
      - type
      - id
      type: object
    EntityV3QueueDatadog:
      additionalProperties: false
      description: Datadog product integrations for the datastore entity.
      properties:
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
      type: object
      x-ignore-duplicate-object: true
    VulnerabilityRelationshipsAffects:
      description: Relationship type.
      properties:
        data:
          $ref: '#/components/schemas/VulnerabilityRelationshipsAffectsData'
      required:
      - data
      type: object
    IncidentAttachmentLinkAttributesAttachmentObject:
      description: The link attachment.
      properties:
        documentUrl:
          description: The URL of this link attachment.
          example: https://www.example.com/webstore-failure-runbook
          type: string
        title:
          description: The title of this link attachment.
          example: Runbook for webstore service failures
          type: string
      required:
      - documentUrl
      - title
      type: object
    ObservabilityPipelineSentinelOneDestination:
      description: The `sentinel_one` destination sends logs to SentinelOne.
      properties:
        id:
          description: The unique identifier for this component.
          example: sentinelone-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        region:
          $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationRegion'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationType'
      required:
      - id
      - type
      - inputs
      - region
      type: object
    OrgConfigRead:
      description: A single Org Config.
      properties:
        attributes:
          $ref: '#/components/schemas/OrgConfigReadAttributes'
        id:
          description: A unique identifier for an Org Config.
          example: abcd1234
          type: string
        type:
          $ref: '#/components/schemas/OrgConfigType'
      required:
      - id
      - type
      - attributes
      type: object
    SecurityMonitoringRuleKeepAlive:
      description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within

        this keep alive window. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    MetricType:
      default: metrics
      description: The metric resource type.
      enum:
      - metrics
      example: metrics
      type: string
      x-enum-varnames:
      - METRICS
    AssetAttributes:
      description: The JSON:API attributes of the asset.
      properties:
        arch:
          description: Asset architecture.
          example: arm64
          type: string
        environments:
          description: List of environments where the asset is deployed.
          example:
          - staging
          items:
            example: staging
            type: string
          type: array
        name:
          description: Asset name.
          example: github.com/DataDog/datadog-agent.git
          type: string
        operating_system:
          $ref: '#/components/schemas/AssetOperatingSystem'
        risks:
          $ref: '#/components/schemas/AssetRisks'
        type:
          $ref: '#/components/schemas/AssetType'
        version:
          $ref: '#/components/schemas/AssetVersion'
      required:
      - name
      - type
      - risks
      - environments
      type: object
    SecurityMonitoringSignalsListResponseMetaPage:
      description: Paging attributes.
      properties:
        after:
          description: 'The cursor used to get the next results, if any. To make the next request, use the same

            parameters with the addition of the `page[cursor]`.'
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    EntityResponseIncludedRawSchema:
      description: Included raw schema.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityResponseIncludedRawSchemaAttributes'
        id:
          description: Raw schema ID.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/EntityResponseIncludedRawSchemaType'
      type: object
    ObservabilityPipelineDedupeProcessorType:
      default: dedupe
      description: The processor type. The value should always be `dedupe`.
      enum:
      - dedupe
      example: dedupe
      type: string
      x-enum-varnames:
      - DEDUPE
    ObservabilityPipelineSampleProcessorType:
      default: sample
      description: The processor type. The value should always be `sample`.
      enum:
      - sample
      example: sample
      type: string
      x-enum-varnames:
      - SAMPLE
    ObservabilityPipelineEnrichmentTableProcessorType:
      default: enrichment_table
      description: The processor type. The value should always be `enrichment_table`.
      enum:
      - enrichment_table
      example: enrichment_table
      type: string
      x-enum-varnames:
      - ENRICHMENT_TABLE
    HistoricalJobDataType:
      description: Type of payload.
      enum:
      - historicalDetectionsJob
      type: string
      x-enum-varnames:
      - HISTORICALDETECTIONSJOB
    ObservabilityPipelineSentinelOneDestinationRegion:
      description: The SentinelOne region to send logs to.
      enum:
      - us
      - eu
      - ca
      - data_set_us
      example: us
      type: string
      x-enum-varnames:
      - US
      - EU
      - CA
      - DATA_SET_US
    SecurityMonitoringRuleSeverity:
      description: Severity of the Security Signal.
      enum:
      - info
      - low
      - medium
      - high
      - critical
      example: critical
      type: string
      x-enum-varnames:
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    RelationshipArray:
      description: Relationships.
      items:
        $ref: '#/components/schemas/RelationshipItem'
      type: array
    ApplicationKeyRelationships:
      description: Resources related to the application key.
      properties:
        owned_by:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
      x-merge-override:
        properties: false
    LeakedKey:
      description: The definition of LeakedKey object.
      properties:
        attributes:
          $ref: '#/components/schemas/LeakedKeyAttributes'
        id:
          description: The LeakedKey id.
          example: id
          type: string
        type:
          $ref: '#/components/schemas/LeakedKeyType'
      required:
      - attributes
      - id
      - type
      type: object
    ObservabilityPipelineSyslogSourceMode:
      description: Protocol used by the syslog source to receive messages.
      enum:
      - tcp
      - udp
      example: tcp
      type: string
      x-enum-varnames:
      - TCP
      - UDP
    FindingResourceDiscoveryDate:
      description: The date on which the resource was discovered (Unix ms).
      example: 1678721573794
      format: int64
      minimum: 1
      type: integer
    VulnerabilityType:
      description: The vulnerability type.
      enum:
      - AdminConsoleActive
      - CodeInjection
      - CommandInjection
      - ComponentWithKnownVulnerability
      - DangerousWorkflows
      - DefaultAppDeployed
      - DefaultHtmlEscapeInvalid
      - DirectoryListingLeak
      - EmailHtmlInjection
      - EndOfLife
      - HardcodedPassword
      - HardcodedSecret
      - HeaderInjection
      - HstsHeaderMissing
      - InsecureAuthProtocol
      - InsecureCookie
      - InsecureJspLayout
      - LdapInjection
      - MaliciousPackage
      - MandatoryRemediation
      - NoHttpOnlyCookie
      - NoSameSiteCookie
      - NoSqlMongoDbInjection
      - PathTraversal
      - ReflectionInjection
      - RiskyLicense
      - SessionRewriting
      - SessionTimeout
      - SqlInjection
      - Ssrf
      - StackTraceLeak
      - TrustBoundaryViolation
      - Unmaintained
      - UntrustedDeserialization
      - UnvalidatedRedirect
      - VerbTampering
      - WeakCipher
      - WeakHash
      - WeakRandomness
      - XContentTypeHeaderMissing
      - XPathInjection
      - Xss
      example: WeakCipher
      type: string
      x-enum-varnames:
      - ADMIN_CONSOLE_ACTIVE
      - CODE_INJECTION
      - COMMAND_INJECTION
      - COMPONENT_WITH_KNOWN_VULNERABILITY
      - DANGEROUS_WORKFLOWS
      - DEFAULT_APP_DEPLOYED
      - DEFAULT_HTML_ESCAPE_INVALID
      - DIRECTORY_LISTING_LEAK
      - EMAIL_HTML_INJECTION
      - END_OF_LIFE
      - HARDCODED_PASSWORD
      - HARDCODED_SECRET
      - HEADER_INJECTION
      - HSTS_HEADER_MISSING
      - INSECURE_AUTH_PROTOCOL
      - INSECURE_COOKIE
      - INSECURE_JSP_LAYOUT
      - LDAP_INJECTION
      - MALICIOUS_PACKAGE
      - MANDATORY_REMEDIATION
      - NO_HTTP_ONLY_COOKIE
      - NO_SAME_SITE_COOKIE
      - NO_SQL_MONGO_DB_INJECTION
      - PATH_TRAVERSAL
      - REFLECTION_INJECTION
      - RISKY_LICENSE
      - SESSION_REWRITING
      - SESSION_TIMEOUT
      - SQL_INJECTION
      - SSRF
      - STACK_TRACE_LEAK
      - TRUST_BOUNDARY_VIOLATION
      - UNMAINTAINED
      - UNTRUSTED_DESERIALIZATION
      - UNVALIDATED_REDIRECT
      - VERB_TAMPERING
      - WEAK_CIPHER
      - WEAK_HASH
      - WEAK_RANDOMNESS
      - X_CONTENT_TYPE_HEADER_MISSING
      - X_PATH_INJECTION
      - XSS
    ObservabilityPipelineAddEnvVarsProcessorType:
      default: add_env_vars
      description: The processor type. The value should always be `add_env_vars`.
      enum:
      - add_env_vars
      example: add_env_vars
      type: string
      x-enum-varnames:
      - ADD_ENV_VARS
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions:
      description: Controls how partial redaction is applied, including character count and direction.
      properties:
        characters:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions` `characters`.
          example: 4
          format: int64
          type: integer
        direction:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection'
      required:
      - characters
      - direction
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByField:
      description: Strategy that increments a generated metric based on the value of a log field.
      properties:
        field:
          description: Name of the log field containing the numeric value to increment the metric by.
          example: errors
          type: string
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy'
      required:
      - strategy
      - field
      type: object
    ObservabilityPipelineSplunkHecDestinationType:
      default: splunk_hec
      description: The destination type. Always `splunk_hec`.
      enum:
      - splunk_hec
      example: splunk_hec
      type: string
      x-enum-varnames:
      - SPLUNK_HEC
    SensitiveDataScannerGroupData:
      description: A scanning group data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerGroup'
      type: object
    ApplicationSecurityWafExclusionFilterResource:
      description: A JSON:API resource for an WAF exclusion filter.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterAttributes'
        id:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterID'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType'
      type: object
    VulnerabilityStatus:
      description: The vulnerability status.
      enum:
      - Open
      - Muted
      - Remediated
      - InProgress
      - AutoClosed
      example: Open
      type: string
      x-enum-varnames:
      - OPEN
      - MUTED
      - REMEDIATED
      - INPROGRESS
      - AUTOCLOSED
    GCPSTSServiceAccountsResponse:
      description: Object containing all your STS enabled accounts.
      properties:
        data:
          description: Array of GCP STS enabled service accounts.
          items:
            $ref: '#/components/schemas/GCPSTSServiceAccount'
          type: array
      type: object
    DashboardType:
      description: The type of the dashboard.
      enum:
      - custom_timeboard
      - custom_screenboard
      - integration_screenboard
      - integration_timeboard
      - host_timeboard
      example: host_timeboard
      type: string
      x-enum-varnames:
      - CUSTOM_TIMEBOARD
      - CUSTOM_SCREENBOARD
      - INTEGRATION_SCREENBOARD
      - INTEGRATION_TIMEBOARD
      - HOST_TIMEBOARD
    MetricsAndMetricTagConfigurations:
      description: Object for a metrics and metric tag configurations.
      oneOf:
      - $ref: '#/components/schemas/Metric'
      - $ref: '#/components/schemas/MetricTagConfiguration'
    AzureUCConfigPairAttributes:
      description: Attributes for Azure config pair.
      properties:
        configs:
          description: An Azure config.
          items:
            $ref: '#/components/schemas/AzureUCConfig'
          type: array
        id:
          description: The ID of the Azure config pair.
          format: int64
          type: integer
          example: 42
      required:
      - configs
      type: object
      x-merge-override:
        properties: false
    ObservabilityPipelineGeneratedMetricIncrementByOneStrategy:
      description: Increments the metric by 1 for each matching event.
      enum:
      - increment_by_one
      example: increment_by_one
      type: string
      x-enum-varnames:
      - INCREMENT_BY_ONE
    ObservabilityPipelineSyslogNgSource:
      description: The `syslog_ng` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: syslog-ng-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSourceType'
      required:
      - id
      - type
      - mode
      type: object
    SensitiveDataScannerGroupAttributes:
      description: Attributes of the Sensitive Data Scanner group.
      properties:
        description:
          description: Description of the group.
          type: string
          example: example_value
        filter:
          $ref: '#/components/schemas/SensitiveDataScannerFilter'
        is_enabled:
          description: Whether or not the group is enabled.
          type: boolean
          example: true
        name:
          description: Name of the group.
          type: string
          example: Example Monitor
        product_list:
          description: List of products the scanning group applies.
          items:
            $ref: '#/components/schemas/SensitiveDataScannerProduct'
          type: array
      type: object
    WorkflowListInstancesResponseMeta:
      additionalProperties: {}
      description: Metadata about the instances list
      properties:
        page:
          $ref: '#/components/schemas/WorkflowListInstancesResponseMetaPage'
      type: object
    IncidentFieldAttributesMultipleValue:
      description: A field with potentially multiple values selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesValueType'
        value:
          description: The multiple values selected for this field.
          example:
          - '1.0'
          - '1.1'
          items:
            description: A value which has been selected for the parent field.
            example: '1.1'
            type: string
          nullable: true
          type: array
      type: object
    SensitiveDataScannerRuleRelationships:
      description: Relationships of a scanning rule.
      properties:
        group:
          $ref: '#/components/schemas/SensitiveDataScannerGroupData'
        standard_pattern:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternData'
      type: object
    SecurityMonitoringSignalsListResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'The link for the next set of results. **Note**: The request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/security_monitoring/signals?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    RelationToEntity:
      description: Relation to entity.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipItem'
        meta:
          $ref: '#/components/schemas/EntityMeta'
      type: object
    ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy:
      description: The authentication strategy to use.
      enum:
      - basic
      - aws
      example: aws
      type: string
      x-enum-varnames:
      - BASIC
      - AWS
    RUMEventType:
      default: rum
      description: Type of the event.
      enum:
      - rum
      example: rum
      type: string
      x-enum-varnames:
      - RUM
    MicrosoftSentinelDestination:
      description: The `microsoft_sentinel` destination forwards logs to Microsoft Sentinel.
      properties:
        client_id:
          description: Azure AD client ID used for authentication.
          example: a1b2c3d4-5678-90ab-cdef-1234567890ab
          type: string
        dcr_immutable_id:
          description: The immutable ID of the Data Collection Rule (DCR).
          example: dcr-uuid-1234
          type: string
        id:
          description: The unique identifier for this component.
          example: sentinel-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        table:
          description: The name of the Log Analytics table where logs are sent.
          example: CustomLogsTable
          type: string
        tenant_id:
          description: Azure AD tenant ID.
          example: abcdef12-3456-7890-abcd-ef1234567890
          type: string
        type:
          $ref: '#/components/schemas/MicrosoftSentinelDestinationType'
      required:
      - id
      - type
      - inputs
      - client_id
      - tenant_id
      - dcr_immutable_id
      - table
      type: object
    CloudConfigurationRegoRule:
      description: Rule details.
      properties:
        policy:
          description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/'
          example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n"
          type: string
        resourceTypes:
          description: List of resource types that will be evaluated upon. Must have at least one element.
          example:
          - gcp_iam_service_account
          - gcp_iam_policy
          items:
            type: string
          type: array
      required:
      - policy
      - resourceTypes
      type: object
    MetricMetaPageType:
      default: cursor_limit
      description: Type of metric pagination.
      enum:
      - cursor_limit
      example: cursor_limit
      type: string
      x-enum-varnames:
      - CURSOR_LIMIT
    ListAppsResponseMeta:
      description: Pagination metadata.
      properties:
        page:
          $ref: '#/components/schemas/ListAppsResponseMetaPage'
      type: object
    SensitiveDataScannerGetConfigResponse:
      description: Get all groups response.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerGetConfigResponseData'
        included:
          $ref: '#/components/schemas/SensitiveDataScannerGetConfigIncludedArray'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMeta'
      type: object
    GetResourceEvaluationFiltersResponseData:
      description: The definition of `GetResourceFilterResponseData` object.
      properties:
        attributes:
          $ref: '#/components/schemas/ResourceFilterAttributes'
        id:
          description: The `data` `id`.
          example: csm_resource_filter
          type: string
        type:
          $ref: '#/components/schemas/ResourceFilterRequestType'
      type: object
    RoleResponseRelationships:
      description: Relationships of the role object returned by the API.
      properties:
        permissions:
          $ref: '#/components/schemas/RelationshipToPermissions'
      type: object
    ObservabilityPipelineGeneratedMetricMetricType:
      description: Type of metric to create.
      enum:
      - count
      - gauge
      - distribution
      example: count
      type: string
      x-enum-varnames:
      - COUNT
      - GAUGE
      - DISTRIBUTION
    EntityV3ServiceSpec:
      additionalProperties: false
      description: The definition of Entity V3 Service Spec object.
      properties:
        componentOf:
          description: A list of components the service is a part of
          items:
            type: string
          type: array
        dependsOn:
          description: A list of components the service depends on.
          items:
            type: string
          type: array
        languages:
          description: The service's programming language.
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the component.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the component.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of service.
          type: string
          example: metric alert
      type: object
    ObservabilityPipelineAddEnvVarsProcessorVariable:
      description: Defines a mapping between an environment variable and a log field.
      properties:
        field:
          description: The target field in the log event.
          example: log.environment.region
          type: string
        name:
          description: The name of the environment variable to read.
          example: AWS_REGION
          type: string
      required:
      - field
      - name
      type: object
    SpansAggregateResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    FindingType:
      default: finding
      description: The JSON:API type for findings.
      enum:
      - finding
      example: finding
      type: string
      x-enum-varnames:
      - FINDING
    ObservabilityPipelineSensitiveDataScannerProcessorScope:
      description: Determines which parts of the log the pattern-matching rule should be applied to.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAll'
    ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude:
      description: Excludes specific fields from sensitive data scanning.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions'
        target:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget'
      required:
      - target
      - options
      type: object
    OutcomesResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: Link for the next set of results.
          example: /api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=100
          type: string
      type: object
    IncidentRespondersType:
      description: The incident responders type.
      enum:
      - incident_responders
      example: incident_responders
      type: string
      x-enum-varnames:
      - INCIDENT_RESPONDERS
    EntityV3Queue:
      additionalProperties: false
      description: Schema for queue entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3QueueDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3QueueKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3QueueSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    CIAppResponseMetadataWithPagination:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: The time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/CIAppResponsePage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          $ref: '#/components/schemas/CIAppResponseStatus'
        warnings:
          description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if

            warnings are present in the response.'
          items:
            $ref: '#/components/schemas/CIAppWarning'
          type: array
      type: object
    RelationshipToRule:
      description: Scorecard create rule response relationship.
      properties:
        scorecard:
          $ref: '#/components/schemas/RelationshipToRuleData'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    ApmRetentionFilterType:
      default: apm_retention_filter
      description: The type of the resource.
      enum:
      - apm_retention_filter
      example: apm_retention_filter
      type: string
      x-enum-varnames:
      - apm_retention_filter
    GetResourceEvaluationFiltersResponse:
      description: The definition of `GetResourceEvaluationFiltersResponse` object.
      properties:
        data:
          $ref: '#/components/schemas/GetResourceEvaluationFiltersResponseData'
      required:
      - data
      type: object
    RelationshipToIncidentAttachmentData:
      description: The attachment relationship data.
      properties:
        id:
          description: A unique identifier that represents the attachment.
          example: 00000000-0000-abcd-1000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    OktaAccountAttributes:
      description: Attributes object for an Okta account.
      properties:
        api_key:
          description: The API key of the Okta account.
          type: string
          writeOnly: true
          example: example_value
        auth_method:
          description: The authorization method for an Okta account.
          example: oauth
          type: string
        client_id:
          description: The Client ID of an Okta app integration.
          type: string
          example: abc-123-def
        client_secret:
          description: The client secret of an Okta app integration.
          type: string
          writeOnly: true
          example: example_value
        domain:
          description: The domain of the Okta account.
          example: https://example.okta.com/
          type: string
        name:
          description: The name of the Okta account.
          example: Okta-Prod
          type: string
      required:
      - auth_method
      - domain
      - name
      type: object
    AzureUCConfigPairType:
      default: azure_uc_configs
      description: Type of Azure config pair.
      enum:
      - azure_uc_configs
      example: azure_uc_configs
      type: string
      x-enum-varnames:
      - AZURE_UC_CONFIGS
    ObservabilityPipelineQuotaProcessorType:
      default: quota
      description: The processor type. The value should always be `quota`.
      enum:
      - quota
      example: quota
      type: string
      x-enum-varnames:
      - QUOTA
    ApplicationSecurityWafExclusionFilterType:
      default: exclusion_filter
      description: Type of the resource. The value should always be `exclusion_filter`.
      enum:
      - exclusion_filter
      example: exclusion_filter
      type: string
      x-enum-varnames:
      - EXCLUSION_FILTER
    ListDevicesResponseMetadataPage:
      description: Pagination object.
      properties:
        total_filtered_count:
          description: Total count of devices matched by the filter.
          example: 1
          format: int64
          type: integer
      type: object
    ApplicationSecurityWafCustomRuleAttributes:
      description: A WAF custom rule.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction'
        blocking:
          description: Indicates whether the WAF custom rule will block the request.
          example: false
          type: boolean
        conditions:
          description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF

            rule to trigger.'
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition'
          type: array
        enabled:
          description: Indicates whether the WAF custom rule is enabled.
          example: false
          type: boolean
        metadata:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleMetadata'
        name:
          description: The Name of the WAF custom rule.
          example: Block request from bad useragent
          type: string
        path_glob:
          description: The path glob for the WAF custom rule.
          example: /api/search/*
          type: string
        scope:
          description: The scope of the WAF custom rule.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope'
          type: array
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags'
      required:
      - enabled
      - blocking
      - name
      - tags
      - conditions
      type: object
    Role:
      description: Role object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/RoleAttributes'
        id:
          description: The unique identifier of the role.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RoleResponseRelationships'
        type:
          $ref: '#/components/schemas/RolesType'
      required:
      - type
      type: object
      x-merge-override:
        required: false
    IncidentTeamResponseData:
      description: Incident Team data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTeamResponseAttributes'
        id:
          description: The incident team's ID.
          example: 00000000-7ea3-0000-000a-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTeamRelationships'
        type:
          $ref: '#/components/schemas/IncidentTeamType'
      type: object
    CloudConfigurationComplianceRuleOptions:
      additionalProperties: {}
      description: 'Options for cloud_configuration rules.

        Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules.

        '
      properties:
        complexRule:
          description: 'Whether the rule is a complex one.

            Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false.

            '
          type: boolean
          example: true
        regoRule:
          $ref: '#/components/schemas/CloudConfigurationRegoRule'
        resourceType:
          description: 'Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`.

            '
          example: aws_acm
          type: string
      type: object
    SensitiveDataScannerConfigurationRelationships:
      description: Relationships of the configuration.
      properties:
        groups:
          $ref: '#/components/schemas/SensitiveDataScannerGroupList'
      type: object
    ObservabilityPipelineReduceProcessorType:
      default: reduce
      description: The processor type. The value should always be `reduce`.
      enum:
      - reduce
      example: reduce
      type: string
      x-enum-varnames:
      - REDUCE
    EntityResponseIncludedRelatedEntityMeta:
      description: Included related entity meta.
      properties:
        createdAt:
          description: Entity creation time.
          format: date-time
          type: string
          example: example_value
        defined_by:
          description: Entity relation defined by.
          type: string
          example: example_value
        modifiedAt:
          description: Entity modification time.
          format: date-time
          type: string
          example: example_value
        source:
          description: Entity relation source.
          type: string
          example: example_value
      type: object
    ObservabilityPipelineParseJSONProcessorType:
      default: parse_json
      description: The processor type. The value should always be `parse_json`.
      enum:
      - parse_json
      example: parse_json
      type: string
      x-enum-varnames:
      - PARSE_JSON
    AuthNMappingsType:
      default: authn_mappings
      description: AuthN Mappings resource type.
      enum:
      - authn_mappings
      example: authn_mappings
      type: string
      x-enum-varnames:
      - AUTHN_MAPPINGS
    SensitiveDataScannerGetConfigIncludedArray:
      description: Included objects from relationships.
      items:
        $ref: '#/components/schemas/SensitiveDataScannerGetConfigIncludedItem'
      type: array
    AWSLogsServicesResponseAttributes:
      description: AWS Logs Services response body
      properties:
        logs_services:
          description: List of AWS services that can send logs to Datadog
          example:
          - s3
          items:
            example: s3
            type: string
          type: array
      required:
      - logs_services
      type: object
    AuditLogsResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'Link for the next set of results. Note that the request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/audit/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    IncidentNonDatadogCreator:
      description: Incident's non Datadog creator.
      nullable: true
      properties:
        image_48_px:
          description: Non Datadog creator `48px` image.
          type: string
          example: example_value
        name:
          description: Non Datadog creator name.
          type: string
          example: Example Monitor
      type: object
    ObservabilityPipelineTls:
      description: Configuration for enabling TLS encryption between the pipeline component and external services.
      properties:
        ca_file:
          description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
          type: string
          example: example_value
        crt_file:
          description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
          example: /path/to/cert.crt
          type: string
        key_file:
          description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
          type: string
          example: example_value
      required:
      - crt_file
      type: object
    MetricName:
      description: The metric name for this resource.
      example: test.metric.latency
      type: string
    RuleUser:
      description: User creating or modifying a rule.
      properties:
        handle:
          description: The user handle.
          example: john.doe@domain.com
          type: string
        name:
          description: The user name.
          example: John Doe
          type: string
      type: object
    SAMLAssertionAttributesType:
      default: saml_assertion_attributes
      description: SAML assertion attributes resource type.
      enum:
      - saml_assertion_attributes
      example: saml_assertion_attributes
      type: string
      x-enum-varnames:
      - SAML_ASSERTION_ATTRIBUTES
    OutcomesResponseDataItem:
      description: A single rule outcome.
      properties:
        attributes:
          $ref: '#/components/schemas/OutcomesBatchResponseAttributes'
        id:
          description: The unique ID for a rule outcome.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RuleOutcomeRelationships'
        type:
          $ref: '#/components/schemas/OutcomeType'
      type: object
    EntityRelationships:
      description: Entity relationships.
      properties:
        incidents:
          $ref: '#/components/schemas/EntityToIncidents'
        oncall:
          $ref: '#/components/schemas/EntityToOncalls'
        rawSchema:
          $ref: '#/components/schemas/EntityToRawSchema'
        relatedEntities:
          $ref: '#/components/schemas/EntityToRelatedEntities'
        schema:
          $ref: '#/components/schemas/EntityToSchema'
      type: object
    DORAListFailuresRequestDataType:
      description: The definition of `DORAListFailuresRequestDataType` object.
      enum:
      - dora_failures_list_request
      type: string
      x-enum-varnames:
      - DORA_FAILURES_LIST_REQUEST
    FindingResource:
      description: The resource name of this finding.
      example: my_resource_name
      type: string
    IncidentServiceIncludedItems:
      description: An object related to an incident service which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    EntityV3DatadogEvents:
      additionalProperties: false
      description: Events associations.
      items:
        $ref: '#/components/schemas/EntityV3DatadogEventItem'
      type: array
    ObservabilityPipelineEnrichmentTableFileSchemaItemsType:
      description: Declares allowed data types for enrichment table columns.
      enum:
      - string
      - boolean
      - integer
      - float
      - date
      - timestamp
      example: string
      type: string
      x-enum-varnames:
      - STRING
      - BOOLEAN
      - INTEGER
      - FLOAT
      - DATE
      - TIMESTAMP
    ObservabilityPipelineDatadogLogsDestination:
      description: The `datadog_logs` destination forwards logs to Datadog Log Management.
      properties:
        id:
          description: The unique identifier for this component.
          example: datadog-logs-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions:
      description: Options for defining a custom regex pattern.
      properties:
        rule:
          description: A regular expression used to detect sensitive values. Must be a valid regex.
          example: \b\d{16}\b
          type: string
      required:
      - rule
      type: object
    CloudflareAccountType:
      default: cloudflare-accounts
      description: The JSON:API type for this API. Should always be `cloudflare-accounts`.
      enum:
      - cloudflare-accounts
      example: cloudflare-accounts
      type: string
      x-enum-varnames:
      - CLOUDFLARE_ACCOUNTS
    ObservabilityPipelineRenameFieldsProcessorField:
      description: Defines how to rename a field in log events.
      properties:
        destination:
          description: The field name to assign the renamed value to.
          example: destination_field
          type: string
        preserve_source:
          description: Indicates whether the original field, that is received from the source, should be kept (`true`) or removed (`false`) after renaming.
          example: false
          type: boolean
        source:
          description: The original field name in the log event that should be renamed.
          example: source_field
          type: string
      required:
      - source
      - destination
      - preserve_source
      type: object
    RelationshipToRoles:
      description: Relationship to roles.
      properties:
        data:
          description: An array containing type and the unique identifier of a role.
          items:
            $ref: '#/components/schemas/RelationshipToRoleData'
          type: array
      type: object
      x-merge-override:
        required: false
    MetricTagConfiguration:
      description: Object for a single metric tag configuration.
      example:
        attributes:
          aggregations:
          - space: avg
            time: avg
          created_at: '2020-03-25T09:48:37.463835Z'
          metric_type: gauge
          modified_at: '2020-04-25T09:48:37.463835Z'
          tags:
          - app
          - datacenter
        id: http.request.latency
        type: manage_tags
      properties:
        attributes:
          $ref: '#/components/schemas/MetricTagConfigurationAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricTagConfigurationType'
      type: object
    ObservabilityPipelineAwsAuth:
      description: 'AWS authentication credentials used for accessing AWS services such as S3.

        If omitted, the system’s default credentials are used (for example, the IAM role and environment variables).

        '
      properties:
        assume_role:
          description: The Amazon Resource Name (ARN) of the role to assume.
          type: string
          example: example_value
        external_id:
          description: A unique identifier for cross-account role assumption.
          type: string
          example: abc-123-def
        session_name:
          description: A session identifier used for logging and tracing the assumed role session.
          type: string
          example: Example Monitor
      type: object
    ObservabilityPipelineConfigProcessorItem:
      description: A processor for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineFilterProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineSampleProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
    EntityV3SystemKind:
      description: The definition of Entity V3 System Kind object.
      enum:
      - system
      example: system
      type: string
      x-enum-varnames:
      - SYSTEM
    SecurityMonitoringRuleNewValueOptionsLearningMethod:
      default: duration
      description: The learning method used to determine when signals should be generated for values that weren't learned.
      enum:
      - duration
      - threshold
      type: string
      x-enum-varnames:
      - DURATION
      - THRESHOLD
    Pagination:
      description: Pagination object.
      properties:
        total_count:
          description: Total count.
          format: int64
          type: integer
          example: 42
        total_filtered_count:
          description: Total count of elements matched by the filter.
          format: int64
          type: integer
          example: 42
      type: object
    SensitiveDataScannerGroupRelationships:
      description: Relationships of the group.
      properties:
        configuration:
          $ref: '#/components/schemas/SensitiveDataScannerConfigurationData'
        rules:
          $ref: '#/components/schemas/SensitiveDataScannerRuleData'
      type: object
    SecurityMonitoringRuleCaseAction:
      description: Action to perform when a signal is triggered. Only available for Application Security rule type.
      properties:
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
      type: object
    ObservabilityPipelineAddEnvVarsProcessor:
      description: The `add_env_vars` processor adds environment variable values to log events.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this processor in the pipeline.
          example: add-env-vars-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorType'
        variables:
          description: A list of environment variable mappings to apply to log fields.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorVariable'
          type: array
      required:
      - id
      - type
      - include
      - inputs
      - variables
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorPattern:
      description: Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern'
    ObservabilityPipelineSyslogNgSourceType:
      default: syslog_ng
      description: The source type. The value should always be `syslog_ng`.
      enum:
      - syslog_ng
      example: syslog_ng
      type: string
      x-enum-varnames:
      - SYSLOG_NG
    ObservabilityPipelineSensitiveDataScannerProcessorActionRedact:
      description: Configuration for completely redacting matched sensitive data.
      properties:
        action:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction'
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions'
      required:
      - action
      - options
      type: object
    ObservabilityPipelineReduceProcessor:
      description: The `reduce` processor aggregates and merges logs based on matching keys and merge strategies.
      properties:
        group_by:
          description: A list of fields used to group log events for merging.
          example:
          - log.user.id
          - log.device.id
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: reduce-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: env:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        merge_strategies:
          description: List of merge strategies defining how values from grouped events should be combined.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategy'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - group_by
      - merge_strategies
      type: object
    ObservabilityPipelineGenerateMetricsProcessorType:
      default: generate_datadog_metrics
      description: The processor type. Always `generate_datadog_metrics`.
      enum:
      - generate_datadog_metrics
      example: generate_datadog_metrics
      type: string
      x-enum-varnames:
      - GENERATE_DATADOG_METRICS
    GCPSTSServiceAccount:
      description: Info on your service account.
      properties:
        attributes:
          $ref: '#/components/schemas/GCPSTSServiceAccountAttributes'
        id:
          description: Your service account's unique ID.
          example: d291291f-12c2-22g4-j290-123456678897
          type: string
        meta:
          $ref: '#/components/schemas/GCPServiceAccountMeta'
        type:
          $ref: '#/components/schemas/GCPServiceAccountType'
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineParseGrokProcessorRuleSupportRule:
      description: The Grok helper rule referenced in the parsing rules.
      properties:
        name:
          description: The name of the Grok helper rule.
          example: user
          type: string
        rule:
          description: The definition of the Grok helper rule.
          example: ' %{word:user.name}'
          type: string
      required:
      - name
      - rule
      type: object
    RelationshipToOutcomeData:
      description: The JSON:API relationship to an outcome, which returns the related rule id.
      properties:
        id:
          $ref: '#/components/schemas/RuleId'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    AssetType:
      description: The asset type
      enum:
      - Repository
      - Service
      - Host
      - HostImage
      - Image
      example: Repository
      type: string
      x-enum-varnames:
      - REPOSITORY
      - SERVICE
      - HOST
      - HOSTIMAGE
      - IMAGE
    IncidentAttachmentPostmortemAttachmentType:
      default: postmortem
      description: The type of postmortem attachment attributes.
      enum:
      - postmortem
      example: postmortem
      type: string
      x-enum-varnames:
      - POSTMORTEM
    VulnerabilitySeverity:
      description: The vulnerability severity.
      enum:
      - Unknown
      - None
      - Low
      - Medium
      - High
      - Critical
      example: Medium
      type: string
      x-enum-varnames:
      - UNKNOWN
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    EntityV3QueueKind:
      description: The definition of Entity V3 Queue Kind object.
      enum:
      - queue
      example: queue
      type: string
      x-enum-varnames:
      - QUEUE
    DORAListResponse:
      description: Response for the DORA list endpoints.
      properties:
        data:
          description: The list of DORA events.
          items:
            $ref: '#/components/schemas/DORAEvent'
          type: array
      type: object
    Vulnerability:
      description: A single vulnerability
      properties:
        attributes:
          $ref: '#/components/schemas/VulnerabilityAttributes'
        id:
          description: The unique ID for this vulnerability.
          example: 3ecdfea798f2ce8f6e964805a344945f
          type: string
        relationships:
          $ref: '#/components/schemas/VulnerabilityRelationships'
        type:
          $ref: '#/components/schemas/VulnerabilitiesType'
      required:
      - id
      - type
      - attributes
      - relationships
      type: object
    SecurityMonitoringRuleCase:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    MetricSuggestedTagsAndAggregations:
      description: Object for a single metric's actively queried tags and aggregations.
      properties:
        attributes:
          $ref: '#/components/schemas/MetricSuggestedTagsAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricActiveConfigurationType'
      type: object
    IncidentAttachmentsResponseIncludedItem:
      description: An object related to an attachment that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    ObservabilityPipelineOcsfMapperProcessor:
      description: The `ocsf_mapper` processor transforms logs into the OCSF schema using a predefined mapping configuration.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline.
          example: ocsf-mapper-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this processor.
          example:
          - filter-processor
          items:
            type: string
          type: array
        mappings:
          description: A list of mapping rules to convert events to the OCSF format.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMapping'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - mappings
      type: object
    ApplicationSecurityWafExclusionFiltersResponse:
      description: Response object for multiple WAF exclusion filters.
      properties:
        data:
          description: A list of WAF exclusion filters.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResource'
          type: array
      type: object
    ObservabilityPipelineSplunkTcpSourceType:
      default: splunk_tcp
      description: The source type. Always `splunk_tcp`.
      enum:
      - splunk_tcp
      example: splunk_tcp
      type: string
      x-enum-varnames:
      - SPLUNK_TCP
    MonitorType:
      description: Attributes from the monitor that triggered the event.
      nullable: true
      properties:
        created_at:
          description: The POSIX timestamp of the monitor's creation in nanoseconds.
          example: 1646318692000
          format: int64
          type: integer
        group_status:
          description: Monitor group status used when there is no `result_groups`.
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
        groups:
          description: Groups to which the monitor belongs.
          items:
            description: A group.
            type: string
          type: array
        id:
          description: The monitor ID.
          format: int64
          type: integer
          example: 42
        message:
          description: The monitor message.
          type: string
          example: CPU usage is high on {{host.name}}
        modified:
          description: The monitor's last-modified timestamp.
          format: int64
          type: integer
          example: 42
        name:
          description: The monitor name.
          type: string
          example: Example Monitor
        query:
          description: The query that triggers the alert.
          type: string
          example: avg:system.cpu.user{*}
        tags:
          description: A list of tags attached to the monitor.
          example:
          - environment:test
          items:
            description: A tag.
            type: string
          type: array
        templated_name:
          description: The templated name of the monitor before resolving any template variables.
          type: string
          example: Example Monitor
        type:
          description: The monitor type.
          type: string
          example: metric alert
      type: object
    SecurityMonitoringFilter:
      description: The rule's suppression filter.
      properties:
        action:
          $ref: '#/components/schemas/SecurityMonitoringFilterAction'
        query:
          description: Query for selecting logs to apply the filtering action.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    ApplicationSecurityWafExclusionFilterRulesTarget:
      description: Target WAF rules based either on an identifier or tags.
      properties:
        rule_id:
          description: Target a single WAF rule based on its identifier.
          example: dog-913-009
          type: string
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTargetTags'
      type: object
    EntityResponseIncludedRawSchemaAttributes:
      description: Included raw schema attributes.
      properties:
        rawSchema:
          description: Schema from user input in base64 encoding.
          type: string
          example: example_value
      type: object
    AWSAccountPartition:
      description: 'AWS partition your AWS account is scoped to. Defaults to `aws`.

        See [Partitions](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html) in the AWS documentation for more information.'
      enum:
      - aws
      - aws-cn
      - aws-us-gov
      example: aws
      type: string
      x-enum-varnames:
      - AWS
      - AWS_CN
      - AWS_US_GOV
    RolesType:
      default: roles
      description: Roles type.
      enum:
      - roles
      example: roles
      type: string
      x-enum-varnames:
      - ROLES
    MetricCustomTimeAggregation:
      description: A time aggregation for use in query.
      enum:
      - avg
      - count
      - max
      - min
      - sum
      example: sum
      type: string
      x-enum-varnames:
      - AVG
      - COUNT
      - MAX
      - MIN
      - SUM
    AuthNMappingAttributes:
      description: Attributes of AuthN Mapping.
      properties:
        attribute_key:
          description: Key portion of a key/value pair of the attribute sent from the Identity Provider.
          example: member-of
          type: string
        attribute_value:
          description: Value portion of a key/value pair of the attribute sent from the Identity Provider.
          example: Development
          type: string
        created_at:
          description: Creation time of the AuthN Mapping.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified_at:
          description: Time of last AuthN Mapping modification.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        saml_assertion_attribute_id:
          description: The ID of the SAML assertion attribute.
          example: '0'
          type: string
      type: object
    ObservabilityPipelineKafkaSourceType:
      default: kafka
      description: The source type. The value should always be `kafka`.
      enum:
      - kafka
      example: kafka
      type: string
      x-enum-varnames:
      - KAFKA
    RelationshipToPermissions:
      description: Relationship to multiple permissions objects.
      properties:
        data:
          description: Relationships to permission objects.
          items:
            $ref: '#/components/schemas/RelationshipToPermissionData'
          type: array
      type: object
      x-merge-override:
        required: false
    EntityData:
      description: Entity data.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityAttributes'
        id:
          description: Entity ID.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/EntityMeta'
        relationships:
          $ref: '#/components/schemas/EntityRelationships'
        type:
          description: Entity.
          type: string
          example: metric alert
      type: object
    FindingRule:
      additionalProperties: false
      description: The rule that triggered this finding.
      properties:
        id:
          description: The ID of the rule that triggered this finding.
          example: dv2-jzf-41i
          type: string
        name:
          description: The name of the rule that triggered this finding.
          example: Soft delete is enabled for Azure Storage
          type: string
      type: object
    IncidentTeamRelationships:
      description: The incident team's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    ObservabilityPipelineGoogleCloudStorageDestinationStorageClass:
      description: Storage class used for objects stored in GCS.
      enum:
      - STANDARD
      - NEARLINE
      - COLDLINE
      - ARCHIVE
      example: STANDARD
      type: string
      x-enum-varnames:
      - STANDARD
      - NEARLINE
      - COLDLINE
      - ARCHIVE
    ObservabilityPipelineConfig:
      description: Specifies the pipeline's configuration, including its sources, processors, and destinations.
      properties:
        destinations:
          description: A list of destination components where processed logs are sent.
          example:
          - id: datadog-logs-destination
            inputs:
            - filter-processor
            type: datadog_logs
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigDestinationItem'
          type: array
        processors:
          description: A list of processors that transform or enrich log data.
          example:
          - id: filter-processor
            include: service:my-service
            inputs:
            - datadog-agent-source
            type: filter
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigProcessorItem'
          type: array
        sources:
          description: A list of configured data sources for the pipeline.
          example:
          - id: datadog-agent-source
            type: datadog_agent
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigSourceItem'
          type: array
      required:
      - sources
      - destinations
      type: object
    IncidentTodoListResponse:
      description: Response with a list of incident todos.
      properties:
        data:
          description: An array of incident todos.
          items:
            $ref: '#/components/schemas/IncidentTodoResponseData'
          type: array
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentTodoResponseIncludedItem'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentResponseMeta'
      required:
      - data
      type: object
    RelationMeta:
      description: Relation metadata.
      properties:
        createdAt:
          description: Relation creation time.
          format: date-time
          type: string
          example: example_value
        definedBy:
          description: Relation defined by.
          type: string
          example: example_value
        modifiedAt:
          description: Relation modification time.
          format: date-time
          type: string
          example: example_value
        source:
          description: Relation source.
          type: string
          example: example_value
      type: object
    RUMEventAttributes:
      description: JSON object containing all event attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from RUM events.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        service:
          description: 'The name of the application or service generating RUM events.

            It is used to switch from RUM to APM, so make sure you define the same

            value when you use both products.'
          example: web-app
          type: string
        tags:
          description: Array of tags associated with your event.
          example:
          - team:A
          items:
            description: Tag associated with your event.
            type: string
          type: array
        timestamp:
          description: Timestamp of your event.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    SensitiveDataScannerStandardPattern:
      description: Data containing the standard pattern id.
      properties:
        id:
          description: ID of the standard pattern.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternType'
      type: object
    UsersType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    SensitiveDataScannerConfiguration:
      description: A Sensitive Data Scanner configuration.
      properties:
        id:
          description: ID of the configuration.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerConfigurationType'
      type: object
    ObservabilityPipelineRemoveFieldsProcessorType:
      default: remove_fields
      description: The processor type. The value should always be `remove_fields`.
      enum:
      - remove_fields
      example: remove_fields
      type: string
      x-enum-varnames:
      - REMOVE_FIELDS
    AwsCURConfigType:
      default: aws_cur_config
      description: Type of AWS CUR config.
      enum:
      - aws_cur_config
      example: aws_cur_config
      type: string
      x-enum-varnames:
      - AWS_CUR_CONFIG
    RUMApplicationListType:
      default: rum_application
      description: RUM application list type.
      enum:
      - rum_application
      example: rum_application
      type: string
      x-enum-varnames:
      - RUM_APPLICATION
    ApplicationSecurityWafCustomRuleTagsCategory:
      description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`.
      enum:
      - attack_attempt
      - business_logic
      - security_response
      example: business_logic
      type: string
      x-enum-varnames:
      - ATTACK_ATTEMPT
      - BUSINESS_LOGIC
      - SECURITY_RESPONSE
    EntityToRawSchema:
      description: Entity to raw schema relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipItem'
      type: object
    IncidentTypeListResponse:
      description: Response with a list of incident types.
      properties:
        data:
          description: An array of incident type objects.
          items:
            $ref: '#/components/schemas/IncidentTypeObject'
          type: array
      required:
      - data
      type: object
    IncidentTodoResponseIncludedItem:
      description: An object related to an incident todo that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    ObservabilityPipelineSumoLogicSource:
      description: The `sumo_logic` source receives logs from Sumo Logic collectors.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sumo-logic-source
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSourceType'
      required:
      - id
      - type
      type: object
    EntityV3APIVersion:
      description: The schema version of entity type. The field is known as schema-version in the previous version.
      enum:
      - v3
      example: v3
      type: string
      x-enum-varnames:
      - V3
    ObservabilityPipelineHttpClientSourceAuthStrategy:
      description: Optional authentication strategy for HTTP requests.
      enum:
      - basic
      - bearer
      example: basic
      type: string
      x-enum-varnames:
      - BASIC
      - BEARER
    EntityV3DatadogEventItem:
      additionalProperties: false
      description: Events association item.
      properties:
        name:
          description: The name of the query.
          type: string
          example: Example Monitor
        query:
          description: The query to run.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    AuthNMappingsResponse:
      description: Array of AuthN Mappings response.
      properties:
        data:
          description: Array of returned AuthN Mappings.
          items:
            $ref: '#/components/schemas/AuthNMapping'
          type: array
        included:
          description: Included data in the AuthN Mapping response.
          items:
            $ref: '#/components/schemas/AuthNMappingIncluded'
          type: array
        meta:
          $ref: '#/components/schemas/ResponseMetaAttributes'
      type: object
    EventsListResponse:
      description: The response object with all events matching the request and pagination information.
      properties:
        data:
          description: An array of events matching the request.
          items:
            $ref: '#/components/schemas/EventResponse'
          type: array
        links:
          $ref: '#/components/schemas/EventsListResponseLinks'
        meta:
          $ref: '#/components/schemas/EventsResponseMetadata'
      type: object
    PermissionAttributes:
      description: Attributes of a permission.
      properties:
        created:
          description: Creation time of the permission.
          format: date-time
          type: string
          example: example_value
        description:
          description: Description of the permission.
          type: string
          example: example_value
        display_name:
          description: Displayed name for the permission.
          type: string
          example: Example Monitor
        display_type:
          description: Display type.
          type: string
          example: metric alert
        group_name:
          description: Name of the permission group.
          type: string
          example: Example Monitor
        name:
          description: Name of the permission.
          type: string
          example: Example Monitor
        restricted:
          description: Whether or not the permission is restricted.
          type: boolean
          example: true
      type: object
    VulnerabilityRisks:
      description: Vulnerability risks.
      properties:
        epss:
          $ref: '#/components/schemas/EPSS'
        exploit_available:
          description: Vulnerability public exploit availability.
          example: false
          type: boolean
        exploit_sources:
          description: Vulnerability exploit sources.
          example:
          - NIST
          items:
            example: NIST
            type: string
          type: array
        exploitation_probability:
          description: Vulnerability exploitation probability.
          example: false
          type: boolean
        poc_exploit_available:
          description: Vulnerability POC exploit availability.
          example: false
          type: boolean
      required:
      - exploitation_probability
      - poc_exploit_available
      - exploit_available
      - exploit_sources
      type: object
    IncidentAttachmentRelationships:
      description: The incident attachment's relationships.
      properties:
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    ObservabilityPipelineOcsfMapperProcessorMapping:
      description: Defines how specific events are transformed to OCSF using a mapping configuration.
      properties:
        include:
          description: A Datadog search query used to select the logs that this mapping should apply to.
          example: service:my-service
          type: string
        mapping:
          $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping'
      required:
      - include
      - mapping
      type: object
    MicrosoftSentinelDestinationType:
      default: microsoft_sentinel
      description: The destination type. The value should always be `microsoft_sentinel`.
      enum:
      - microsoft_sentinel
      example: microsoft_sentinel
      type: string
      x-enum-varnames:
      - MICROSOFT_SENTINEL
    RelationshipToOutcome:
      description: The JSON:API relationship to a scorecard outcome.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToOutcomeData'
      type: object
    ObservabilityPipelineQuotaProcessorLimit:
      description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events.
      properties:
        enforce:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType'
        limit:
          description: The limit for quota enforcement.
          example: 1000
          format: int64
          type: integer
      required:
      - enforce
      - limit
      type: object
    ResourceFilterAttributes:
      description: Attributes of a resource filter.
      example:
        aws:
          '123456789':
          - environment:production
          - team:devops
        azure:
          sub-001:
          - app:frontend
        gcp:
          project-abc:
          - region:us-central1
      properties:
        cloud_provider:
          additionalProperties:
            additionalProperties:
              items:
                description: Tag filter in format "key:value"
                example: environment:production
                type: string
              type: array
            type: object
          description: A map of cloud provider names (e.g., "aws", "gcp", "azure") to a map of account/resource IDs and their associated tag filters.
          type: object
        uuid:
          description: The UUID of the resource filter.
          type: string
          example: abc-123-def
      required:
      - cloud_provider
      type: object
    NotificationRule:
      description: 'Notification rules allow full control over notifications generated by the various Datadog security products.

        They allow users to define the conditions under which a notification should be generated (based on rule severities,

        rule types, rule tags, and so on), and the targets to notify.

        A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.

        '
      properties:
        attributes:
          $ref: '#/components/schemas/NotificationRuleAttributes'
        id:
          $ref: '#/components/schemas/ID'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - id
      - type
      type: object
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    ListAppsResponse:
      description: A paginated list of apps matching the specified filters and sorting.
      properties:
        data:
          description: An array of app definitions.
          items:
            $ref: '#/components/schemas/ListAppsResponseDataItems'
          type: array
        included:
          description: Data on the version of the app that was published.
          items:
            $ref: '#/components/schemas/Deployment'
          type: array
        meta:
          $ref: '#/components/schemas/ListAppsResponseMeta'
      type: object
    ListPipelinesResponse:
      description: Represents the response payload containing a list of pipelines and associated metadata.
      properties:
        data:
          description: The `schema` `data`.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineData'
          type: array
        meta:
          $ref: '#/components/schemas/ListPipelinesResponseMeta'
      required:
      - data
      type: object
    ListFindingsData:
      description: Array of findings.
      items:
        $ref: '#/components/schemas/Finding'
      type: array
    ListExternalUsersResponse:
      description: List users response object.
      example:
        Resources:
        - active: true
          emails:
          - primary: true
            type: work
            value: john.doe@datadoghq.com
          id: e43536e9-33fe-43f8-90b8-d3e39a7dd6ad
          meta:
            created: '2024-11-22T15:05:52.055138963Z'
            lastModified: '2024-11-22T15:05:52.055139017Z'
            location: https://app.datadoghq.com/api/scim/v2/Users/e43536e9-33fe-43f8-90b8-d3e39a7dd6ad
            resourceType: User
          name:
            formatted: John Doe
          schemas:
          - urn:ietf:params:scim:schemas:core:2.0:User
          title: Mr.
          userName: john.doe@datadoghq.com
        - active: true
          emails:
          - primary: true
            type: work
            value: jane.doe@datadoghq.com
          id: 79ef0d28-f257-4829-97e6-d23d2a26cb1a
          meta:
            created: '2024-11-22T15:05:52.055139748Z'
            lastModified: '2024-11-22T15:05:52.055139813Z'
            location: https://app.datadoghq.com/api/scim/v2/Users/79ef0d28-f257-4829-97e6-d23d2a26cb1a
            resourceType: User
          name:
            formatted: Jane Doe
          schemas:
          - urn:ietf:params:scim:schemas:core:2.0:User
          title: Mrs.
          userName: jane.doe@datadoghq.com
        itemsPerPage: 2
        schemas:
        - urn:ietf:params:scim:api:messages:2.0:ListResponse
        startIndex: 1
        totalResults: 2
      properties:
        Resources:
          description: List of users matching the request criteria.
          items:
            $ref: '#/components/schemas/ListExternalUsersResponseResourcesItems'
          type: array
        itemsPerPage:
          description: Number of users returned per page.
          format: int64
          maximum: 4294967295
          minimum: 0
          type: integer
          example: 42
        schemas:
          description: List response JSON Schemas.
          example:
          - urn:ietf:params:scim:api:messages:2.0:ListResponse
          items:
            type: string
          type: array
        startIndex:
          description: Starting index of the users for this page (1-indexed).
          format: int64
          maximum: 4294967295
          minimum: 0
          type: integer
          example: 42
        totalResults:
          description: Total number of users matching the request criteria.
          format: int64
          maximum: 4294967295
          minimum: 0
          type: integer
          example: 42
      type: object
    EntityV3ServiceDatadog:
      additionalProperties: false
      description: Datadog product integrations for the service entity.
      properties:
        codeLocations:
          $ref: '#/components/schemas/EntityV3DatadogCodeLocations'
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
        pipelines:
          $ref: '#/components/schemas/EntityV3DatadogPipelines'
      type: object
    SlackIntegrationMetadata:
      description: Incident integration metadata for the Slack integration.
      properties:
        channels:
          description: Array of Slack channels in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/SlackIntegrationMetadataChannelItem'
          type: array
      required:
      - channels
      type: object
    IncidentIntegrationMetadataResponseIncludedItem:
      description: An object related to an incident integration metadata that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    RelationshipToIncidentResponderData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentRespondersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    RelationshipToIncidentImpacts:
      description: Relationship to impacts.
      properties:
        data:
          description: An array of incident impacts.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentImpactData'
          type: array
      required:
      - data
      type: object
    ApplicationSecurityWafCustomRuleConditionOperator:
      description: Operator to use for the WAF Condition.
      enum:
      - match_regex
      - '!match_regex'
      - phrase_match
      - '!phrase_match'
      - is_xss
      - is_sqli
      - exact_match
      - '!exact_match'
      - ip_match
      - '!ip_match'
      - capture_data
      example: match_regex
      type: string
      x-enum-varnames:
      - MATCH_REGEX
      - NOT_MATCH_REGEX
      - PHRASE_MATCH
      - NOT_PHRASE_MATCH
      - IS_XSS
      - IS_SQLI
      - EXACT_MATCH
      - NOT_EXACT_MATCH
      - IP_MATCH
      - NOT_IP_MATCH
      - CAPTURE_DATA
    EventsResponseMetadataPage:
      description: Pagination attributes.
      properties:
        after:
          description: 'The cursor to use to get the next results, if any. To make the next request, use the same

            parameters with the addition of the `page[cursor]`.'
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    IncidentTodoResponseData:
      description: Incident todo response data.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTodoAttributes'
        id:
          description: The incident todo's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTodoRelationships'
        type:
          $ref: '#/components/schemas/IncidentTodoType'
      required:
      - id
      - type
      type: object
    GetInterfacesData:
      description: The interfaces list data
      properties:
        attributes:
          $ref: '#/components/schemas/InterfaceAttributes'
        id:
          description: The interface ID
          example: example:1.2.3.4:99
          type: string
        type:
          description: The type of the resource. The value should always be interface.
          type: string
          example: metric alert
      type: object
    EntityToRelatedEntities:
      description: Entity to related entities relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipArray'
      type: object
    IncidentAttachmentPostmortemAttributes:
      description: The attributes object for a postmortem attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType'
      required:
      - attachment_type
      - attachment
      type: object
    ListEntityCatalogResponseIncludedItem:
      description: List entity response included item.
      oneOf:
      - $ref: '#/components/schemas/EntityResponseIncludedSchema'
      - $ref: '#/components/schemas/EntityResponseIncludedRawSchema'
      - $ref: '#/components/schemas/EntityResponseIncludedRelatedEntity'
      - $ref: '#/components/schemas/EntityResponseIncludedOncall'
      - $ref: '#/components/schemas/EntityResponseIncludedIncident'
    AuditLogsEvent:
      description: Object description of an Audit Logs event after it is processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/AuditLogsEventAttributes'
        id:
          description: Unique ID of the event.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/AuditLogsEventType'
      type: object
    MetricTagConfigurationMetricTypes:
      default: gauge
      description: The metric's type.
      enum:
      - gauge
      - count
      - rate
      - distribution
      example: count
      type: string
      x-enum-varnames:
      - GAUGE
      - COUNT
      - RATE
      - DISTRIBUTION
    SensitiveDataScannerTextReplacement:
      description: Object describing how the scanned event will be replaced.
      properties:
        number_of_chars:
          description: 'Required if type == ''partial_replacement_from_beginning''

            or ''partial_replacement_from_end''. It must be > 0.'
          format: int64
          minimum: 0
          type: integer
          example: 42
        replacement_string:
          description: Required if type == 'replacement_string'.
          type: string
          example: example_value
        type:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacementType'
      type: object
    AssetVersion:
      description: Asset version.
      properties:
        first:
          description: Asset first version.
          example: _latest
          type: string
        last:
          description: Asset last version.
          example: _latest
          type: string
      type: object
    RelationshipToIncidentIntegrationMetadataData:
      description: A relationship reference for an integration metadata object.
      example:
        id: 00000000-abcd-0002-0000-000000000000
        type: incident_integrations
      properties:
        id:
          description: A unique identifier that represents the integration metadata.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior
      type: string
      x-enum-varnames:
      - BLOCK_IP
      - BLOCK_USER
      - USER_BEHAVIOR
    ObservabilityPipelineSampleProcessor:
      description: The `sample` processor allows probabilistic sampling of logs at a fixed rate.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: sample-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        percentage:
          description: The percentage of logs to sample.
          example: 10
          format: double
          type: number
        rate:
          description: Number of events to sample (1 in N).
          example: 10
          format: int64
          minimum: 1
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSampleProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    CIAppPipelineEventsResponse:
      description: Response object with all pipeline events matching the request and pagination information.
      properties:
        data:
          description: Array of events matching the request.
          items:
            $ref: '#/components/schemas/CIAppPipelineEvent'
          type: array
        links:
          $ref: '#/components/schemas/CIAppResponseLinks'
        meta:
          $ref: '#/components/schemas/CIAppResponseMetadataWithPagination'
      type: object
    EntityV3API:
      additionalProperties: false
      description: Schema for API entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3APIDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3APIKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3APISpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    FastlyService:
      description: The schema representation of a Fastly service.
      properties:
        id:
          description: The ID of the Fastly service
          example: 6abc7de6893AbcDe9fghIj
          type: string
        tags:
          description: A list of tags for the Fastly service.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - id
      type: object
    ObservabilityPipelineData:
      description: Contains the pipeline’s ID, type, and configuration attributes.
      properties:
        attributes:
          $ref: '#/components/schemas/ObservabilityPipelineDataAttributes'
        id:
          description: Unique identifier for the pipeline.
          example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
          type: string
        type:
          default: pipelines
          description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`.
          example: pipelines
          type: string
      required:
      - id
      - type
      - attributes
      type: object
    MetricsListResponseLinks:
      description: Pagination links. Only present if pagination query parameters were provided.
      properties:
        first:
          description: Link to the first page.
          type: string
          example: example_value
        last:
          description: Link to the last page.
          nullable: true
          type: string
          example: example_value
        next:
          description: Link to the next page.
          nullable: true
          type: string
          example: example_value
        prev:
          description: Link to previous page.
          nullable: true
          type: string
          example: example_value
        self:
          description: Link to current page.
          type: string
          example: example_value
      type: object
    OrgConfigType:
      description: Data type of an Org Config.
      enum:
      - org_configs
      example: org_configs
      type: string
      x-enum-varnames:
      - ORG_CONFIGS
    AWSAccountResponseData:
      description: AWS Account response data.
      properties:
        attributes:
          $ref: '#/components/schemas/AWSAccountResponseAttributes'
        id:
          $ref: '#/components/schemas/AWSAccountConfigID'
        type:
          $ref: '#/components/schemas/AWSAccountType'
      required:
      - id
      - type
      type: object
    DashboardListItemRequest:
      description: A dashboard within a list.
      properties:
        id:
          description: ID of the dashboard.
          example: q5j-nti-fv6
          type: string
        type:
          $ref: '#/components/schemas/DashboardType'
      required:
      - type
      - id
      type: object
    ApplicationSecurityWafCustomRuleActionAction:
      default: block_request
      description: Override the default action to take when the WAF custom rule would block.
      enum:
      - redirect_request
      - block_request
      example: block_request
      type: string
      x-enum-varnames:
      - REDIRECT_REQUEST
      - BLOCK_REQUEST
    SensitiveDataScannerGroupIncludedItem:
      description: A Scanning Group included item.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerGroupAttributes'
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerGroupRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    RelationshipToTeam:
      description: Relationship to team.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToTeamData'
      type: object
      x-merge-override:
        required: false
    WorkflowInstanceListItem:
      additionalProperties: {}
      description: An item in the workflow instances list.
      properties:
        id:
          description: The ID of the workflow instance
          type: string
          example: abc-123-def
      type: object
    EntityV3SystemSpec:
      additionalProperties: false
      description: The definition of Entity V3 System Spec object.
      properties:
        components:
          description: A list of components belongs to the system.
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the component.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: An entity reference to the owner of the component.
          minLength: 1
          type: string
          example: example_value
      type: object
    RelationshipToRole:
      description: Relationship to role.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToRoleData'
      type: object
      x-merge-override:
        required: false
    RuleType:
      default: rule
      description: The JSON:API type for scorecard rules.
      enum:
      - rule
      example: rule
      type: string
      x-enum-varnames:
      - RULE
    WorkflowListInstancesResponse:
      additionalProperties: {}
      description: Response returned when listing workflow instances.
      properties:
        data:
          description: A list of workflow instances.
          items:
            $ref: '#/components/schemas/WorkflowInstanceListItem'
          type: array
        meta:
          $ref: '#/components/schemas/WorkflowListInstancesResponseMeta'
      type: object
    ObservabilityPipelineGoogleCloudStorageDestinationAcl:
      description: Access control list setting for objects written to the bucket.
      enum:
      - private
      - project-private
      - public-read
      - authenticated-read
      - bucket-owner-read
      - bucket-owner-full-control
      example: private
      type: string
      x-enum-varnames:
      - PRIVATE
      - PROJECTNOT_PRIVATE
      - PUBLICNOT_READ
      - AUTHENTICATEDNOT_READ
      - BUCKETNOT_OWNERNOT_READ
      - BUCKETNOT_OWNERNOT_FULLNOT_CONTROL
    SecurityMonitoringSignalsListResponseMeta:
      description: Meta attributes.
      properties:
        page:
          $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMetaPage'
      type: object
    MetricTagConfigurationAttributes:
      description: Object containing the definition of a metric tag configuration attributes.
      properties:
        aggregations:
          $ref: '#/components/schemas/MetricCustomAggregations'
        created_at:
          description: Timestamp when the tag configuration was created.
          example: '2020-03-25T09:48:37.463835Z'
          format: date-time
          type: string
        exclude_tags_mode:
          description: 'When set to true, the configuration will exclude the configured tags and include any other submitted tags.

            When set to false, the configuration will include the configured tags and exclude any other submitted tags.

            Defaults to false. Requires `tags` property.'
          type: boolean
          example: true
        include_percentiles:
          description: 'Toggle to include or exclude percentile aggregations for distribution metrics.

            Only present when the `metric_type` is `distribution`.'
          example: true
          type: boolean
        metric_type:
          $ref: '#/components/schemas/MetricTagConfigurationMetricTypes'
        modified_at:
          description: Timestamp when the tag configuration was last modified.
          example: '2020-03-25T09:48:37.463835Z'
          format: date-time
          type: string
        tags:
          description: List of tag keys on which to group.
          example:
          - app
          - datacenter
          items:
            description: Tag keys to group by.
            type: string
          type: array
      type: object
    ObservabilityPipelineGoogleChronicleDestinationType:
      default: google_chronicle
      description: The destination type. The value should always be `google_chronicle`.
      enum:
      - google_chronicle
      example: google_chronicle
      type: string
      x-enum-varnames:
      - GOOGLE_CHRONICLE
    DashboardListDeleteItemsResponse:
      description: Response containing a list of deleted dashboards.
      properties:
        deleted_dashboards_from_list:
          description: List of dashboards deleted from the dashboard list.
          items:
            $ref: '#/components/schemas/DashboardListItemResponse'
          type: array
      type: object
    RUMEvent:
      description: Object description of a RUM event after being processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/RUMEventAttributes'
        id:
          description: Unique ID of the event.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/RUMEventType'
      type: object
    ObservabilityPipelineDedupeProcessor:
      description: The `dedupe` processor removes duplicate fields in log events.
      properties:
        fields:
          description: A list of log field paths to check for duplicates.
          example:
          - log.message
          - log.error
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: dedupe-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorMode'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - fields
      - mode
      type: object
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    ObservabilityPipelineGoogleChronicleDestinationEncoding:
      description: The encoding format for the logs sent to Chronicle.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    NotificationRulesType:
      description: The rule type associated to notification rules.
      enum:
      - notification_rules
      example: notification_rules
      type: string
      x-enum-varnames:
      - NOTIFICATION_RULES
    ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude:
      description: Includes only specific fields for sensitive data scanning.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions'
        target:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget'
      required:
      - target
      - options
      type: object
    ObservabilityPipelineAmazonS3DestinationType:
      default: amazon_s3
      description: The destination type. Always `amazon_s3`.
      enum:
      - amazon_s3
      example: amazon_s3
      type: string
      x-enum-varnames:
      - AMAZON_S3
    EntityV3Datastore:
      additionalProperties: false
      description: Schema for datastore entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3DatastoreDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3DatastoreKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3DatastoreSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    RelationshipToIncidentUserDefinedFieldData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentUserDefinedFieldType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    FindingID:
      description: The unique ID for this finding.
      example: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==
      type: string
    IncidentServiceType:
      default: services
      description: Incident service resource type.
      enum:
      - services
      example: services
      type: string
      x-enum-varnames:
      - SERVICES
    ObservabilityPipelineFilterProcessorType:
      default: filter
      description: The processor type. The value should always be `filter`.
      enum:
      - filter
      example: filter
      type: string
      x-enum-varnames:
      - FILTER
    MSTeamsIntegrationMetadata:
      description: Incident integration metadata for the Microsoft Teams integration.
      properties:
        teams:
          description: Array of Microsoft Teams in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/MSTeamsIntegrationMetadataTeamsItem'
          type: array
      required:
      - teams
      type: object
    SensitiveDataScannerProduct:
      default: logs
      description: Datadog product onto which Sensitive Data Scanner can be activated.
      enum:
      - logs
      - rum
      - events
      - apm
      type: string
      x-enum-varnames:
      - LOGS
      - RUM
      - EVENTS
      - APM
    SecurityMonitoringThirdPartyRuleCaseCreate:
      description: Case when a signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    RelationshipToRuleData:
      description: Relationship data for a rule.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToRuleDataObject'
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget:
      description: Excludes specific fields from processing.
      enum:
      - exclude
      example: exclude
      type: string
      x-enum-varnames:
      - EXCLUDE
    FindingMuteReason:
      description: The reason why this finding is muted or unmuted.
      enum:
      - PENDING_FIX
      - FALSE_POSITIVE
      - ACCEPTED_RISK
      - NO_PENDING_FIX
      - HUMAN_ERROR
      - NO_LONGER_ACCEPTED_RISK
      - OTHER
      example: ACCEPTED_RISK
      type: string
      x-enum-varnames:
      - PENDING_FIX
      - FALSE_POSITIVE
      - ACCEPTED_RISK
      - NO_PENDING_FIX
      - HUMAN_ERROR
      - NO_LONGER_ACCEPTED_RISK
      - OTHER
    ApplicationSecurityWafExclusionFilterRulesTargetTags:
      additionalProperties:
        type: string
      description: Target multiple WAF rules based on their tags.
      properties:
        category:
          description: The category of the targeted WAF rules.
          example: attack_attempt
          type: string
        type:
          description: The type of the targeted WAF rules.
          example: lfi
          type: string
      type: object
    Creator:
      description: Creator of the object.
      properties:
        email:
          description: Email of the creator.
          type: string
          example: user@example.com
        handle:
          description: Handle of the creator.
          type: string
          example: example_value
        name:
          description: Name of the creator.
          nullable: true
          type: string
          example: Example Monitor
      type: object
    IncidentFieldAttributesSingleValue:
      description: A field with a single value selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesSingleValueType'
        value:
          description: The single value selected for this field.
          example: SEV-1
          nullable: true
          type: string
      type: object
    EntityResponseMeta:
      description: Entity metadata.
      properties:
        count:
          description: Total entities count.
          format: int64
          type: integer
          example: 42
        includeCount:
          description: Total included data count.
          format: int64
          type: integer
          example: 42
      type: object
    SecurityMonitoringSignal:
      description: Object description of a security signal.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSignalAttributes'
        id:
          description: The unique ID of the security signal.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalType'
      type: object
    MetricIngestedIndexedVolumeAttributes:
      description: Object containing the definition of a metric's ingested and indexed volume.
      properties:
        indexed_volume:
          description: Indexed volume for the given metric.
          example: 10
          format: int64
          type: integer
        ingested_volume:
          description: Ingested volume for the given metric.
          example: 20
          format: int64
          type: integer
      type: object
    ObservabilityPipelineParseGrokProcessorRule:
      description: 'A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields

        from a specific log field using Grok patterns.

        '
      properties:
        match_rules:
          description: 'A list of Grok parsing rules that define how to extract fields from the source field.

            Each rule must contain a name and a valid Grok pattern.

            '
          example:
          - name: MyParsingRule
            rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule'
          type: array
        source:
          description: The name of the field in the log event to apply the Grok rules to.
          example: message
          type: string
        support_rules:
          description: 'A list of Grok helper rules that can be referenced by the parsing rules.

            '
          example:
          - name: user
            rule: '%{word:user.name}'
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule'
          type: array
      required:
      - source
      - match_rules
      - support_rules
      type: object
    MetricSuggestedAggregations:
      description: List of aggregation combinations that have been actively queried.
      example:
      - space: sum
        time: sum
      - space: sum
        time: count
      items:
        $ref: '#/components/schemas/MetricCustomAggregation'
      type: array
    RuleTypes:
      description: Security rule types used as filters in security rules.
      example:
      - misconfiguration
      - attack_path
      items:
        $ref: '#/components/schemas/RuleTypesItems'
      type: array
    MetricAllTags:
      description: Object for a single metric's indexed tags.
      properties:
        attributes:
          $ref: '#/components/schemas/MetricAllTagsAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricType'
      type: object
    CalculatedField:
      description: Calculated field.
      properties:
        expression:
          description: Expression.
          example: '@request_end_timestamp - @request_start_timestamp'
          type: string
        name:
          description: Field name.
          example: response_time
          type: string
      required:
      - name
      - expression
      type: object
    AuditLogsEventsResponse:
      description: Response object with all events matching the request and pagination information.
      properties:
        data:
          description: Array of events matching the request.
          items:
            $ref: '#/components/schemas/AuditLogsEvent'
          type: array
        links:
          $ref: '#/components/schemas/AuditLogsResponseLinks'
        meta:
          $ref: '#/components/schemas/AuditLogsResponseMetadata'
      type: object
    SensitiveDataScannerFilter:
      description: Filter for the Scanning Group.
      properties:
        query:
          description: Query to filter the events.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    AWSNamespacesResponseAttributes:
      description: AWS Namespaces response attributes.
      properties:
        namespaces:
          description: AWS CloudWatch namespace.
          example:
          - AWS/ApiGateway
          items:
            example: AWS/ApiGateway
            type: string
          type: array
      required:
      - namespaces
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByOne:
      description: Strategy that increments a generated metric by one for each matching event.
      properties:
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOneStrategy'
      required:
      - strategy
      type: object
    AwsCURConfigAttributes:
      description: Attributes for An AWS CUR config.
      properties:
        account_filters:
          $ref: '#/components/schemas/AccountFilteringConfig'
        account_id:
          description: The AWS account ID.
          example: '123456789123'
          type: string
        bucket_name:
          description: The AWS bucket name used to store the Cost and Usage Report.
          example: dd-cost-bucket
          type: string
        bucket_region:
          description: The region the bucket is located in.
          example: us-east-1
          type: string
        created_at:
          description: The timestamp when the AWS CUR config was created.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: example_value
        error_messages:
          description: The error messages for the AWS CUR config.
          items:
            type: string
          type: array
        months:
          deprecated: true
          description: The number of months the report has been backfilled.
          format: int32
          maximum: 36
          type: integer
          example: 42
        report_name:
          description: The name of the Cost and Usage Report.
          example: dd-report-name
          type: string
        report_prefix:
          description: The report prefix used for the Cost and Usage Report.
          example: dd-report-prefix
          type: string
        status:
          description: The status of the AWS CUR.
          example: active
          type: string
        status_updated_at:
          description: The timestamp when the AWS CUR config status was updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: OK
        updated_at:
          description: The timestamp when the AWS CUR config status was updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: '2026-04-17T12:00:00Z'
      required:
      - account_id
      - bucket_name
      - bucket_region
      - report_name
      - report_prefix
      - status
      type: object
      x-merge-override:
        required: false
    ListPipelinesResponseMeta:
      description: Metadata about the response.
      properties:
        totalCount:
          description: The total number of pipelines.
          example: 42
          format: int64
          type: integer
      type: object
    ListRulesResponseData:
      description: Array of rule details.
      items:
        $ref: '#/components/schemas/ListRulesResponseDataItem'
      type: array
    SecurityMonitoringSignalRuleResponseQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to correlate by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        defaultRuleId:
          description: Default Rule ID to match on signals.
          example: d3f-ru1-e1d
          type: string
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      type: object
    ObservabilityPipelineNewRelicDestinationRegion:
      description: The New Relic region.
      enum:
      - us
      - eu
      example: us
      type: string
      x-enum-varnames:
      - US
      - EU
    EntityV3APIKind:
      description: The definition of Entity V3 API Kind object.
      enum:
      - api
      example: api
      type: string
      x-enum-varnames:
      - API
    AuthNMappingTeam:
      description: Team.
      properties:
        attributes:
          $ref: '#/components/schemas/AuthNMappingTeamAttributes'
        id:
          description: The ID of the Team.
          example: f9bb8444-af7f-11ec-ac2c-da7ad0900001
          type: string
        type:
          $ref: '#/components/schemas/TeamType'
      type: object
    SecurityMonitoringSignalsSort:
      description: The sort parameters used for querying security signals.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    GCPServiceAccountType:
      default: gcp_service_account
      description: The type of account.
      enum:
      - gcp_service_account
      example: gcp_service_account
      type: string
      x-enum-varnames:
      - GCP_SERVICE_ACCOUNT
    ObservabilityPipelineEnrichmentTableFileEncoding:
      description: File encoding format.
      properties:
        delimiter:
          description: The `encoding` `delimiter`.
          example: ','
          type: string
        includes_headers:
          description: The `encoding` `includes_headers`.
          example: true
          type: boolean
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncodingType'
      required:
      - type
      - delimiter
      - includes_headers
      type: object
    EventsWarning:
      description: A warning message indicating something is wrong with the query.
      properties:
        code:
          description: A unique code for this type of warning.
          example: unknown_index
          type: string
        detail:
          description: A detailed explanation of this specific warning.
          example: 'indexes: foo, bar'
          type: string
        title:
          description: A short human-readable summary of the warning.
          example: One or several indexes are missing or invalid. Results hold data from the other indexes.
          type: string
      type: object
    IncidentIntegrationMetadataMetadata:
      description: Incident integration metadata's metadata attribute.
      oneOf:
      - $ref: '#/components/schemas/SlackIntegrationMetadata'
      - $ref: '#/components/schemas/JiraIntegrationMetadata'
      - $ref: '#/components/schemas/MSTeamsIntegrationMetadata'
    ApplicationSecurityWafCustomRuleMetadata:
      description: Metadata associated with the WAF Custom Rule.
      properties:
        added_at:
          description: The date and time the WAF custom rule was created.
          example: '2021-01-01T00:00:00Z'
          format: date-time
          type: string
        added_by:
          description: The handle of the user who created the WAF custom rule.
          example: john.doe@datadoghq.com
          type: string
        added_by_name:
          description: The name of the user who created the WAF custom rule.
          example: John Doe
          type: string
        modified_at:
          description: The date and time the WAF custom rule was last updated.
          example: '2021-01-01T00:00:00Z'
          format: date-time
          type: string
        modified_by:
          description: The handle of the user who last updated the WAF custom rule.
          example: john.doe@datadoghq.com
          type: string
        modified_by_name:
          description: The name of the user who last updated the WAF custom rule.
          example: John Doe
          type: string
      readOnly: true
      type: object
    EntityV3APIDatadog:
      additionalProperties: false
      description: Datadog product integrations for the API entity.
      properties:
        codeLocations:
          $ref: '#/components/schemas/EntityV3DatadogCodeLocations'
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
        pipelines:
          $ref: '#/components/schemas/EntityV3DatadogPipelines'
      type: object
    ScorecardType:
      default: scorecard
      description: The JSON:API type for scorecard.
      enum:
      - scorecard
      example: scorecard
      type: string
      x-enum-varnames:
      - SCORECARD
    RestrictionQueryRoleAttribute:
      description: Attributes of the role for a restriction query.
      properties:
        name:
          description: The role name.
          example: Datadog Admin Role
          type: string
      type: object
    ListEntityCatalogResponseIncluded:
      description: List entity response included.
      items:
        $ref: '#/components/schemas/ListEntityCatalogResponseIncludedItem'
      type: array
    SpansListResponse:
      description: Response object with all spans matching the request and pagination information.
      properties:
        data:
          description: Array of spans matching the request.
          items:
            $ref: '#/components/schemas/Span'
          type: array
        links:
          $ref: '#/components/schemas/SpansListResponseLinks'
        meta:
          $ref: '#/components/schemas/SpansListResponseMetadata'
      type: object
    UserResponseRelationships:
      description: Relationships of the user object returned by the API.
      properties:
        org:
          $ref: '#/components/schemas/RelationshipToOrganization'
        other_orgs:
          $ref: '#/components/schemas/RelationshipToOrganizations'
        other_users:
          $ref: '#/components/schemas/RelationshipToUsers'
        roles:
          $ref: '#/components/schemas/RelationshipToRoles'
      type: object
      x-merge-override:
        properties: false
    SecurityMonitoringSignalsListResponse:
      description: 'The response object with all security signals matching the request

        and pagination information.'
      properties:
        data:
          description: An array of security signals matching the request.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignal'
          type: array
        links:
          $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseLinks'
        meta:
          $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMeta'
      type: object
    SpansListResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'Link for the next set of results. Note that the request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/spans/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    AssetEntityType:
      description: The JSON:API type.
      enum:
      - assets
      example: assets
      type: string
      x-enum-varnames:
      - ASSETS
    ObservabilityPipelineEnrichmentTableFileSchemaItems:
      description: Describes a single column and its type in an enrichment table schema.
      properties:
        column:
          description: The `items` `column`.
          example: region
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItemsType'
      required:
      - column
      - type
      type: object
    ObservabilityPipelineNewRelicDestinationType:
      default: new_relic
      description: The destination type. The value should always be `new_relic`.
      enum:
      - new_relic
      example: new_relic
      type: string
      x-enum-varnames:
      - NEW_RELIC
    ExternalUserNameType:
      description: The components of user's real name
      properties:
        formatted:
          description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
          type: string
          example: example_value
      type: object
    HistoricalJobResponseData:
      description: Historical job response data.
      properties:
        attributes:
          $ref: '#/components/schemas/HistoricalJobResponseAttributes'
        id:
          description: ID of the job.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/HistoricalJobDataType'
      type: object
    GCPServiceAccountMeta:
      description: Additional information related to your service account.
      properties:
        accessible_projects:
          description: The current list of projects accessible from your service account.
          items:
            description: List of GCP projects.
            type: string
          type: array
      type: object
    MetricAllTagsResponse:
      description: Response object that includes a single metric's indexed tags.
      properties:
        data:
          $ref: '#/components/schemas/MetricAllTags'
      readOnly: true
      type: object
    SecurityMonitoringRuleCaseCreate:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    ApplicationSecurityWafExclusionFilterAttributes:
      description: Attributes describing a WAF exclusion filter.
      properties:
        description:
          description: A description for the exclusion filter.
          example: Exclude false positives on a path
          type: string
        enabled:
          description: Indicates whether the exclusion filter is enabled.
          example: true
          type: boolean
        event_query:
          description: The event query matched by the legacy exclusion filter. Cannot be created nor updated.
          type: string
          example: avg:system.cpu.user{*}
        ip_list:
          description: The client IP addresses matched by the exclusion filter (CIDR notation is supported).
          items:
            example: 198.51.100.72
            type: string
          type: array
        metadata:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterMetadata'
        on_match:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch'
        parameters:
          description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character.
          items:
            example: list.search.query
            type: string
          type: array
        path_glob:
          description: The HTTP path glob expression matched by the exclusion filter.
          example: /accounts/*
          type: string
        rules_target:
          description: The WAF rules targeted by the exclusion filter.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget'
          type: array
        scope:
          description: The services where the exclusion filter is deployed.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterScope'
          type: array
        search_query:
          description: Generated event search query for traces matching the exclusion filter.
          readOnly: true
          type: string
          example: avg:system.cpu.user{*}
      type: object
    RelationType:
      description: Supported relation types.
      enum:
      - RelationTypeOwns
      - RelationTypeOwnedBy
      - RelationTypeDependsOn
      - RelationTypeDependencyOf
      - RelationTypePartsOf
      - RelationTypeHasPart
      - RelationTypeOtherOwns
      - RelationTypeOtherOwnedBy
      - RelationTypeImplementedBy
      - RelationTypeImplements
      type: string
      x-enum-varnames:
      - RELATIONTYPEOWNS
      - RELATIONTYPEOWNEDBY
      - RELATIONTYPEDEPENDSON
      - RELATIONTYPEDEPENDENCYOF
      - RELATIONTYPEPARTSOF
      - RELATIONTYPEHASPART
      - RELATIONTYPEOTHEROWNS
      - RELATIONTYPEOTHEROWNEDBY
      - RELATIONTYPEIMPLEMENTEDBY
      - RELATIONTYPEIMPLEMENTS
    TagsEventAttribute:
      description: Array of tags associated with your event.
      example:
      - team:A
      items:
        description: Tag associated with your event.
        type: string
      type: array
    RelationResponseData:
      description: Array of relation responses
      items:
        $ref: '#/components/schemas/RelationResponse'
      type: array
    CloudflareAccountsResponse:
      description: The expected response schema when getting Cloudflare accounts.
      properties:
        data:
          description: The JSON:API data schema.
          items:
            $ref: '#/components/schemas/CloudflareAccountResponseData'
          type: array
      type: object
    Budget:
      description: A budget.
      properties:
        attributes:
          $ref: '#/components/schemas/BudgetAttributes'
        id:
          description: The id of the budget.
          type: string
          example: abc-123-def
        type:
          description: The type of the object, must be `budget`.
          type: string
          example: metric alert
      type: object
    AzureUCConfigsResponse:
      description: List of Azure accounts with configs.
      properties:
        data:
          description: An Azure config pair.
          items:
            $ref: '#/components/schemas/AzureUCConfigPair'
          type: array
      type: object
    ApplicationSecurityWafExclusionFilterMetadata:
      description: Extra information about the exclusion filter.
      properties:
        added_at:
          description: The creation date of the exclusion filter.
          format: date-time
          type: string
          example: example_value
        added_by:
          description: The handle of the user who created the exclusion filter.
          type: string
          example: example_value
        added_by_name:
          description: The name of the user who created the exclusion filter.
          type: string
          example: Example Monitor
        modified_at:
          description: The last modification date of the exclusion filter.
          format: date-time
          type: string
          example: example_value
        modified_by:
          description: The handle of the user who last modified the exclusion filter.
          type: string
          example: example_value
        modified_by_name:
          description: The name of the user who last modified the exclusion filter.
          type: string
          example: Example Monitor
      readOnly: true
      type: object
    FastlyAccountsResponse:
      description: The expected response schema when getting Fastly accounts.
      properties:
        data:
          description: The JSON:API data schema.
          items:
            $ref: '#/components/schemas/FastlyAccountResponseData'
          type: array
      type: object
    AuthNMappingsSort:
      description: Sorting options for AuthN Mappings.
      enum:
      - created_at
      - -created_at
      - role_id
      - -role_id
      - saml_assertion_attribute_id
      - -saml_assertion_attribute_id
      - role.name
      - -role.name
      - saml_assertion_attribute.attribute_key
      - -saml_assertion_attribute.attribute_key
      - saml_assertion_attribute.attribute_value
      - -saml_assertion_attribute.attribute_value
      type: string
      x-enum-varnames:
      - CREATED_AT_ASCENDING
      - CREATED_AT_DESCENDING
      - ROLE_ID_ASCENDING
      - ROLE_ID_DESCENDING
      - SAML_ASSERTION_ATTRIBUTE_ID_ASCENDING
      - SAML_ASSERTION_ATTRIBUTE_ID_DESCENDING
      - ROLE_NAME_ASCENDING
      - ROLE_NAME_DESCENDING
      - SAML_ASSERTION_ATTRIBUTE_KEY_ASCENDING
      - SAML_ASSERTION_ATTRIBUTE_KEY_DESCENDING
      - SAML_ASSERTION_ATTRIBUTE_VALUE_ASCENDING
      - SAML_ASSERTION_ATTRIBUTE_VALUE_DESCENDING
    Span:
      description: Object description of a spans after being processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/SpansAttributes'
        id:
          description: Unique ID of the Span.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/SpansType'
      type: object
    ObservabilityPipelineSyslogNgDestination:
      description: The `syslog_ng` destination forwards logs to an external `syslog-ng` server over TCP or UDP using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component.
          example: syslog-ng-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        keepalive:
          description: Optional socket keepalive duration in milliseconds.
          example: 60000
          format: int64
          minimum: 0
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    VulnerabilityRelationships:
      description: Related entities object.
      properties:
        affects:
          $ref: '#/components/schemas/VulnerabilityRelationshipsAffects'
      required:
      - affects
      type: object
    DeviceAttributes:
      description: The device attributes
      properties:
        description:
          description: The device description
          example: a device monitored with NDM
          type: string
        device_type:
          description: The device type
          example: other
          type: string
        integration:
          description: The device integration
          example: snmp
          type: string
        interface_statuses:
          $ref: '#/components/schemas/DeviceAttributesInterfaceStatuses'
        ip_address:
          description: The device IP address
          example: 1.2.3.4
          type: string
        location:
          description: The device location
          example: paris
          type: string
        model:
          description: The device model
          example: xx-123
          type: string
        name:
          description: The device name
          example: example device
          type: string
        os_hostname:
          description: The device OS hostname
          type: string
          example: Example Monitor
        os_name:
          description: The device OS name
          example: example OS
          type: string
        os_version:
          description: The device OS version
          example: 1.0.2
          type: string
        ping_status:
          description: The device ping status
          example: unmonitored
          type: string
        product_name:
          description: The device product name
          example: example device
          type: string
        serial_number:
          description: The device serial number
          example: X12345
          type: string
        status:
          description: The device SNMP status
          example: ok
          type: string
        subnet:
          description: The device subnet
          example: 1.2.3.4/24
          type: string
        sys_object_id:
          description: The device `sys_object_id`
          example: 1.3.6.1.4.1.99999
          type: string
        tags:
          description: The list of device tags
          example:
          - device_ip:1.2.3.4
          - device_id:example:1.2.3.4
          items:
            type: string
          type: array
        vendor:
          description: The device vendor
          example: example vendor
          type: string
        version:
          description: The device version
          example: 1.2.3
          type: string
      type: object
    SlackIntegrationMetadataChannelItem:
      description: Item in the Slack integration metadata channel array.
      properties:
        channel_id:
          description: Slack channel ID.
          example: C0123456789
          type: string
        channel_name:
          description: Name of the Slack channel.
          example: '#example-channel-name'
          type: string
        redirect_url:
          description: URL redirecting to the Slack channel.
          example: https://slack.com/app_redirect?channel=C0123456789&team=T01234567
          type: string
        team_id:
          description: Slack team ID.
          example: T01234567
          type: string
      required:
      - channel_id
      - channel_name
      - redirect_url
      type: object
    ObservabilityPipelineEnrichmentTableFileKeyItems:
      description: Defines how to map log fields to enrichment table columns during lookups.
      properties:
        column:
          description: The `items` `column`.
          example: user_id
          type: string
        comparison:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison'
        field:
          description: The `items` `field`.
          example: log.user.id
          type: string
      required:
      - column
      - comparison
      - field
      type: object
    EntityV3APISpecInterface:
      additionalProperties: false
      description: The API definition.
      oneOf:
      - $ref: '#/components/schemas/EntityV3APISpecInterfaceFileRef'
      - $ref: '#/components/schemas/EntityV3APISpecInterfaceDefinition'
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction:
      description: Action type that redacts part of the sensitive data while preserving a configurable number of characters, typically used for masking purposes (e.g., show last 4 digits of a credit card).
      enum:
      - partial_redact
      example: partial_redact
      type: string
      x-enum-varnames:
      - PARTIAL_REDACT
    Organization:
      description: Organization object.
      properties:
        attributes:
          $ref: '#/components/schemas/OrganizationAttributes'
        id:
          description: ID of the organization.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/OrganizationsType'
      required:
      - type
      type: object
    EntityV3DatadogCodeLocationItem:
      additionalProperties: false
      description: Code location item.
      properties:
        paths:
          description: The paths (glob) to the source code of the service.
          items:
            type: string
          type: array
        repositoryURL:
          description: The repository path of the source code of the entity.
          type: string
          example: https://app.datadoghq.com
      type: object
    Metric:
      description: Object for a single metric tag configuration.
      example:
        id: metric.foo.bar
        type: metrics
      properties:
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricType'
      type: object
    MetricSuggestedTagsAttributes:
      description: Object containing the definition of a metric's actively queried tags and aggregations.
      properties:
        active_aggregations:
          $ref: '#/components/schemas/MetricSuggestedAggregations'
        active_tags:
          description: List of tag keys that have been actively queried.
          example:
          - app
          - datacenter
          items:
            description: Actively queried tag keys.
            type: string
          type: array
      type: object
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    ExternalUserMeta:
      description: Metadata associated with a user.
      properties:
        created:
          description: The date and time the user was created.
          example: '2024-10-17T12:53:35.793Z'
          format: date-time
          type: string
        lastModified:
          description: The date and time the user was last changed.
          example: '2024-10-19T12:53:35.793Z'
          format: date-time
          type: string
        location:
          description: URL identifying the resource.
          example: https://app.datadoghq.com/api/scim/v2/Users/13a95654-b76d-478d-8636-157a7e461d7c
          type: string
        resourceType:
          description: Type of resource.
          example: User
          type: string
      type: object
    ObservabilityPipelineDatadogAgentSource:
      description: The `datadog_agent` source collects logs from the Datadog Agent.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: datadog-agent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSourceType'
      required:
      - id
      - type
      type: object
    RelationshipToUsers:
      description: Relationship to users.
      properties:
        data:
          description: Relationships to user objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToUserData'
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineHttpServerSourceType:
      default: http_server
      description: The source type. The value should always be `http_server`.
      enum:
      - http_server
      example: http_server
      type: string
      x-enum-varnames:
      - HTTP_SERVER
    VulnerabilityCvss:
      description: Vulnerability severities.
      properties:
        base:
          $ref: '#/components/schemas/CVSS'
        datadog:
          $ref: '#/components/schemas/CVSS'
      required:
      - base
      - datadog
      type: object
    OutcomeType:
      default: outcome
      description: The JSON:API type for an outcome.
      enum:
      - outcome
      example: outcome
      type: string
      x-enum-varnames:
      - OUTCOME
    OutcomesResponse:
      description: Scorecard outcomes - the result of a rule for a service.
      properties:
        data:
          $ref: '#/components/schemas/OutcomesResponseData'
        included:
          $ref: '#/components/schemas/OutcomesResponseIncluded'
        links:
          $ref: '#/components/schemas/OutcomesResponseLinks'
      type: object
    ConfluentResourceResponseData:
      description: Confluent Cloud resource data.
      properties:
        attributes:
          $ref: '#/components/schemas/ConfluentResourceResponseAttributes'
        id:
          description: The ID associated with the Confluent resource.
          example: resource_id_abc123
          type: string
        type:
          $ref: '#/components/schemas/ConfluentResourceType'
      required:
      - attributes
      - type
      - id
      type: object
      x-merge-override:
        required: false
    NullableRelationshipToUserData:
      description: Relationship to user object.
      nullable: true
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    AppMeta:
      description: Metadata of an app.
      properties:
        created_at:
          description: Timestamp of when the app was created.
          format: date-time
          type: string
          example: example_value
        deleted_at:
          description: Timestamp of when the app was deleted.
          format: date-time
          type: string
          example: example_value
        org_id:
          description: The Datadog organization ID that owns the app.
          format: int64
          type: integer
          example: 42
        updated_at:
          description: Timestamp of when the app was last updated.
          format: date-time
          type: string
          example: '2026-04-17T12:00:00Z'
        updated_since_deployment:
          description: Whether the app was updated since it was last published. Published apps are pinned to a specific version and do not automatically update when the app is updated.
          type: boolean
          example: true
        user_id:
          description: The ID of the user who created the app.
          format: int64
          type: integer
          example: 42
        user_name:
          description: The name (or email address) of the user who created the app.
          type: string
          example: Example Monitor
        user_uuid:
          description: The UUID of the user who created the app.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        version:
          description: The version number of the app. This starts at 1 and increments with each update.
          format: int64
          type: integer
          example: 42
      type: object
    ListAPIsResponse:
      description: Response for `ListAPIs`.
      properties:
        data:
          description: List of API items.
          items:
            $ref: '#/components/schemas/ListAPIsResponseData'
          type: array
        meta:
          $ref: '#/components/schemas/ListAPIsResponseMeta'
      type: object
    PermissionsType:
      default: permissions
      description: Permissions resource type.
      enum:
      - permissions
      example: permissions
      type: string
      x-enum-varnames:
      - PERMISSIONS
    EntityToSchema:
      description: Entity to detail schema relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipItem'
      type: object
    ApplicationKeyResponseMetaPage:
      description: Additional information related to the application key response.
      properties:
        total_filtered_count:
          description: Total filtered application key count.
          format: int64
          type: integer
          example: 42
      type: object
    SecurityMonitoringSignalRuleType:
      description: The rule type.
      enum:
      - signal_correlation
      type: string
      x-enum-varnames:
      - SIGNAL_CORRELATION
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions:
      description: Options for selecting a predefined library pattern and enabling keyword support.
      properties:
        id:
          description: Identifier for a predefined pattern from the sensitive data scanner pattern library.
          example: credit_card
          type: string
        use_recommended_keywords:
          description: Whether to augment the pattern with recommended keywords (optional).
          type: boolean
          example: true
      required:
      - id
      type: object
    ObservabilityPipelineAmazonS3DestinationStorageClass:
      description: S3 storage class.
      enum:
      - STANDARD
      - REDUCED_REDUNDANCY
      - INTELLIGENT_TIERING
      - STANDARD_IA
      - EXPRESS_ONEZONE
      - ONEZONE_IA
      - GLACIER
      - GLACIER_IR
      - DEEP_ARCHIVE
      example: STANDARD
      type: string
      x-enum-varnames:
      - STANDARD
      - REDUCED_REDUNDANCY
      - INTELLIGENT_TIERING
      - STANDARD_IA
      - EXPRESS_ONEZONE
      - ONEZONE_IA
      - GLACIER
      - GLACIER_IR
      - DEEP_ARCHIVE
    PartialApplicationKey:
      description: Partial Datadog application key.
      properties:
        attributes:
          $ref: '#/components/schemas/PartialApplicationKeyAttributes'
        id:
          description: ID of the application key.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/ApplicationKeyRelationships'
        type:
          $ref: '#/components/schemas/ApplicationKeysType'
      type: object
      x-merge-override:
        required: false
    EventType:
      default: event
      description: Type of the event.
      enum:
      - event
      example: event
      type: string
      x-enum-varnames:
      - EVENT
    Links:
      description: The JSON:API links related to pagination.
      properties:
        first:
          description: First page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=1&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        last:
          description: Last page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=15&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        next:
          description: Next page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=16&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        previous:
          description: Previous page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=14&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        self:
          description: Request link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?filter%5Btool%5D=Infra
          type: string
      required:
      - self
      - first
      - last
      type: object
    ObservabilityPipelineDecoding:
      description: The decoding format used to interpret incoming logs.
      enum:
      - bytes
      - gelf
      - json
      - syslog
      example: json
      type: string
      x-enum-varnames:
      - DECODE_BYTES
      - DECODE_GELF
      - DECODE_JSON
      - DECODE_SYSLOG
    RelationshipItem:
      description: Relationship entry.
      properties:
        id:
          description: Associated data ID.
          type: string
          example: abc-123-def
        type:
          description: Relationship type.
          type: string
          example: metric alert
      type: object
    IncidentTodoAnonymousAssignee:
      description: Anonymous assignee entity.
      properties:
        icon:
          description: URL for assignee's icon.
          example: https://a.slack-edge.com/80588/img/slackbot_48.png
          type: string
        id:
          description: Anonymous assignee's ID.
          example: USLACKBOT
          type: string
        name:
          description: Assignee's name.
          example: Slackbot
          type: string
        source:
          $ref: '#/components/schemas/IncidentTodoAnonymousAssigneeSource'
      required:
      - id
      - icon
      - name
      - source
      type: object
    EntityResponseIncludedRelatedOncallEscalationItem:
      description: Oncall escalation.
      properties:
        email:
          description: Oncall email.
          type: string
          example: user@example.com
        escalationLevel:
          description: Oncall level.
          format: int64
          type: integer
          example: 42
        name:
          description: Oncall name.
          type: string
          example: Example Monitor
      type: object
    EntityV3DatadogCodeLocations:
      additionalProperties: false
      description: Schema for mapping source code locations to an entity.
      items:
        $ref: '#/components/schemas/EntityV3DatadogCodeLocationItem'
      type: array
    CustomCostsFileListResponse:
      description: Response for List Custom Costs files.
      properties:
        data:
          description: List of Custom Costs files.
          items:
            $ref: '#/components/schemas/CustomCostsFileMetadataHighLevel'
          type: array
        meta:
          $ref: '#/components/schemas/CustomCostListResponseMeta'
      type: object
    CIAppEventAttributes:
      description: JSON object containing all event attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from CI Visibility test events.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        tags:
          $ref: '#/components/schemas/TagsEventAttribute'
        test_level:
          $ref: '#/components/schemas/CIAppTestLevel'
      type: object
    IncidentAttachmentAttachmentType:
      description: The type of the incident attachment attributes.
      enum:
      - link
      - postmortem
      example: link
      type: string
      x-enum-varnames:
      - LINK
      - POSTMORTEM
    ListAppsResponseMetaPage:
      description: Information on the total number of apps, to be used for pagination.
      properties:
        totalCount:
          description: The total number of apps under the Datadog organization, disregarding any filters applied.
          format: int64
          type: integer
          example: 42
        totalFilteredCount:
          description: The total number of apps that match the specified filters.
          format: int64
          type: integer
          example: 42
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions:
      description: Configuration for fully redacting sensitive data.
      properties:
        replace:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions` `replace`.
          example: '***'
          type: string
      required:
      - replace
      type: object
    GetInterfacesResponse:
      description: The `GetInterfaces` operation's response.
      properties:
        data:
          description: Get Interfaces response
          items:
            $ref: '#/components/schemas/GetInterfacesData'
          type: array
      type: object
    CIAppSort:
      description: Sort parameters when querying events.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    RuleAttributes:
      description: Details of a rule.
      properties:
        category:
          deprecated: true
          description: The scorecard name to which this rule must belong.
          type: string
          example: example_value
        created_at:
          description: Creation time of the rule outcome.
          format: date-time
          type: string
          example: example_value
        custom:
          description: Defines if the rule is a custom rule.
          type: boolean
          example: true
        description:
          description: Explanation of the rule.
          type: string
          example: example_value
        enabled:
          description: If enabled, the rule is calculated as part of the score.
          example: true
          type: boolean
        modified_at:
          description: Time of the last rule outcome modification.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the rule.
          example: Team Defined
          type: string
        owner:
          description: Owner of the rule.
          type: string
          example: example_value
        scorecard_name:
          description: The scorecard name to which this rule must belong.
          example: Deployments automated via Deployment Trains
          type: string
      type: object
    EntityResponseIncludedOncallType:
      description: Oncall type.
      enum:
      - oncall
      type: string
      x-enum-varnames:
      - ONCALL
    MetricTagConfigurationResponse:
      description: Response object which includes a single metric's tag configuration.
      properties:
        data:
          $ref: '#/components/schemas/MetricTagConfiguration'
      readOnly: true
      type: object
    DashboardListItems:
      description: Dashboards within a list.
      properties:
        dashboards:
          description: List of dashboards in the dashboard list.
          example: []
          items:
            $ref: '#/components/schemas/DashboardListItem'
          type: array
        total:
          description: Number of dashboards in the dashboard list.
          format: int64
          readOnly: true
          type: integer
          example: 42
      required:
      - dashboards
      type: object
    IncidentTypeType:
      default: incident_types
      description: Incident type resource type.
      enum:
      - incident_types
      example: incident_types
      type: string
      x-enum-varnames:
      - INCIDENT_TYPES
    DashboardListAddItemsResponse:
      description: Response containing a list of added dashboards.
      properties:
        added_dashboards_to_list:
          description: List of dashboards added to the dashboard list.
          items:
            $ref: '#/components/schemas/DashboardListItemResponse'
          type: array
      type: object
    IncidentAttachmentData:
      description: A single incident attachment.
      example:
        attributes:
          attachment:
            documentUrl: ''
            title: Postmortem IR-123
          attachment_type: postmortem
        id: 00000000-abcd-0002-0000-000000000000
        relationships:
          last_modified_by_user:
            data:
              id: 00000000-0000-0000-cccc-000000000000
              type: users
        type: incident_attachments
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentAttachmentAttributes'
        id:
          description: A unique identifier that represents the incident attachment.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentAttachmentRelationships'
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - type
      - attributes
      - id
      - relationships
      type: object
    EntityV3APISpec:
      additionalProperties: false
      description: The definition of Entity V3 API Spec object.
      properties:
        implementedBy:
          description: Services which implemented the API.
          items:
            type: string
          type: array
        interface:
          $ref: '#/components/schemas/EntityV3APISpecInterface'
        lifecycle:
          description: The lifecycle state of the component.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the component.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of API.
          type: string
          example: metric alert
      type: object
    FindingEvaluation:
      description: The evaluation of the finding.
      enum:
      - pass
      - fail
      example: pass
      type: string
      x-enum-varnames:
      - PASS
      - FAIL
    RUMWarning:
      description: A warning message indicating something that went wrong with the query.
      properties:
        code:
          description: A unique code for this type of warning.
          example: unknown_index
          type: string
        detail:
          description: A detailed explanation of this specific warning.
          example: 'indexes: foo, bar'
          type: string
        title:
          description: A short human-readable summary of the warning.
          example: One or several indexes are missing or invalid, results hold data from the other indexes
          type: string
      type: object
    IncidentIntegrationMetadataAttributes:
      description: Incident integration metadata's attributes for a create request.
      properties:
        created:
          description: Timestamp when the incident todo was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        incident_id:
          description: UUID of the incident this integration metadata is connected to.
          example: 00000000-aaaa-0000-0000-000000000000
          type: string
        integration_type:
          description: 'A number indicating the type of integration this metadata is for. 1 indicates Slack;

            8 indicates Jira.'
          example: 1
          format: int32
          maximum: 9
          type: integer
        metadata:
          $ref: '#/components/schemas/IncidentIntegrationMetadataMetadata'
        modified:
          description: Timestamp when the incident todo was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        status:
          description: 'A number indicating the status of this integration metadata. 0 indicates unknown;

            1 indicates pending; 2 indicates complete; 3 indicates manually created;

            4 indicates manually updated; 5 indicates failed.'
          format: int32
          maximum: 5
          type: integer
          example: 42
      required:
      - integration_type
      - metadata
      type: object
    SensitiveDataScannerGroup:
      description: A scanning group.
      properties:
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    Advisory:
      description: Advisory.
      properties:
        base_severity:
          description: Advisory base severity.
          example: Critical
          type: string
        id:
          description: Advisory id.
          example: GHSA-4wrc-f8pq-fpqp
          type: string
        severity:
          description: Advisory Datadog severity.
          example: Medium
          type: string
      required:
      - id
      - base_severity
      type: object
    ObservabilityPipelineConfigDestinationItem:
      description: A destination for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Destination'
      - $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestination'
      - $ref: '#/components/schemas/AzureStorageDestination'
      - $ref: '#/components/schemas/MicrosoftSentinelDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
    MetricVolumesResponse:
      description: Response object which includes a single metric's volume.
      properties:
        data:
          $ref: '#/components/schemas/MetricVolumes'
      readOnly: true
      type: object
    IncidentServiceResponseData:
      description: Incident Service data from responses.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentServiceResponseAttributes'
        id:
          description: The incident service's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentServiceRelationships'
        type:
          $ref: '#/components/schemas/IncidentServiceType'
      required:
      - id
      - type
      type: object
    OutcomesResponseIncludedItem:
      description: Attributes of the included rule.
      properties:
        attributes:
          $ref: '#/components/schemas/OutcomesResponseIncludedRuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    DevicesListData:
      description: The devices list data
      properties:
        attributes:
          $ref: '#/components/schemas/DeviceAttributes'
        id:
          description: The device ID
          example: example:1.2.3.4
          type: string
        type:
          description: The type of the resource. The value should always be device.
          type: string
          example: metric alert
      type: object
    AWSAccountTags:
      description: Tags to apply to all hosts and metrics reporting for this account. Defaults to `[]`.
      items:
        description: Tag in the form `key:value`.
        example: env:prod
        type: string
      nullable: true
      type: array
    EntityV3DatastoreSpec:
      additionalProperties: false
      description: The definition of Entity V3 Datastore Spec object.
      properties:
        componentOf:
          description: A list of components the datastore is a part of
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the datastore.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the datastore.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of datastore.
          type: string
          example: metric alert
      type: object
    AWSAuthConfigRole:
      description: AWS Authentication config to integrate your account using an IAM role.
      properties:
        external_id:
          description: AWS IAM External ID for associated role.
          type: string
          example: abc-123-def
        role_name:
          description: AWS IAM Role name.
          example: DatadogIntegrationRole
          maxLength: 576
          minLength: 1
          type: string
      required:
      - role_name
      type: object
    ObservabilityPipelineGoogleCloudStorageDestination:
      description: 'The `google_cloud_storage` destination stores logs in a Google Cloud Storage (GCS) bucket.

        It requires a bucket name, GCP authentication, and metadata fields.

        '
      properties:
        acl:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationAcl'
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        bucket:
          description: Name of the GCS bucket.
          example: error-logs
          type: string
        id:
          description: Unique identifier for the destination component.
          example: gcs-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        key_prefix:
          description: Optional prefix for object keys within the GCS bucket.
          type: string
          example: example_value
        metadata:
          description: Custom metadata to attach to each object uploaded to the GCS bucket.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineMetadataEntry'
          type: array
        storage_class:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationStorageClass'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - bucket
      - auth
      - storage_class
      - acl
      type: object
    SecurityMonitoringRuleTypeRead:
      description: The rule type.
      enum:
      - log_detection
      - infrastructure_configuration
      - workload_security
      - cloud_configuration
      - application_security
      type: string
      x-enum-varnames:
      - LOG_DETECTION
      - INFRASTRUCTURE_CONFIGURATION
      - WORKLOAD_SECURITY
      - CLOUD_CONFIGURATION
      - APPLICATION_SECURITY
    IncidentTeamType:
      default: teams
      description: Incident Team resource type.
      enum:
      - teams
      example: teams
      type: string
      x-enum-varnames:
      - TEAMS
    BudgetArray:
      description: An array of budgets.
      example:
        data:
        - attributes:
            created_at: 1741011342772
            created_by: user1
            end_month: 202502
            metrics_query: aws.cost.amortized{service:ec2} by {service}
            name: my budget
            org_id: 123
            start_month: 202501
            total_amount: 1000
            updated_at: 1741011342772
            updated_by: user2
          id: 00000000-0a0a-0a0a-aaa0-00000000000a
          type: budget
      properties:
        data:
          description: The `BudgetArray` `data`.
          items:
            $ref: '#/components/schemas/Budget'
          type: array
      type: object
    ObservabilityPipelineConfigSourceItem:
      description: A data source for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineKafkaSource'
      - $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSource'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Source'
      - $ref: '#/components/schemas/ObservabilityPipelineFluentdSource'
      - $ref: '#/components/schemas/ObservabilityPipelineFluentBitSource'
      - $ref: '#/components/schemas/ObservabilityPipelineHttpServerSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSource'
      - $ref: '#/components/schemas/ObservabilityPipelineRsyslogSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSource'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSource'
      - $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource'
      - $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource'
      - $ref: '#/components/schemas/ObservabilityPipelineLogstashSource'
    ListEntityCatalogResponseLinks:
      description: List entity response links.
      properties:
        next:
          description: Next link.
          type: string
          example: example_value
        previous:
          description: Previous link.
          type: string
          example: example_value
        self:
          description: Current link.
          type: string
          example: example_value
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorAction:
      description: Defines what action to take when sensitive data is matched.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedact'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHash'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact'
    ObservabilityPipelineNewRelicDestination:
      description: The `new_relic` destination sends logs to the New Relic platform.
      properties:
        id:
          description: The unique identifier for this component.
          example: new-relic-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        region:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationType'
      required:
      - id
      - type
      - inputs
      - region
      type: object
    ObservabilityPipelineHttpServerSourceAuthStrategy:
      description: HTTP authentication method.
      enum:
      - none
      - plain
      example: plain
      type: string
      x-enum-varnames:
      - NONE
      - PLAIN
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern:
      description: Defines a custom regex-based pattern for identifying sensitive data in logs.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType'
      required:
      - type
      - options
      type: object
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    ObservabilityPipelineFluentdSource:
      description: The `fluentd` source ingests logs from a Fluentd-compatible service.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentdSourceType'
      required:
      - id
      - type
      type: object
    ApplicationSecurityWafCustomRuleAction:
      description: The definition of `ApplicationSecurityWafCustomRuleAction` object.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionAction'
        parameters:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters'
      type: object
    ObservabilityPipelineFluentBitSource:
      description: The `fluent_bit` source ingests logs from Fluent Bit.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentBitSourceType'
      required:
      - id
      - type
      type: object
    AssetRisks:
      description: Asset risks.
      properties:
        has_access_to_sensitive_data:
          description: Whether the asset has access to sensitive data or not.
          example: false
          type: boolean
        has_privileged_access:
          description: Whether the asset has privileged access or not.
          example: false
          type: boolean
        in_production:
          description: Whether the asset is in production or not.
          example: false
          type: boolean
        is_publicly_accessible:
          description: Whether the asset is publicly accessible or not.
          example: false
          type: boolean
        under_attack:
          description: Whether the asset is under attack or not.
          example: false
          type: boolean
      required:
      - in_production
      type: object
    IncidentIntegrationRelationships:
      description: The incident's integration relationships from a response.
      properties:
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    RestrictionQueryRole:
      description: Partial role object.
      properties:
        attributes:
          $ref: '#/components/schemas/RestrictionQueryRoleAttribute'
        id:
          description: ID of the role.
          example: <ROLE_ID>
          type: string
        type:
          default: roles
          description: Role resource type.
          example: roles
          readOnly: true
          type: string
      type: object
    OutcomesResponseIncluded:
      description: Array of rule details.
      items:
        $ref: '#/components/schemas/OutcomesResponseIncludedItem'
      type: array
    InterfaceAttributesStatus:
      description: The interface status
      enum:
      - up
      - down
      - warning
      - 'off'
      example: up
      type: string
      x-enum-varnames:
      - UP
      - DOWN
      - WARNING
      - 'OFF'
    EntityV3DatadogLogItem:
      additionalProperties: false
      description: Log association item.
      properties:
        name:
          description: The name of the query.
          type: string
          example: Example Monitor
        query:
          description: The query to run.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    AWSLogsConfig:
      description: AWS Logs Collection config.
      properties:
        lambda_forwarder:
          $ref: '#/components/schemas/AWSLambdaForwarderConfig'
      type: object
    RelationshipToSAMLAssertionAttributeData:
      description: Data of AuthN Mapping relationship to SAML Assertion Attribute.
      properties:
        id:
          description: The ID of the SAML assertion attribute.
          example: '0'
          type: string
        type:
          $ref: '#/components/schemas/SAMLAssertionAttributesType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    MetricCustomAggregation:
      description: A time and space aggregation combination for use in query.
      example:
        space: sum
        time: sum
      properties:
        space:
          $ref: '#/components/schemas/MetricCustomSpaceAggregation'
        time:
          $ref: '#/components/schemas/MetricCustomTimeAggregation'
      required:
      - time
      - space
      type: object
    UserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        created_at:
          description: Creation time of the user.
          format: date-time
          type: string
          example: example_value
        disabled:
          description: Whether the user is disabled.
          type: boolean
          example: true
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        mfa_enabled:
          description: If user has MFA enabled.
          readOnly: true
          type: boolean
          example: true
        modified_at:
          description: Time that the user was last modified.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        service_account:
          description: Whether the user is a service account.
          type: boolean
          example: true
        status:
          description: Status of the user.
          type: string
          example: OK
        title:
          description: Title of the user.
          nullable: true
          type: string
          example: Example Monitor
        verified:
          description: Whether the user is verified.
          type: boolean
          example: true
      type: object
    MetricVolumes:
      description: Possible response objects for a metric's volume.
      oneOf:
      - $ref: '#/components/schemas/MetricDistinctVolume'
      - $ref: '#/components/schemas/MetricIngestedIndexedVolume'
    SensitiveDataScannerTextReplacementType:
      default: none
      description: 'Type of the replacement text. None means no replacement.

        hash means the data will be stubbed. replacement_string means that

        one can chose a text to replace the data. partial_replacement_from_beginning

        allows a user to partially replace the data from the beginning, and

        partial_replacement_from_end on the other hand, allows to replace data from

        the end.'
      enum:
      - none
      - hash
      - replacement_string
      - partial_replacement_from_beginning
      - partial_replacement_from_end
      type: string
      x-enum-varnames:
      - NONE
      - HASH
      - REPLACEMENT_STRING
      - PARTIAL_REPLACEMENT_FROM_BEGINNING
      - PARTIAL_REPLACEMENT_FROM_END
    ListAPIsResponseMeta:
      description: Metadata for `ListAPIsResponse`.
      properties:
        pagination:
          $ref: '#/components/schemas/ListAPIsResponseMetaPagination'
      type: object
    ApplicationSecurityWafCustomRuleConditionParameters:
      description: The scope of the WAF custom rule.
      properties:
        data:
          description: Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.
          example: blocked_users
          type: string
        inputs:
          description: List of inputs on which at least one should match with the given operator.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput'
          type: array
        list:
          description: 'List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and

            !exact_match operator.'
          items:
            type: string
          type: array
        options:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions'
        regex:
          description: Regex to use with the condition. Only used with match_regex and !match_regex operator.
          example: path.*
          type: string
        value:
          description: Store the captured value in the specified tag name. Only used with the capture_data operator.
          example: custom_tag
          type: string
      required:
      - inputs
      type: object
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    SecurityMonitoringRuleResponse:
      description: Create a new rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
    IncidentType:
      default: incidents
      description: Incident resource type.
      enum:
      - incidents
      example: incidents
      type: string
      x-enum-varnames:
      - INCIDENTS
    ListTagsResponseData:
      description: The list tags response data.
      properties:
        attributes:
          $ref: '#/components/schemas/ListTagsResponseDataAttributes'
        id:
          description: The device ID
          example: example:1.2.3.4
          type: string
        type:
          description: The type of the resource. The value should always be tags.
          type: string
          example: metric alert
      type: object
    NotificationRuleAttributes:
      description: Attributes of the notification rule.
      properties:
        created_at:
          $ref: '#/components/schemas/Date'
        created_by:
          $ref: '#/components/schemas/RuleUser'
        enabled:
          $ref: '#/components/schemas/Enabled'
        modified_at:
          $ref: '#/components/schemas/Date'
        modified_by:
          $ref: '#/components/schemas/RuleUser'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
        version:
          $ref: '#/components/schemas/Version'
      required:
      - created_at
      - created_by
      - enabled
      - modified_at
      - modified_by
      - name
      - selectors
      - targets
      - version
      type: object
    SensitiveDataScannerIncludedKeywordConfiguration:
      description: 'Object defining a set of keywords and a number of characters that help reduce noise.

        You can provide a list of keywords you would like to check within a defined proximity of the matching pattern.

        If any of the keywords are found within the proximity check, the match is kept.

        If none are found, the match is discarded.'
      properties:
        character_count:
          description: 'The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined.

            `character_count` should be greater than the maximum length of a keyword defined for a rule.'
          example: 30
          format: int64
          maximum: 50
          minimum: 1
          type: integer
        keywords:
          description: 'Keyword list that will be checked during scanning in order to validate a match.

            The number of keywords in the list must be less than or equal to 30.'
          example:
          - credit card
          - cc
          items:
            type: string
          type: array
        use_recommended_keywords:
          description: 'Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied

            to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied.'
          type: boolean
          example: true
      required:
      - keywords
      - character_count
      type: object
    EntityV3DatadogIntegrationOpsgenie:
      additionalProperties: false
      description: An Opsgenie integration schema.
      properties:
        region:
          description: The region for the Opsgenie integration.
          minLength: 1
          type: string
          example: example_value
        serviceURL:
          description: The service URL for the Opsgenie integration.
          example: https://www.opsgenie.com/service/shopping-cart
          minLength: 1
          type: string
      required:
      - serviceURL
      type: object
    AzureStorageDestination:
      description: The `azure_storage` destination forwards logs to an Azure Blob Storage container.
      properties:
        blob_prefix:
          description: Optional prefix for blobs written to the container.
          example: logs/
          type: string
        container_name:
          description: The name of the Azure Blob Storage container to store logs in.
          example: my-log-container
          type: string
        id:
          description: The unique identifier for this component.
          example: azure-storage-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - processor-id
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/AzureStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - container_name
      type: object
    EntityResponseIncludedRelatedOncallEscalations:
      description: Oncall escalations.
      items:
        $ref: '#/components/schemas/EntityResponseIncludedRelatedOncallEscalationItem'
      type: array
    IncidentIntegrationMetadataResponseData:
      description: Incident integration metadata from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes'
        id:
          description: The incident integration metadata's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentIntegrationRelationships'
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
    CIAppTestEvent:
      description: Object description of test event after being processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/CIAppEventAttributes'
        id:
          description: Unique ID of the event.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/CIAppTestEventTypeName'
      type: object
    IncidentAttachmentType:
      default: incident_attachments
      description: The incident attachment resource type.
      enum:
      - incident_attachments
      example: incident_attachments
      type: string
      x-enum-varnames:
      - INCIDENT_ATTACHMENTS
    IncidentUserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        uuid:
          description: UUID of the user.
          type: string
          example: abc-123-def
      type: object
    MetricIngestedIndexedVolume:
      description: Object for a single metric's ingested and indexed volume.
      properties:
        attributes:
          $ref: '#/components/schemas/MetricIngestedIndexedVolumeAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricIngestedIndexedVolumeType'
      type: object
    SpansSort:
      description: Sort parameters when querying spans.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    ListApplicationKeysResponse:
      description: Response for a list of application keys.
      properties:
        data:
          description: Array of application keys.
          items:
            $ref: '#/components/schemas/PartialApplicationKey'
          type: array
        included:
          description: Array of objects related to the application key.
          items:
            $ref: '#/components/schemas/ApplicationKeyResponseIncludedItem'
          type: array
        meta:
          $ref: '#/components/schemas/ApplicationKeyResponseMeta'
      type: object
    BudgetAttributes:
      description: The attributes of a budget.
      properties:
        created_at:
          description: The timestamp when the budget was created.
          example: 1738258683590
          format: int64
          type: integer
        created_by:
          description: The id of the user that created the budget.
          example: 00000000-0a0a-0a0a-aaa0-00000000000a
          type: string
        end_month:
          description: The month when the budget ends.
          example: 202502
          format: int64
          type: integer
        entries:
          description: The entries of the budget.
          items:
            $ref: '#/components/schemas/BudgetEntry'
          type: array
        metrics_query:
          description: The cost query used to track against the budget.
          example: aws.cost.amortized{service:ec2} by {service}
          type: string
        name:
          description: The name of the budget.
          example: my budget
          type: string
        org_id:
          description: The id of the org the budget belongs to.
          example: 123
          format: int64
          type: integer
        start_month:
          description: The month when the budget starts.
          example: 202501
          format: int64
          type: integer
        total_amount:
          description: The sum of all budget entries' amounts.
          example: 1000
          format: double
          type: number
        updated_at:
          description: The timestamp when the budget was last updated.
          example: 1738258683590
          format: int64
          type: integer
        updated_by:
          description: The id of the user that created the budget.
          example: 00000000-0a0a-0a0a-aaa0-00000000000a
          type: string
      type: object
    ApplicationSecurityWafCustomRuleCondition:
      description: One condition of the WAF Custom Rule.
      properties:
        operator:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator'
        parameters:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters'
      required:
      - operator
      - parameters
      type: object
    RoleAttributes:
      description: Attributes of the role.
      properties:
        created_at:
          description: Creation time of the role.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified_at:
          description: Time of last role modification.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: The name of the role. The name is neither unique nor a stable identifier of the role.
          type: string
          example: Example Monitor
        user_count:
          description: Number of users with that role.
          format: int64
          readOnly: true
          type: integer
          example: 42
      type: object
    ObservabilityPipelineHttpServerSource:
      description: The `http_server` source collects logs over HTTP POST from external services.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: Unique ID for the HTTP server source.
          example: http-server-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType'
      required:
      - id
      - type
      - auth_strategy
      - decoding
      type: object
    OktaAccountType:
      default: okta-accounts
      description: Account type for an Okta account.
      enum:
      - okta-accounts
      example: okta-accounts
      type: string
      x-enum-varnames:
      - OKTA_ACCOUNTS
    SensitiveDataScannerGetConfigIncludedItem:
      description: An object related to the configuration.
      oneOf:
      - $ref: '#/components/schemas/SensitiveDataScannerRuleIncludedItem'
      - $ref: '#/components/schemas/SensitiveDataScannerGroupIncludedItem'
    IncidentAttachmentsResponse:
      description: The response object containing an incident's attachments.
      properties:
        data:
          description: An array of incident attachments.
          example:
          - attributes:
              attachment:
                documentUrl: ''
                title: Postmortem IR-123
              attachment_type: postmortem
            id: 00000000-abcd-0002-0000-000000000000
            relationships:
              last_modified_by_user:
                data:
                  id: 00000000-0000-0000-cccc-000000000000
                  type: users
            type: incident_attachments
          items:
            $ref: '#/components/schemas/IncidentAttachmentData'
          type: array
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentAttachmentsResponseIncludedItem'
          type: array
      required:
      - data
      type: object
    User:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/UserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/UserResponseRelationships'
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineOpenSearchDestinationType:
      default: opensearch
      description: The destination type. The value should always be `opensearch`.
      enum:
      - opensearch
      example: opensearch
      type: string
      x-enum-varnames:
      - OPENSEARCH
    EntityV3DatastoreKind:
      description: The definition of Entity V3 Datastore Kind object.
      enum:
      - datastore
      example: datastore
      type: string
      x-enum-varnames:
      - DATASTORE
    DashboardListItem:
      description: A dashboard within a list.
      properties:
        author:
          $ref: '#/components/schemas/Creator'
        created:
          description: Date of creation of the dashboard.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        icon:
          description: URL to the icon of the dashboard.
          nullable: true
          readOnly: true
          type: string
          example: example_value
        id:
          description: ID of the dashboard.
          example: q5j-nti-fv6
          type: string
        integration_id:
          description: The short name of the integration.
          nullable: true
          readOnly: true
          type: string
          example: abc-123-def
        is_favorite:
          description: Whether or not the dashboard is in the favorites.
          readOnly: true
          type: boolean
          example: true
        is_read_only:
          description: Whether or not the dashboard is read only.
          readOnly: true
          type: boolean
          example: true
        is_shared:
          description: Whether the dashboard is publicly shared or not.
          readOnly: true
          type: boolean
          example: true
        modified:
          description: Date of last edition of the dashboard.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        popularity:
          description: Popularity of the dashboard.
          format: int32
          maximum: 5
          readOnly: true
          type: integer
          example: 42
        tags:
          description: List of team names representing ownership of a dashboard.
          items:
            description: The name of a Datadog team, formatted as `team:<name>`
            type: string
          maxItems: 5
          nullable: true
          readOnly: true
          type: array
        title:
          description: Title of the dashboard.
          readOnly: true
          type: string
          example: Example Monitor
        type:
          $ref: '#/components/schemas/DashboardType'
        url:
          description: URL path to the dashboard.
          readOnly: true
          type: string
          example: https://app.datadoghq.com
      required:
      - type
      - id
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessor:
      description: The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log events.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sensitive-scanner
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: source:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        rules:
          description: A list of rules for identifying and acting on sensitive data patterns.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    AuthNMapping:
      description: The AuthN Mapping object returned by API.
      properties:
        attributes:
          $ref: '#/components/schemas/AuthNMappingAttributes'
        id:
          description: ID of the AuthN Mapping.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        relationships:
          $ref: '#/components/schemas/AuthNMappingRelationships'
        type:
          $ref: '#/components/schemas/AuthNMappingsType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    RelationshipToIncidentAttachment:
      description: A relationship reference for attachments.
      properties:
        data:
          description: An array of incident attachments.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentAttachmentData'
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineDatadogLogsDestinationType:
      default: datadog_logs
      description: The destination type. The value should always be `datadog_logs`.
      enum:
      - datadog_logs
      example: datadog_logs
      type: string
      x-enum-varnames:
      - DATADOG_LOGS
    ObservabilityPipelineSensitiveDataScannerProcessorType:
      default: sensitive_data_scanner
      description: The processor type. The value should always be `sensitive_data_scanner`.
      enum:
      - sensitive_data_scanner
      example: sensitive_data_scanner
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER
    ObservabilityPipelineKafkaSourceSasl:
      description: Specifies the SASL mechanism for authenticating with a Kafka cluster.
      properties:
        mechanism:
          $ref: '#/components/schemas/ObservabilityPipelinePipelineKafkaSourceSaslMechanism'
      type: object
    ObservabilityPipelineSplunkHecDestination:
      description: 'The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC).

        '
      properties:
        auto_extract_timestamp:
          description: 'If `true`, Splunk tries to extract timestamps from incoming log events.

            If `false`, Splunk assigns the time the event was received.

            '
          example: true
          type: boolean
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-hec-destination
          type: string
        index:
          description: Optional name of the Splunk index where logs are written.
          example: main
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        sourcetype:
          description: The Splunk sourcetype to assign to log events.
          example: custom_sourcetype
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    EntityResponseIncludedRelatedEntity:
      description: Included related entity.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityResponseIncludedRelatedEntityAttributes'
        id:
          description: Entity UUID.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/EntityResponseIncludedRelatedEntityMeta'
        type:
          $ref: '#/components/schemas/EntityResponseIncludedRelatedEntityType'
      type: object
    EntityV3Integrations:
      additionalProperties: false
      description: A base schema for defining third-party integrations.
      properties:
        opsgenie:
          $ref: '#/components/schemas/EntityV3DatadogIntegrationOpsgenie'
        pagerduty:
          $ref: '#/components/schemas/EntityV3DatadogIntegrationPagerduty'
      type: object
    CustomCostsUser:
      description: Metadata of the user that has uploaded the Custom Costs file.
      properties:
        email:
          description: The name of the Custom Costs file.
          example: email.test@datadohq.com
          type: string
        icon:
          description: The name of the Custom Costs file.
          example: icon.png
          type: string
        name:
          description: Name of the user.
          example: Test User
          type: string
      type: object
    IncidentFieldAttributesValueType:
      default: multiselect
      description: Type of the multiple value field definitions.
      enum:
      - multiselect
      - textarray
      - metrictag
      - autocomplete
      example: multiselect
      type: string
      x-enum-varnames:
      - MULTISELECT
      - TEXTARRAY
      - METRICTAG
      - AUTOCOMPLETE
    RelationshipToIncidentIntegrationMetadatas:
      description: A relationship reference for multiple integration metadata objects.
      example:
        data:
        - id: 00000000-abcd-0005-0000-000000000000
          type: incident_integrations
        - id: 00000000-abcd-0006-0000-000000000000
          type: incident_integrations
      properties:
        data:
          description: Integration metadata relationship array
          example:
          - id: 00000000-abcd-0003-0000-000000000000
            type: incident_integrations
          - id: 00000000-abcd-0004-0000-000000000000
            type: incident_integrations
          items:
            $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadataData'
          type: array
      required:
      - data
      type: object
    IncidentServiceRelationships:
      description: The incident service's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    SecurityMonitoringRuleHardcodedEvaluatorType:
      description: Hardcoded evaluator type.
      enum:
      - log4shell
      type: string
      x-enum-varnames:
      - LOG4SHELL
    RelationshipToUserData:
      description: Relationship to user object.
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    ObservabilityPipelineGooglePubSubSourceType:
      default: google_pubsub
      description: The source type. The value should always be `google_pubsub`.
      enum:
      - google_pubsub
      example: google_pubsub
      type: string
      x-enum-varnames:
      - GOOGLE_PUBSUB
    GCPMetricNamespaceConfig:
      description: Configuration for a GCP metric namespace.
      properties:
        disabled:
          default: false
          description: When disabled, Datadog does not collect metrics that are related to this GCP metric namespace.
          example: true
          type: boolean
        id:
          description: The id of the GCP metric namespace.
          example: aiplatform
          type: string
      type: object
    AppDefinitionType:
      default: appDefinitions
      description: The app definition type.
      enum:
      - appDefinitions
      example: appDefinitions
      type: string
      x-enum-varnames:
      - APPDEFINITIONS
    CustomCostsFileUsageChargePeriod:
      description: Usage charge period of a Custom Costs file.
      properties:
        end:
          description: End of the usage of the Custom Costs file.
          example: 1706745600000
          format: double
          type: number
        start:
          description: Start of the usage of the Custom Costs file.
          example: 1704067200000
          format: double
          type: number
      type: object
    IncidentTodoAssignee:
      description: A todo assignee.
      example: '@test.user@test.com'
      oneOf:
      - $ref: '#/components/schemas/IncidentTodoAssigneeHandle'
      - $ref: '#/components/schemas/IncidentTodoAnonymousAssignee'
    ListDevicesResponse:
      description: List devices response.
      properties:
        data:
          description: The list devices response data.
          items:
            $ref: '#/components/schemas/DevicesListData'
          type: array
        meta:
          $ref: '#/components/schemas/ListDevicesResponseMetadata'
      type: object
    IncidentTodoAssigneeArray:
      description: Array of todo assignees.
      example:
      - '@test.user@test.com'
      items:
        $ref: '#/components/schemas/IncidentTodoAssignee'
      type: array
    ResourceFilterRequestType:
      description: Constant string to identify the request type.
      enum:
      - csm_resource_filter
      example: csm_resource_filter
      type: string
      x-enum-varnames:
      - CSM_RESOURCE_FILTER
    IncidentAttachmentLinkAttributes:
      description: The attributes object for a link attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType'
        modified:
          description: Timestamp when the incident attachment link was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - attachment_type
      - attachment
      type: object
    AuditLogsWarning:
      description: Warning message indicating something that went wrong with the query.
      properties:
        code:
          description: Unique code for this type of warning.
          example: unknown_index
          type: string
        detail:
          description: Detailed explanation of this specific warning.
          example: 'indexes: foo, bar'
          type: string
        title:
          description: Short human-readable summary of the warning.
          example: One or several indexes are missing or invalid, results hold data from the other indexes
          type: string
      type: object
    ConfluentAccountResponseData:
      description: An API key and API secret pair that represents a Confluent account.
      properties:
        attributes:
          $ref: '#/components/schemas/ConfluentAccountResponseAttributes'
        id:
          description: A randomly generated ID associated with a Confluent account.
          example: account_id_abc123
          type: string
        type:
          $ref: '#/components/schemas/ConfluentAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    SpansResponseMetadataPage:
      description: Paging attributes.
      properties:
        after:
          description: 'The cursor to use to get the next results, if any. To make the next request, use the same

            parameters with the addition of the `page[cursor]`.'
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    EmailTypeType:
      description: The type of email.
      enum:
      - work
      type: string
      x-enum-varnames:
      - WORK
    RelationEntity:
      description: Relation entity reference.
      properties:
        kind:
          description: Entity kind.
          type: string
          example: example_value
        name:
          description: Entity name.
          type: string
          example: Example Monitor
        namespace:
          description: Entity namespace.
          type: string
          example: Example Monitor
      type: object
    ObservabilityPipelineGenerateMetricsProcessor:
      description: 'The `generate_datadog_metrics` processor creates custom metrics from logs and sends them to Datadog.

        Metrics can be counters, gauges, or distributions and optionally grouped by log fields.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline.
          example: generate-metrics-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this processor.
          example:
          - source-id
          items:
            type: string
          type: array
        metrics:
          description: Configuration for generating individual metrics.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetric'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessorType'
      required:
      - id
      - type
      - inputs
      - include
      - metrics
      type: object
    ListRelationCatalogResponseLinks:
      description: List relation response links.
      properties:
        next:
          description: Next link.
          example: /api/v2/catalog/relation?filter[from_ref]=service:service-catalog&include=entity&page[limit]=2&page[offset]=2
          type: string
        previous:
          description: Previous link.
          type: string
          example: example_value
        self:
          description: Current link.
          example: /api/v2/catalog/relation?filter[from_ref]=service:service-catalog&include=entity&page[limit]=2&page[offset]=0
          type: string
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact:
      description: Configuration for partially redacting matched sensitive data.
      properties:
        action:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction'
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions'
      required:
      - action
      - options
      type: object
    AssetOperatingSystem:
      description: Asset operating system.
      properties:
        description:
          description: Operating system version.
          example: '24.04'
          type: string
        name:
          description: Operating system name.
          example: ubuntu
          type: string
      required:
      - name
      type: object
    EntityMeta:
      description: Entity metadata.
      properties:
        createdAt:
          description: The creation time.
          type: string
          example: example_value
        ingestionSource:
          description: The ingestion source.
          type: string
          example: example_value
        modifiedAt:
          description: The modification time.
          type: string
          example: example_value
        origin:
          description: The origin.
          type: string
          example: example_value
      type: object
    FindingTags:
      description: The tags associated with this finding.
      example:
      - cloud_provider:aws
      - myTag:myValue
      items:
        description: The list of tags.
        type: string
      type: array
    Remediation:
      description: Vulnerability remediation.
      properties:
        auto_solvable:
          description: Whether the vulnerability can be resolved when recompiling the package or not.
          example: false
          type: boolean
        avoided_advisories:
          description: Avoided advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        fixed_advisories:
          description: Remediation fixed advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        library_name:
          description: Library name remediating the vulnerability.
          example: stdlib
          type: string
        library_version:
          description: Library version remediating the vulnerability.
          example: Upgrade to a version >= 1.20.0
          type: string
        new_advisories:
          description: New advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        remaining_advisories:
          description: Remaining advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        type:
          description: Remediation type.
          example: text
          type: string
      required:
      - type
      - library_name
      - library_version
      - auto_solvable
      - fixed_advisories
      - remaining_advisories
      - new_advisories
      - avoided_advisories
      type: object
    CIAppTestEventsResponse:
      description: Response object with all test events matching the request and pagination information.
      properties:
        data:
          description: Array of events matching the request.
          items:
            $ref: '#/components/schemas/CIAppTestEvent'
          type: array
        links:
          $ref: '#/components/schemas/CIAppResponseLinks'
        meta:
          $ref: '#/components/schemas/CIAppResponseMetadataWithPagination'
      type: object
    ObservabilityPipelineSumoLogicDestination:
      description: The `sumo_logic` destination forwards logs to Sumo Logic.
      properties:
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationEncoding'
        header_custom_fields:
          description: A list of custom headers to include in the request to Sumo Logic.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem'
          type: array
        header_host_name:
          description: Optional override for the host name header.
          example: host-123
          type: string
        header_source_category:
          description: Optional override for the source category header.
          example: source-category
          type: string
        header_source_name:
          description: Optional override for the source name header.
          example: source-name
          type: string
        id:
          description: The unique identifier for this component.
          example: sumo-logic-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    IncidentUserData:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentUserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    ObservabilityPipelineMetricValue:
      description: Specifies how the value of the generated metric is computed.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOne'
      - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByField'
    EntityResponseIncludedSchemaAttributes:
      description: Included schema.
      properties:
        schema:
          $ref: '#/components/schemas/EntityV3'
      type: object
    IncidentResponseData:
      description: Incident data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentResponseAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentResponseRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    RuleOutcomeRelationships:
      description: The JSON:API relationship to a scorecard rule.
      properties:
        rule:
          $ref: '#/components/schemas/RelationshipToOutcome'
      type: object
    ObservabilityPipelineQuotaProcessorOverride:
      description: Defines a custom quota limit that applies to specific log events based on matching field values.
      properties:
        fields:
          description: A list of field matchers used to apply a specific override. If an event matches all listed key-value pairs, the corresponding override limit is enforced.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineFieldValue'
          type: array
        limit:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit'
      required:
      - fields
      - limit
      type: object
    SensitiveDataScannerConfigurationType:
      default: sensitive_data_scanner_configuration
      description: Sensitive Data Scanner configuration type.
      enum:
      - sensitive_data_scanner_configuration
      example: sensitive_data_scanner_configuration
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_CONFIGURATIONS
    SAMLAssertionAttribute:
      description: SAML assertion attribute.
      properties:
        attributes:
          $ref: '#/components/schemas/SAMLAssertionAttributeAttributes'
        id:
          description: The ID of the SAML assertion attribute.
          example: '0'
          type: string
        type:
          $ref: '#/components/schemas/SAMLAssertionAttributesType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    MetricsAndMetricTagConfigurationsResponse:
      description: Response object that includes metrics and metric tag configurations.
      properties:
        data:
          description: Array of metrics and metric tag configurations.
          items:
            $ref: '#/components/schemas/MetricsAndMetricTagConfigurations'
          type: array
        links:
          $ref: '#/components/schemas/MetricsListResponseLinks'
        meta:
          $ref: '#/components/schemas/MetricPaginationMeta'
      readOnly: true
      type: object
    EntityV3DatadogPerformance:
      additionalProperties: false
      description: Performance stats association.
      properties:
        tags:
          description: A list of APM entity tags that associates the APM Stats data with the entity.
          items:
            type: string
          type: array
      type: object
    AzureUCConfig:
      description: Azure config.
      properties:
        account_id:
          description: The tenant ID of the azure account.
          example: 1234abcd-1234-abcd-1234-1234abcd1234
          type: string
        client_id:
          description: The client ID of the Azure account.
          example: 1234abcd-1234-abcd-1234-1234abcd1234
          type: string
        created_at:
          description: The timestamp when the Azure config was created.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: example_value
        dataset_type:
          description: The dataset type of the Azure config.
          example: actual
          type: string
        error_messages:
          description: The error messages for the Azure config.
          items:
            type: string
          type: array
        export_name:
          description: The name of the configured Azure Export.
          example: dd-actual-export
          type: string
        export_path:
          description: The path where the Azure Export is saved.
          example: dd-export-path
          type: string
        id:
          description: The ID of the Azure config.
          format: int64
          type: integer
          example: 42
        months:
          deprecated: true
          description: The number of months the report has been backfilled.
          format: int32
          maximum: 36
          type: integer
          example: 42
        scope:
          description: The scope of your observed subscription.
          example: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234
          type: string
        status:
          description: The status of the Azure config.
          example: active
          type: string
        status_updated_at:
          description: The timestamp when the Azure config status was last updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: OK
        storage_account:
          description: The name of the storage account where the Azure Export is saved.
          example: dd-storage-account
          type: string
        storage_container:
          description: The name of the storage container where the Azure Export is saved.
          example: dd-storage-container
          type: string
        updated_at:
          description: The timestamp when the Azure config was last updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: '2026-04-17T12:00:00Z'
      required:
      - account_id
      - client_id
      - dataset_type
      - export_name
      - export_path
      - scope
      - status
      - storage_account
      - storage_container
      type: object
      x-merge-override:
        required: false
    EntityToIncidents:
      description: Entity to incidents relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipArray'
      type: object
    ObservabilityPipelineRemoveFieldsProcessor:
      description: The `remove_fields` processor deletes specified fields from logs.
      properties:
        fields:
          description: A list of field names to be removed from each log event.
          example:
          - field1
          - field2
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: remove-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: The `PipelineRemoveFieldsProcessor` `inputs`.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    DeploymentRelationshipData:
      description: Data object containing the deployment ID.
      properties:
        id:
          description: The deployment ID.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        type:
          $ref: '#/components/schemas/AppDeploymentType'
      type: object
    CIAppPipelineEvent:
      description: Object description of a pipeline event after being processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/CIAppPipelineEventAttributes'
        id:
          description: Unique ID of the event.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/CIAppPipelineEventTypeName'
      type: object
    IncidentUserDefinedFieldType:
      description: The incident user defined fields type.
      enum:
      - user_defined_field
      example: user_defined_field
      type: string
      x-enum-varnames:
      - USER_DEFINED_FIELD
    FindingStatus:
      description: The status of the finding.
      enum:
      - critical
      - high
      - medium
      - low
      - info
      example: critical
      type: string
      x-enum-varnames:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - INFO
    CIAppTestLevel:
      description: Test run level.
      enum:
      - session
      - module
      - suite
      - test
      example: test
      type: string
      x-enum-varnames:
      - SESSION
      - MODULE
      - SUITE
      - TEST
    SpansFilter:
      description: The spans filter used to index spans.
      properties:
        query:
          description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/).
          example: '@http.status_code:200 service:my-service'
          type: string
      type: object
    RelationRelationships:
      description: Relation relationships.
      properties:
        fromEntity:
          $ref: '#/components/schemas/RelationToEntity'
        toEntity:
          $ref: '#/components/schemas/RelationToEntity'
      type: object
    IncidentTeamsResponse:
      description: Response with a list of incident team payloads.
      properties:
        data:
          description: An array of incident teams.
          example:
          - attributes:
              name: team name
            id: 00000000-7ea3-0000-0000-000000000000
            type: teams
          items:
            $ref: '#/components/schemas/IncidentTeamResponseData'
          type: array
        included:
          description: Included related resources which the user requested.
          items:
            $ref: '#/components/schemas/IncidentTeamIncludedItems'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentResponseMeta'
      required:
      - data
      type: object
    MetricSuggestedTagsAndAggregationsResponse:
      description: Response object that includes a single metric's actively queried tags and aggregations.
      properties:
        data:
          $ref: '#/components/schemas/MetricSuggestedTagsAndAggregations'
      readOnly: true
      type: object
    SensitiveDataScannerRuleIncludedItem:
      description: A Scanning Rule included item.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes'
        id:
          description: ID of the rule.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      type: object
    OrganizationsType:
      default: orgs
      description: Organizations resource type.
      enum:
      - orgs
      example: orgs
      type: string
      x-enum-varnames:
      - ORGS
    EntityV3QueueSpec:
      additionalProperties: false
      description: The definition of Entity V3 Queue Spec object.
      properties:
        componentOf:
          description: A list of components the queue is a part of
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the queue.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the queue.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of queue.
          type: string
          example: metric alert
      type: object
    SecurityMonitoringSignalAttributes:
      additionalProperties: {}
      description: 'The object containing all signal attributes and their

        associated values.'
      properties:
        custom:
          additionalProperties: {}
          description: A JSON object of attributes in the security signal.
          example:
            workflow:
              first_seen: '2020-06-23T14:46:01.000Z'
              last_seen: '2020-06-23T14:46:49.000Z'
              rule:
                id: 0f5-e0c-805
                name: 'Brute Force Attack Grouped By User '
                version: 12
          type: object
        message:
          description: The message in the security signal defined by the rule that generated the signal.
          example: Detect Account Take Over (ATO) through brute force attempts
          type: string
        tags:
          description: An array of tags associated with the security signal.
          example:
          - security:attack
          - technique:T1110-brute-force
          items:
            description: The tag associated with the security signal.
            type: string
          type: array
        timestamp:
          description: The timestamp of the security signal.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    ListRelationCatalogResponse:
      description: List entity relation response.
      properties:
        data:
          $ref: '#/components/schemas/RelationResponseData'
        included:
          $ref: '#/components/schemas/ListRelationCatalogResponseIncluded'
        links:
          $ref: '#/components/schemas/ListRelationCatalogResponseLinks'
        meta:
          $ref: '#/components/schemas/RelationResponseMeta'
      type: object
    ApplicationSecurityWafCustomRuleConditionOptions:
      description: Options for the operator of this condition.
      properties:
        case_sensitive:
          default: false
          description: Evaluate the value as case sensitive.
          type: boolean
          example: true
        min_length:
          default: 0
          description: Only evaluate this condition if the value has a minimum amount of characters.
          format: int64
          type: integer
          example: 42
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection:
      description: Indicates whether to redact characters from the first or last part of the matched value.
      enum:
      - first
      - last
      example: last
      type: string
      x-enum-varnames:
      - FIRST
      - LAST
    EntityResponseIncludedSchema:
      description: Included detail entity schema.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityResponseIncludedSchemaAttributes'
        id:
          description: Entity ID.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/EntityResponseIncludedSchemaType'
      type: object
    FindingVulnerabilityType:
      description: The vulnerability type of the finding.
      enum:
      - misconfiguration
      - attack_path
      - identity_risk
      - api_security
      example: misconfiguration
      type: string
      x-enum-varnames:
      - MISCONFIGURATION
      - ATTACK_PATH
      - IDENTITY_RISK
      - API_SECURITY
    ObservabilityPipelineAmazonS3Source:
      description: 'The `amazon_s3` source ingests logs from an Amazon S3 bucket.

        It supports AWS authentication and TLS encryption.

        '
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAwsAuth'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: aws-s3-source
          type: string
        region:
          description: AWS region where the S3 bucket resides.
          example: us-east-1
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonS3SourceType'
      required:
      - id
      - type
      - region
      type: object
    ApplicationKeysType:
      default: application_keys
      description: Application Keys resource type.
      enum:
      - application_keys
      example: application_keys
      type: string
      x-enum-varnames:
      - APPLICATION_KEYS
    ListFindingsResponse:
      description: The expected response schema when listing findings.
      properties:
        data:
          $ref: '#/components/schemas/ListFindingsData'
        meta:
          $ref: '#/components/schemas/ListFindingsMeta'
      required:
      - data
      - meta
      type: object
    CIAppPipelineEventAttributes:
      description: JSON object containing all event attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from CI Visibility pipeline events.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        ci_level:
          $ref: '#/components/schemas/CIAppPipelineLevel'
        tags:
          $ref: '#/components/schemas/TagsEventAttribute'
      type: object
    ObservabilityPipelineAddFieldsProcessor:
      description: The `add_fields` processor adds static key-value fields to logs.
      properties:
        fields:
          description: A list of static fields (key-value pairs) that is added to each log event processed by this component.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineFieldValue'
          type: array
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: add-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    ObservabilityPipelineLogstashSource:
      description: The `logstash` source ingests logs from a Logstash forwarder.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: logstash-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineLogstashSourceType'
      required:
      - id
      - type
      type: object
    AWSNamespaceFiltersIncludeOnly:
      description: Include only these namespaces.
      properties:
        include_only:
          description: Include only these namespaces.
          example:
          - AWS/EC2
          items:
            example: AWS/EC2
            type: string
          type: array
      required:
      - include_only
      type: object
    EntityV3DatadogLogs:
      additionalProperties: false
      description: Logs association.
      items:
        $ref: '#/components/schemas/EntityV3DatadogLogItem'
      type: array
    ListVulnerabilitiesResponse:
      description: The expected response schema when listing vulnerabilities.
      properties:
        data:
          description: List of vulnerabilities.
          items:
            $ref: '#/components/schemas/Vulnerability'
          type: array
        links:
          $ref: '#/components/schemas/Links'
        meta:
          $ref: '#/components/schemas/Metadata'
      required:
      - data
      type: object
    ListRelationCatalogResponseIncluded:
      description: List relation response included entities.
      items:
        $ref: '#/components/schemas/EntityData'
      type: array
    ObservabilityPipelineAddFieldsProcessorType:
      default: add_fields
      description: The processor type. The value should always be `add_fields`.
      enum:
      - add_fields
      example: add_fields
      type: string
      x-enum-varnames:
      - ADD_FIELDS
    GCPSTSDelegateAccountType:
      default: gcp_sts_delegate
      description: The type of account.
      enum:
      - gcp_sts_delegate
      example: gcp_sts_delegate
      type: string
      x-enum-varnames:
      - GCP_STS_DELEGATE
    SpansListResponseMetadata:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: The time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/SpansResponseMetadataPage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          $ref: '#/components/schemas/SpansAggregateResponseStatus'
        warnings:
          description: 'A list of warnings (non fatal errors) encountered, partial results might be returned if

            warnings are present in the response.'
          items:
            $ref: '#/components/schemas/SpansWarning'
          type: array
      type: object
    RelationshipToIncidentResponders:
      description: Relationship to incident responders.
      properties:
        data:
          description: An array of incident responders.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentResponderData'
          type: array
      required:
      - data
      type: object
    EntityResponseIncludedIncident:
      description: Included incident.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityResponseIncludedRelatedIncidentAttributes'
        id:
          description: Incident ID.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/EntityResponseIncludedIncidentType'
      type: object
    RetentionFilterAllType:
      default: spans-sampling-processor
      description: The type of retention filter.
      enum:
      - spans-sampling-processor
      - spans-errors-sampling-processor
      - spans-appsec-sampling-processor
      example: spans-sampling-processor
      type: string
      x-enum-varnames:
      - SPANS_SAMPLING_PROCESSOR
      - SPANS_ERRORS_SAMPLING_PROCESSOR
      - SPANS_APPSEC_SAMPLING_PROCESSOR
    CloudflareAccountResponseAttributes:
      description: Attributes object of a Cloudflare account.
      properties:
        email:
          description: The email associated with the Cloudflare account.
          example: test-email@example.com
          type: string
        name:
          description: The name of the Cloudflare account.
          example: test-name
          type: string
        resources:
          description: An allowlist of resources, such as `web`, `dns`, `lb` (load balancer), `worker`, that restricts pulling metrics from those resources.
          example:
          - web
          - dns
          - lb
          - worker
          items:
            type: string
          type: array
        zones:
          description: An allowlist of zones to restrict pulling metrics for.
          example:
          - zone_id_1
          - zone_id_2
          items:
            type: string
          type: array
      required:
      - name
      type: object
    ConfluentResourceResponseAttributes:
      description: Model representation of a Confluent Cloud resource.
      properties:
        enable_custom_metrics:
          default: false
          description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags.
          example: false
          type: boolean
        id:
          description: The ID associated with the Confluent resource.
          example: resource_id_abc123
          type: string
        resource_type:
          description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, or `schema_registry`.
          example: kafka
          type: string
        tags:
          description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - resource_type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineEnrichmentTableFile:
      description: Defines a static enrichment table loaded from a CSV file.
      properties:
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncoding'
        key:
          description: Key fields used to look up enrichment values.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItems'
          type: array
        path:
          description: Path to the CSV file.
          example: /etc/enrichment/lookup.csv
          type: string
        schema:
          description: Schema defining column names and their types.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItems'
          type: array
      required:
      - encoding
      - key
      - path
      - schema
      type: object
    SensitiveDataScannerStandardPatternsResponseItem:
      description: Standard pattern item.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternAttributes'
        id:
          description: ID of the standard pattern.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternType'
      type: object
    ObservabilityPipelineAmazonS3Destination:
      description: The `amazon_s3` destination sends your logs in Datadog-rehydratable format to an Amazon S3 bucket for archiving.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAwsAuth'
        bucket:
          description: S3 bucket name.
          example: error-logs
          type: string
        id:
          description: Unique identifier for the destination component.
          example: amazon-s3-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        key_prefix:
          description: Optional prefix for object keys.
          type: string
          example: example_value
        region:
          description: AWS region of the S3 bucket.
          example: us-east-1
          type: string
        storage_class:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationType'
      required:
      - id
      - type
      - inputs
      - bucket
      - region
      - storage_class
      type: object
    CVSS:
      description: Vulnerability severity.
      properties:
        score:
          description: Vulnerability severity score.
          example: 4.5
          format: double
          type: number
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
        vector:
          description: Vulnerability CVSS vector.
          example: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
          type: string
      required:
      - score
      - severity
      - vector
      type: object
    DORAListDeploymentsRequest:
      description: Request to get a list of deployments.
      properties:
        data:
          $ref: '#/components/schemas/DORAListDeploymentsRequestData'
      required:
      - data
      type: object
    ObservabilityPipelineElasticsearchDestinationApiVersion:
      description: The Elasticsearch API version to use. Set to `auto` to auto-detect.
      enum:
      - auto
      - v6
      - v7
      - v8
      example: auto
      type: string
      x-enum-varnames:
      - AUTO
      - V6
      - V7
      - V8
    CIAppPipelineLevel:
      description: Pipeline execution level.
      enum:
      - pipeline
      - stage
      - job
      - step
      - custom
      example: pipeline
      type: string
      x-enum-varnames:
      - PIPELINE
      - STAGE
      - JOB
      - STEP
      - CUSTOM
    TimeAggregation:
      description: 'Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.

        Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.

        Notifications are only sent for new issues discovered during the window.

        Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation

        is done.'
      example: 86400
      format: int64
      type: integer
    AWSNamespaceFiltersExcludeOnly:
      description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`.

        `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.'
      properties:
        exclude_only:
          description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`.

            `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.'
          example:
          - AWS/SQS
          - AWS/ElasticMapReduce
          items:
            example: AWS/SQS
            type: string
          type: array
      required:
      - exclude_only
      type: object
    ConfluentAccountsResponse:
      description: Confluent account returned by the API.
      properties:
        data:
          description: The Confluent account.
          items:
            $ref: '#/components/schemas/ConfluentAccountResponseData'
          type: array
      type: object
    ApplicationSecurityWafCustomRuleTags:
      additionalProperties:
        type: string
      description: 'Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security

        activity field associated with the traces.'
      maxProperties: 32
      properties:
        category:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory'
        type:
          description: The type of the WAF rule, associated with the category will form the security activity.
          example: users.login.success
          type: string
      required:
      - category
      - type
      type: object
    DORAListFailuresRequest:
      description: Request to get a list of failures.
      properties:
        data:
          $ref: '#/components/schemas/DORAListFailuresRequestData'
      required:
      - data
      type: object
    MetricActiveConfigurationType:
      default: actively_queried_configurations
      description: The metric actively queried configuration resource type.
      enum:
      - actively_queried_configurations
      example: actively_queried_configurations
      type: string
      x-enum-varnames:
      - ACTIVELY_QUERIED_CONFIGURATIONS
    EventAttributes:
      description: Object description of attributes from your event.
      properties:
        aggregation_key:
          description: Aggregation key of the event.
          type: string
          example: example_value
        date_happened:
          description: 'POSIX timestamp of the event. Must be sent as an integer (no quotation marks).

            Limited to events no older than 18 hours.'
          format: int64
          type: integer
          example: 42
        device_name:
          description: A device name.
          type: string
          example: Example Monitor
        duration:
          description: The duration between the triggering of the event and its recovery in nanoseconds.
          format: int64
          type: integer
          example: 42
        event_object:
          description: The event title.
          example: Did you hear the news today?
          type: string
        evt:
          $ref: '#/components/schemas/Event'
        hostname:
          description: 'Host name to associate with the event.

            Any tags associated with the host are also applied to this event.'
          type: string
          example: Example Monitor
        monitor:
          $ref: '#/components/schemas/MonitorType'
        monitor_groups:
          description: List of groups referred to in the event.
          items:
            description: Group referred to in the event.
            type: string
          nullable: true
          type: array
        monitor_id:
          description: ID of the monitor that triggered the event. When an event isn't related to a monitor, this field is empty.
          format: int64
          nullable: true
          type: integer
          example: 42
        priority:
          $ref: '#/components/schemas/EventPriority'
        related_event_id:
          description: Related event ID.
          format: int64
          type: integer
          example: 42
        service:
          description: Service that triggered the event.
          example: datadog-api
          type: string
        source_type_name:
          description: 'The type of event being posted.

            For example, `nagios`, `hudson`, `jenkins`, `my_apps`, `chef`, `puppet`, `git` or `bitbucket`.

            The list of standard source attribute values is [available here](https://docs.datadoghq.com/integrations/faq/list-of-api-source-attribute-value).'
          type: string
          example: Example Monitor
        sourcecategory:
          description: Identifier for the source of the event, such as a monitor alert, an externally-submitted event, or an integration.
          type: string
          example: example_value
        status:
          $ref: '#/components/schemas/EventStatusType'
        tags:
          description: A list of tags to apply to the event.
          example:
          - environment:test
          items:
            description: A tag.
            type: string
          type: array
        timestamp:
          description: POSIX timestamp of your event in milliseconds.
          example: 1652274265000
          format: int64
          type: integer
        title:
          description: The event title.
          example: Oh boy!
          type: string
      type: object
    ObservabilityPipelineFieldValue:
      description: Represents a static key-value pair used in various processors.
      properties:
        name:
          description: The field name.
          example: field_name
          type: string
        value:
          description: The field value.
          example: field_value
          type: string
      required:
      - name
      - value
      type: object
    Date:
      description: Date as Unix timestamp in milliseconds.
      example: 1722439510282
      format: int64
      type: integer
    ObservabilityPipelineDataAttributes:
      description: Defines the pipeline’s name and its components (sources, processors, and destinations).
      properties:
        config:
          $ref: '#/components/schemas/ObservabilityPipelineConfig'
        name:
          description: Name of the pipeline.
          example: Main Observability Pipeline
          type: string
      required:
      - name
      - config
      type: object
    ObservabilityPipelineEnrichmentTableProcessor:
      description: The `enrichment_table` processor enriches logs using a static CSV file or GeoIP database.
      properties:
        file:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFile'
        geoip:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableGeoIp'
        id:
          description: The unique identifier for this processor.
          example: enrichment-table-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: source:my-source
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - add-fields-processor
          items:
            type: string
          type: array
        target:
          description: Path where enrichment results should be stored in the log.
          example: enriched.geoip
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - target
      type: object
    ApplicationKeyResponseMeta:
      description: Additional information related to the application key response.
      properties:
        max_allowed_per_user:
          description: Max allowed number of application keys per user.
          format: int64
          type: integer
          example: 42
        page:
          $ref: '#/components/schemas/ApplicationKeyResponseMetaPage'
      type: object
    MetricAllTagsAttributes:
      description: Object containing the definition of a metric's tags.
      properties:
        tags:
          description: List of indexed tag value pairs.
          example:
          - sport:golf
          - sport:football
          - animal:dog
          items:
            description: Tag key-value pairs.
            type: string
          type: array
      type: object
    EntityV3Service:
      additionalProperties: false
      description: Schema for service entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3ServiceDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3ServiceKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3ServiceSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    EntityResponseIncludedSchemaType:
      description: Schema type.
      enum:
      - schema
      type: string
      x-enum-varnames:
      - SCHEMA
    ObservabilityPipelineDatadogAgentSourceType:
      default: datadog_agent
      description: The source type. The value should always be `datadog_agent`.
      enum:
      - datadog_agent
      example: datadog_agent
      type: string
      x-enum-varnames:
      - DATADOG_AGENT
    IncidentResponseIncludedItem:
      description: An object related to an incident that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/IncidentUserData'
      - $ref: '#/components/schemas/IncidentAttachmentData'
    IncidentsResponse:
      description: Response with a list of incidents.
      properties:
        data:
          description: An array of incidents.
          example:
          - attributes:
              created: '2020-04-21T15:34:08.627205+00:00'
              creation_idempotency_key: null
              customer_impact_duration: 0
              customer_impact_end: null
              customer_impact_scope: null
              customer_impact_start: null
              customer_impacted: false
              detected: '2020-04-14T00:00:00+00:00'
              incident_type_uuid: 00000000-0000-0000-0000-000000000001
              modified: '2020-09-17T14:16:58.696424+00:00'
              public_id: 1
              resolved: null
              severity: SEV-1
              time_to_detect: 0
              time_to_internal_response: 0
              time_to_repair: 0
              time_to_resolve: 0
              title: Example Incident
            id: 00000000-aaaa-0000-0000-000000000000
            relationships:
              attachments:
                data:
                - id: 00000000-9999-0000-0000-000000000000
                  type: incident_attachments
                - id: 00000000-1234-0000-0000-000000000000
                  type: incident_attachments
              commander_user:
                data:
                  id: 00000000-0000-0000-cccc-000000000000
                  type: users
              created_by_user:
                data:
                  id: 00000000-0000-0000-cccc-000000000000
                  type: users
              integrations:
                data:
                - id: 00000000-0000-0000-4444-000000000000
                  type: incident_integrations
                - id: 00000000-0000-0000-5555-000000000000
                  type: incident_integrations
              last_modified_by_user:
                data:
                  id: 00000000-0000-0000-cccc-000000000000
                  type: users
            type: incidents
          - attributes:
              created: '2020-04-21T15:34:08.627205+00:00'
              creation_idempotency_key: null
              customer_impact_duration: 0
              customer_impact_end: null
              customer_impact_scope: null
              customer_impact_start: null
              customer_impacted: false
              detected: '2020-04-14T00:00:00+00:00'
              incident_type_uuid: 00000000-0000-0000-0000-000000000002
              modified: '2020-09-17T14:16:58.696424+00:00'
              public_id: 2
              resolved: null
              severity: SEV-5
              time_to_detect: 0
              time_to_internal_response: 0
              time_to_repair: 0
              time_to_resolve: 0
              title: Example Incident 2
            id: 00000000-1111-0000-0000-000000000000
            relationships:
              attachments:
                data:
                - id: 00000000-9999-0000-0000-000000000000
                  type: incident_attachments
              commander_user:
                data:
                  id: 00000000-aaaa-0000-0000-000000000000
                  type: users
              created_by_user:
                data:
                  id: 00000000-aaaa-0000-0000-000000000000
                  type: users
              integrations:
                data:
                - id: 00000000-0000-0000-0001-000000000000
                  type: incident_integrations
                - id: 00000000-0000-0000-0002-000000000000
                  type: incident_integrations
              last_modified_by_user:
                data:
                  id: 00000000-aaaa-0000-0000-000000000000
                  type: users
            type: incidents
          items:
            $ref: '#/components/schemas/IncidentResponseData'
          type: array
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentResponseIncludedItem'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentResponseMeta'
      required:
      - data
      type: object
    ObservabilityPipelinePipelineKafkaSourceSaslMechanism:
      description: SASL mechanism used for Kafka authentication.
      enum:
      - PLAIN
      - SCRAM-SHA-256
      - SCRAM-SHA-512
      type: string
      x-enum-varnames:
      - PLAIN
      - SCRAMNOT_SHANOT_256
      - SCRAMNOT_SHANOT_512
    ObservabilityPipelineFluentBitSourceType:
      default: fluent_bit
      description: The source type. The value should always be `fluent_bit`.
      enum:
      - fluent_bit
      example: fluent_bit
      type: string
      x-enum-varnames:
      - FLUENT_BIT
    IncidentServiceResponseAttributes:
      description: The incident service's attributes from a response.
      properties:
        created:
          description: Timestamp of when the incident service was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified:
          description: Timestamp of when the incident service was modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the incident service.
          example: service name
          type: string
      type: object
    RUMSort:
      description: Sort parameters when querying events.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    IncidentImpactsType:
      description: The incident impacts type.
      enum:
      - incident_impacts
      example: incident_impacts
      type: string
      x-enum-varnames:
      - INCIDENT_IMPACTS
    RelationshipToRoleData:
      description: Relationship to role object.
      properties:
        id:
          description: The unique identifier of the role.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        type:
          $ref: '#/components/schemas/RolesType'
      type: object
      x-merge-override:
        required: false
    ListRulesResponse:
      description: Scorecard rules response.
      properties:
        data:
          $ref: '#/components/schemas/ListRulesResponseData'
        links:
          $ref: '#/components/schemas/ListRulesResponseLinks'
      type: object
    RelationshipToOrganizationData:
      description: Relationship to organization object.
      properties:
        id:
          description: ID of the organization.
          example: 00000000-0000-beef-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/OrganizationsType'
      required:
      - id
      - type
      type: object
    RolesSort:
      default: name
      description: Sorting options for roles.
      enum:
      - name
      - -name
      - modified_at
      - -modified_at
      - user_count
      - -user_count
      type: string
      x-enum-varnames:
      - NAME_ASCENDING
      - NAME_DESCENDING
      - MODIFIED_AT_ASCENDING
      - MODIFIED_AT_DESCENDING
      - USER_COUNT_ASCENDING
      - USER_COUNT_DESCENDING
    FastlyAccountResponseData:
      description: Data object of a Fastly account.
      properties:
        attributes:
          $ref: '#/components/schemas/FastlyAccounResponseAttributes'
        id:
          description: The ID of the Fastly account, a hash of the account name.
          example: abc123
          type: string
        type:
          $ref: '#/components/schemas/FastlyAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    RelationshipToIncidentImpactData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the impact.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentImpactsType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    PartialApplicationKeyAttributes:
      description: Attributes of a partial application key.
      properties:
        created_at:
          description: Creation date of the application key.
          example: '2020-11-23T10:00:00.000Z'
          readOnly: true
          type: string
          x-merge-override:
            format: false
        last4:
          description: The last four characters of the application key.
          example: abcd
          maxLength: 4
          minLength: 4
          readOnly: true
          type: string
          x-secret: true
        name:
          description: Name of the application key.
          example: Application Key for managing dashboards
          type: string
        scopes:
          description: Array of scopes to grant the application key.
          example:
          - dashboards_read
          - dashboards_write
          - dashboards_public_share
          items:
            description: Name of scope.
            type: string
          nullable: true
          type: array
      type: object
    EntityV3SystemDatadog:
      additionalProperties: false
      description: Datadog product integrations for the service entity.
      properties:
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
        pipelines:
          $ref: '#/components/schemas/EntityV3DatadogPipelines'
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern:
      description: Specifies a pattern from Datadog’s sensitive data detection library to match known sensitive data types.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType'
      required:
      - type
      - options
      type: object
    ConfluentAccountType:
      default: confluent-cloud-accounts
      description: The JSON:API type for this API. Should always be `confluent-cloud-accounts`.
      enum:
      - confluent-cloud-accounts
      example: confluent-cloud-accounts
      type: string
      x-enum-varnames:
      - CONFLUENT_CLOUD_ACCOUNTS
    XRayServicesIncludeOnly:
      description: Include only these services. Defaults to `[]`.
      nullable: true
      properties:
        include_only:
          description: Include only these services.
          example:
          - AWS/AppSync
          items:
            example: AWS/AppSync
            type: string
          type: array
      required:
      - include_only
      type: object
    FastlyAccountType:
      default: fastly-accounts
      description: The JSON:API type for this API. Should always be `fastly-accounts`.
      enum:
      - fastly-accounts
      example: fastly-accounts
      type: string
      x-enum-varnames:
      - FASTLY_ACCOUNTS
    ObservabilityPipelineAmazonOpenSearchDestinationAuth:
      description: 'Authentication settings for the Amazon OpenSearch destination.

        The `strategy` field determines whether basic or AWS-based authentication is used.

        '
      properties:
        assume_role:
          description: The ARN of the role to assume (used with `aws` strategy).
          type: string
          example: example_value
        aws_region:
          description: AWS region
          type: string
          example: example_value
        external_id:
          description: External ID for the assumed role (used with `aws` strategy).
          type: string
          example: abc-123-def
        session_name:
          description: Session name for the assumed role (used with `aws` strategy).
          type: string
          example: Example Monitor
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy'
      required:
      - strategy
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction:
      description: Action type that completely replaces the matched sensitive data with a fixed replacement string to remove all visibility.
      enum:
      - redact
      example: redact
      type: string
      x-enum-varnames:
      - REDACT
    ListAppsResponseDataItemsRelationships:
      description: The app's publication information.
      properties:
        deployment:
          $ref: '#/components/schemas/DeploymentRelationship'
      type: object
    AWSAccountType:
      default: account
      description: AWS Account resource type.
      enum:
      - account
      example: account
      type: string
      x-enum-varnames:
      - ACCOUNT
    RUMResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'Link for the next set of results. Note that the request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/rum/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    IncidentIntegrationMetadataListResponse:
      description: Response with a list of incident integration metadata.
      properties:
        data:
          description: An array of incident integration metadata.
          items:
            $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData'
          type: array
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentResponseMeta'
      required:
      - data
      type: object
    AuditLogsResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    EntityResponseIncludedRelatedEntityType:
      description: Related entity.
      enum:
      - relatedEntity
      type: string
      x-enum-varnames:
      - RELATED_ENTITY
    AWSTracesConfig:
      description: AWS Traces Collection config.
      properties:
        xray_services:
          $ref: '#/components/schemas/XRayServicesList'
      type: object
    FastlyServicesResponse:
      description: The expected response schema when getting Fastly services.
      properties:
        data:
          description: The JSON:API data schema.
          items:
            $ref: '#/components/schemas/FastlyServiceData'
          type: array
      type: object
    AWSRegionsIncludeOnly:
      description: Include only these regions.
      properties:
        include_only:
          description: Include only these regions.
          example:
          - us-east-1
          items:
            example: us-east-1
            type: string
          type: array
      required:
      - include_only
      type: object
    MetricPaginationMeta:
      description: Response metadata object.
      properties:
        pagination:
          $ref: '#/components/schemas/MetricMetaPage'
      type: object
    CIAppTestEventTypeName:
      description: Type of the event.
      enum:
      - citest
      example: citest
      type: string
      x-enum-varnames:
      - CITEST
    ListAPIsResponseData:
      description: Data envelope for `ListAPIsResponse`.
      properties:
        attributes:
          $ref: '#/components/schemas/ListAPIsResponseDataAttributes'
        id:
          $ref: '#/components/schemas/ApiID'
      type: object
    ApplicationKeysSort:
      default: name
      description: Sorting options
      enum:
      - created_at
      - -created_at
      - last4
      - -last4
      - name
      - -name
      type: string
      x-enum-varnames:
      - CREATED_AT_ASCENDING
      - CREATED_AT_DESCENDING
      - LAST4_ASCENDING
      - LAST4_DESCENDING
      - NAME_ASCENDING
      - NAME_DESCENDING
    SensitiveDataScannerRuleData:
      description: Rules included in the group.
      properties:
        data:
          description: Rules included in the group. The order is important.
          items:
            $ref: '#/components/schemas/SensitiveDataScannerRule'
          type: array
      type: object
    ObservabilityPipelineGooglePubSubSource:
      description: The `google_pubsub` source ingests logs from a Google Cloud Pub/Sub subscription.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: google-pubsub-source
          type: string
        project:
          description: The GCP project ID that owns the Pub/Sub subscription.
          example: my-gcp-project
          type: string
        subscription:
          description: The Pub/Sub subscription name from which messages are consumed.
          example: logs-subscription
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSourceType'
      required:
      - id
      - type
      - auth
      - decoding
      - project
      - subscription
      type: object
    EntityResponseIncludedIncidentType:
      description: Incident description.
      enum:
      - incident
      type: string
      x-enum-varnames:
      - INCIDENT
    ObservabilityPipelineReduceProcessorMergeStrategyStrategy:
      description: The merge strategy to apply.
      enum:
      - discard
      - retain
      - sum
      - max
      - min
      - array
      - concat
      - concat_newline
      - concat_raw
      - shortest_array
      - longest_array
      - flat_unique
      example: flat_unique
      type: string
      x-enum-varnames:
      - DISCARD
      - RETAIN
      - SUM
      - MAX
      - MIN
      - ARRAY
      - CONCAT
      - CONCAT_NEWLINE
      - CONCAT_RAW
      - SHORTEST_ARRAY
      - LONGEST_ARRAY
      - FLAT_UNIQUE
    BudgetEntry:
      description: The entry of a budget.
      properties:
        amount:
          description: The `amount` of the budget entry.
          example: 500
          format: double
          type: number
        month:
          description: The `month` of the budget entry.
          example: 202501
          format: int64
          type: integer
        tag_filters:
          description: The `tag_filters` of the budget entry.
          items:
            $ref: '#/components/schemas/TagFilter'
          type: array
      type: object
    ID:
      description: The ID of a notification rule.
      example: aaa-bbb-ccc
      type: string
    AuthNMappingTeamAttributes:
      description: Team attributes.
      properties:
        avatar:
          description: Unicode representation of the avatar for the team, limited to a single grapheme
          example: 🥑
          nullable: true
          type: string
        banner:
          description: Banner selection for the team
          format: int64
          nullable: true
          type: integer
          example: 42
        handle:
          description: The team's identifier
          example: example-team
          maxLength: 195
          type: string
        link_count:
          description: The number of links belonging to the team
          format: int32
          maximum: 2147483647
          readOnly: true
          type: integer
          example: 42
        name:
          description: The name of the team
          example: Example Team
          maxLength: 200
          type: string
        summary:
          description: A brief summary of the team, derived from the `description`
          maxLength: 120
          nullable: true
          type: string
          example: example_value
        user_count:
          description: The number of users belonging to the team
          format: int32
          maximum: 2147483647
          readOnly: true
          type: integer
          example: 42
      type: object
    SensitiveDataScannerStandardPatternType:
      default: sensitive_data_scanner_standard_pattern
      description: Sensitive Data Scanner standard pattern type.
      enum:
      - sensitive_data_scanner_standard_pattern
      example: sensitive_data_scanner_standard_pattern
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_STANDARD_PATTERN
    SecurityMonitoringThirdPartyRootQuery:
      description: A query to be combined with the third party case query.
      properties:
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        query:
          description: Query to run on logs.
          example: source:cloudtrail
          type: string
      type: object
    SensitiveDataScannerGroupType:
      default: sensitive_data_scanner_group
      description: Sensitive Data Scanner group type.
      enum:
      - sensitive_data_scanner_group
      example: sensitive_data_scanner_group
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_GROUP
    FastlyServiceData:
      description: Data object for Fastly service requests.
      properties:
        attributes:
          $ref: '#/components/schemas/FastlyServiceAttributes'
        id:
          description: The ID of the Fastly service.
          example: abc123
          type: string
        type:
          $ref: '#/components/schemas/FastlyServiceType'
      required:
      - id
      - type
      type: object
    VulnerabilityDependencyLocations:
      description: Static library vulnerability location.
      properties:
        block:
          $ref: '#/components/schemas/DependencyLocation'
        name:
          $ref: '#/components/schemas/DependencyLocation'
        version:
          $ref: '#/components/schemas/DependencyLocation'
      required:
      - block
      type: object
    ConfluentAccountResponseAttributes:
      description: The attributes of a Confluent account.
      properties:
        api_key:
          description: The API key associated with your Confluent account.
          example: TESTAPIKEY123
          type: string
        resources:
          description: A list of Confluent resources associated with the Confluent account.
          items:
            $ref: '#/components/schemas/ConfluentResourceResponseAttributes'
          type: array
        tags:
          description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - api_key
      type: object
    ObservabilityPipelineOcsfMapperProcessorType:
      default: ocsf_mapper
      description: The processor type. The value should always be `ocsf_mapper`.
      enum:
      - ocsf_mapper
      example: ocsf_mapper
      type: string
      x-enum-varnames:
      - OCSF_MAPPER
    EntityV3ServiceKind:
      description: The definition of Entity V3 Service Kind object.
      enum:
      - service
      example: service
      type: string
      x-enum-varnames:
      - SERVICE
    RestrictionQueryListResponse:
      description: Response containing information about multiple restriction queries.
      properties:
        data:
          description: Array of returned restriction queries.
          items:
            $ref: '#/components/schemas/RestrictionQueryWithoutRelationships'
          type: array
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeAll:
      description: Applies scanning across all available fields.
      properties:
        target:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget'
      required:
      - target
      type: object
    IncidentAttachmentsPostmortemAttributesAttachmentObject:
      description: The postmortem attachment.
      properties:
        documentUrl:
          description: The URL of this notebook attachment.
          example: https://app.datadoghq.com/notebook/123
          type: string
        title:
          description: The title of this postmortem attachment.
          example: Postmortem IR-123
          type: string
      required:
      - documentUrl
      - title
      type: object
    ListRulesResponseDataItem:
      description: Rule details.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        relationships:
          $ref: '#/components/schemas/RelationshipToRule'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    RestrictionQueryRolesResponse:
      description: Response containing information about roles attached to a restriction query.
      properties:
        data:
          description: Array of roles.
          items:
            $ref: '#/components/schemas/RestrictionQueryRole'
          type: array
      type: object
    RUMEventsResponse:
      description: Response object with all events matching the request and pagination information.
      properties:
        data:
          description: Array of events matching the request.
          items:
            $ref: '#/components/schemas/RUMEvent'
          type: array
        links:
          $ref: '#/components/schemas/RUMResponseLinks'
        meta:
          $ref: '#/components/schemas/RUMResponseMetadata'
      type: object
    Asset:
      description: A single vulnerable asset
      properties:
        attributes:
          $ref: '#/components/schemas/AssetAttributes'
        id:
          description: The unique ID for this asset.
          example: Repository|github.com/DataDog/datadog-agent.git
          type: string
        type:
          $ref: '#/components/schemas/AssetEntityType'
      required:
      - id
      - type
      - attributes
      type: object
    Metadata:
      description: The metadata related to this request.
      properties:
        count:
          description: Number of entities included in the response.
          example: 150
          format: int64
          type: integer
        token:
          description: The token that identifies the request.
          example: b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        total:
          description: Total number of entities across all pages.
          example: 152431
          format: int64
          type: integer
      required:
      - count
      - total
      - token
      type: object
    ObservabilityPipelineKafkaSourceLibrdkafkaOption:
      description: Represents a key-value pair used to configure low-level `librdkafka` client options for Kafka sources, such as timeouts, buffer sizes, and security settings.
      properties:
        name:
          description: The name of the `librdkafka` configuration option to set.
          example: fetch.message.max.bytes
          type: string
        value:
          description: The value assigned to the specified `librdkafka` configuration option.
          example: '1048576'
          type: string
      required:
      - name
      - value
      type: object
    SecurityMonitoringSignalListRequest:
      description: The request for a security signal list.
      properties:
        filter:
          $ref: '#/components/schemas/SecurityMonitoringSignalListRequestFilter'
        page:
          $ref: '#/components/schemas/SecurityMonitoringSignalListRequestPage'
        sort:
          $ref: '#/components/schemas/SecurityMonitoringSignalsSort'
      type: object
    MetricDistinctVolumeType:
      default: distinct_metric_volumes
      description: The metric distinct volume type.
      enum:
      - distinct_metric_volumes
      example: distinct_metric_volumes
      type: string
      x-enum-varnames:
      - DISTINCT_METRIC_VOLUMES
    ApplicationSecurityWafExclusionFilterID:
      description: The identifier of the WAF exclusion filter.
      example: 3dd-0uc-h1s
      readOnly: true
      type: string
    IncidentSeverity:
      description: The incident severity.
      enum:
      - UNKNOWN
      - SEV-0
      - SEV-1
      - SEV-2
      - SEV-3
      - SEV-4
      - SEV-5
      example: UNKNOWN
      type: string
      x-enum-varnames:
      - UNKNOWN
      - SEV_0
      - SEV_1
      - SEV_2
      - SEV_3
      - SEV_4
      - SEV_5
    EntityV3DatadogIntegrationPagerduty:
      additionalProperties: false
      description: A PagerDuty integration schema.
      properties:
        serviceURL:
          description: The service URL for the PagerDuty integration.
          example: https://www.pagerduty.com/service-directory/Pshopping-cart
          minLength: 1
          type: string
      required:
      - serviceURL
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions:
      description: Fields to which the scope rule applies.
      properties:
        fields:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions` `fields`.
          example:
          - ''
          items:
            type: string
          type: array
      required:
      - fields
      type: object
    SensitiveDataScannerStandardPatternsResponse:
      description: List Standard patterns response.
      items:
        $ref: '#/components/schemas/SensitiveDataScannerStandardPatternsResponseItem'
      type: array
    ObservabilityPipelineOpenSearchDestination:
      description: The `opensearch` destination writes logs to an OpenSearch cluster.
      properties:
        bulk_index:
          description: The index to write logs to.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: opensearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    AppDeploymentType:
      default: deployment
      description: The deployment type.
      enum:
      - deployment
      example: deployment
      type: string
      x-enum-varnames:
      - DEPLOYMENT
    RUMResponsePage:
      description: Paging attributes.
      properties:
        after:
          description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    IncidentRelatedObject:
      description: Object related to an incident.
      enum:
      - users
      - attachments
      type: string
      x-enum-varnames:
      - USERS
      - ATTACHMENTS
    AWSAuthConfig:
      description: AWS Authentication config.
      oneOf:
      - $ref: '#/components/schemas/AWSAuthConfigKeys'
      - $ref: '#/components/schemas/AWSAuthConfigRole'
    SpansType:
      default: spans
      description: Type of the span.
      enum:
      - spans
      example: spans
      type: string
      x-enum-varnames:
      - SPANS
    SecurityMonitoringStandardRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        defaultTags:
          description: Default Tags for default rules (included in tags)
          example:
          - security:attacks
          items:
            description: Default Tag.
            type: string
          type: array
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        updatedAt:
          description: The date the rule was last updated, in milliseconds.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    ExternalUserEmailType:
      description: Email address for the user.
      properties:
        primary:
          description: Boolean indicating if this email is the primary email address.
          type: boolean
          example: true
        type:
          $ref: '#/components/schemas/EmailTypeType'
        value:
          description: Email addresses for the user.
          type: string
          example: example_value
      type: object
    TagFilter:
      description: Tag filter for the budget's entries.
      properties:
        tag_key:
          description: The key of the tag.
          example: service
          type: string
        tag_value:
          description: The value of the tag.
          example: ec2
          type: string
      type: object
    SecurityMonitoringRuleDetectionMethod:
      description: The detection method.
      enum:
      - threshold
      - new_value
      - anomaly_detection
      - impossible_travel
      - hardcoded
      - third_party
      - anomaly_threshold
      type: string
      x-enum-varnames:
      - THRESHOLD
      - NEW_VALUE
      - ANOMALY_DETECTION
      - IMPOSSIBLE_TRAVEL
      - HARDCODED
      - THIRD_PARTY
      - ANOMALY_THRESHOLD
    ObservabilityPipelineQuotaProcessor:
      description: The Quota Processor measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert.
      properties:
        drop_events:
          description: If set to `true`, logs that matched the quota filter and sent after the quota has been met are dropped; only logs that did not match the filter query continue through the pipeline.
          example: false
          type: boolean
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: quota-processor
          type: string
        ignore_when_missing_partitions:
          description: If `true`, the processor skips quota checks when partition fields are missing from the logs.
          type: boolean
          example: true
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        limit:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit'
        name:
          description: Name of the quota.
          example: MyQuota
          type: string
        overflow_action:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction'
        overrides:
          description: A list of alternate quota rules that apply to specific sets of events, identified by matching field values. Each override can define a custom limit.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverride'
          type: array
        partition_fields:
          description: A list of fields used to segment log traffic for quota enforcement. Quotas are tracked independently by unique combinations of these field values.
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorType'
      required:
      - id
      - type
      - include
      - name
      - drop_events
      - limit
      - inputs
      type: object
  parameters:
    FilterRelationByType:
      description: Filter relations by type.
      explode: true
      in: query
      name: filter[type]
      required: false
      schema:
        $ref: '#/components/schemas/RelationType'
    ApplicationKeyFilterCreatedAtEndParameter:
      description: Only include application keys created on or before the specified date.
      in: query
      name: filter[created_at][end]
      required: false
      schema:
        example: '2020-11-24T18:46:21+00:00'
        type: string
        x-merge-override:
          format: false
    SkipCache:
      description: Skip cache for resource filters.
      in: query
      name: skip_cache
      required: false
      schema:
        type: boolean
    IncidentIncludeQueryParameter:
      description: Specifies which types of related objects should be included in the response.
      explode: false
      in: query
      name: include
      required: false
      schema:
        items:
          $ref: '#/components/schemas/IncidentRelatedObject'
        type: array
    IncidentTypeIncludeDeletedParameter:
      description: Include deleted incident types in the response.
      in: query
      name: include_deleted
      schema:
        default: false
        type: boolean
    FilterRelationByToRef:
      description: Filter relations by the reference of the second entity in the relation.
      example: service:shopping-cart
      explode: true
      in: query
      name: filter[to_ref]
      required: false
      schema:
        type: string
    FilterByName:
      description: Filter entities by name.
      explode: true
      in: query
      name: filter[name]
      required: false
      schema:
        type: string
    FilterByExcludeSnapshot:
      description: Filter entities by excluding snapshotted entities.
      in: query
      name: filter[exclude_snapshot]
      required: false
      schema:
        type: string
    FilterByID:
      description: Filter entities by UUID.
      explode: true
      in: query
      name: filter[id]
      required: false
      schema:
        type: string
    IncidentServiceSearchQueryParameter:
      description: A search query that filters services by name.
      in: query
      name: filter
      required: false
      schema:
        example: ExampleServiceName
        type: string
    FilterByRelationType:
      description: Filter entities by relation type.
      explode: true
      in: query
      name: filter[relation][type]
      required: false
      schema:
        $ref: '#/components/schemas/RelationType'
    ApplicationKeyFilterCreatedAtStartParameter:
      description: Only include application keys created on or after the specified date.
      in: query
      name: filter[created_at][start]
      required: false
      schema:
        example: '2020-11-24T18:46:21+00:00'
        type: string
        x-merge-override:
          format: false
    MetricName:
      description: The name of the metric.
      example: dist.http.endpoint.request
      in: path
      name: metric_name
      required: true
      schema:
        type: string
    ResourceFilterAccountID:
      description: Filter resource filters by cloud provider account ID. This parameter is only valid when provider is specified.
      in: query
      name: account_id
      required: false
      schema:
        type: string
    FilterByRef:
      description: Filter entities by reference
      example: service:shopping-cart
      explode: true
      in: query
      name: filter[ref]
      required: false
      schema:
        type: string
    IncidentTeamIncludeQueryParameter:
      description: Specifies which types of related objects should be included in the response.
      in: query
      name: include
      required: false
      schema:
        $ref: '#/components/schemas/IncidentRelatedObject'
    FilterByOwner:
      description: Filter entities by owner.
      explode: true
      in: query
      name: filter[owner]
      required: false
      schema:
        type: string
    RestrictionQueryID:
      description: The ID of the restriction query.
      in: path
      name: restriction_query_id
      required: true
      schema:
        type: string
    RoleID:
      description: The unique identifier of the role.
      in: path
      name: role_id
      required: true
      schema:
        type: string
    FilterRelationByFromRef:
      description: Filter relations by the reference of the first entity in the relation.
      example: service:shopping-cart
      explode: true
      in: query
      name: filter[from_ref]
      required: false
      schema:
        type: string
    ServiceAccountID:
      description: The ID of the service account.
      in: path
      name: service_account_id
      required: true
      schema:
        example: 00000000-0000-1234-0000-000000000000
        type: string
    ResourceFilterProvider:
      description: Filter resource filters by cloud provider (e.g. aws, gcp, azure).
      in: query
      name: cloud_provider
      required: false
      schema:
        type: string
    Include:
      description: Include relationship data.
      explode: true
      in: query
      name: include
      required: false
      schema:
        $ref: '#/components/schemas/IncludeType'
    FastlyAccountID:
      description: Fastly Account id.
      in: path
      name: account_id
      required: true
      schema:
        type: string
    WorkflowId:
      description: The ID of the workflow.
      in: path
      name: workflow_id
      required: true
      schema:
        type: string
    FilterByKind:
      description: Filter entities by kind.
      explode: true
      in: query
      name: filter[kind]
      required: false
      schema:
        type: string
    RelationInclude:
      description: Include relationship data.
      explode: true
      in: query
      name: include
      required: false
      schema:
        $ref: '#/components/schemas/RelationIncludeType'
    IncidentAttachmentIncludeQueryParameter:
      description: Specifies which types of related objects are included in the response.
      explode: false
      in: query
      name: include
      required: false
      schema:
        items:
          $ref: '#/components/schemas/IncidentAttachmentRelatedObject'
        type: array
    PageSize:
      description: Size for a given page. The maximum allowed value is 100.
      in: query
      name: page[size]
      required: false
      schema:
        default: 10
        example: 10
        format: int64
        type: integer
    IncidentAttachmentFilterQueryParameter:
      description: Specifies which types of attachments are included in the response.
      explode: false
      in: query
      name: filter[attachment_type]
      required: false
      schema:
        items:
          $ref: '#/components/schemas/IncidentAttachmentAttachmentType'
        type: array
    PageOffset:
      description: Specific offset to use as the beginning of the returned page.
      in: query
      name: page[offset]
      required: false
      schema:
        default: 0
        example: 0
        format: int64
        type: integer
    IncidentTeamSearchQueryParameter:
      description: A search query that filters teams by name.
      in: query
      name: filter
      required: false
      schema:
        example: ExampleTeamName
        type: string
    ArchiveID:
      description: The ID of the archive.
      in: path
      name: archive_id
      required: true
      schema:
        type: string
    IncidentIDPathParameter:
      description: The UUID of the incident.
      in: path
      name: incident_id
      required: true
      schema:
        type: string
    ConfluentAccountID:
      description: Confluent Account ID.
      in: path
      name: account_id
      required: true
      schema:
        type: string
    ApplicationKeyFilterParameter:
      description: Filter application keys by the specified string.
      in: query
      name: filter
      required: false
      schema:
        type: string
    PageNumber:
      description: Specific page number to return.
      in: query
      name: page[number]
      required: false
      schema:
        default: 0
        example: 0
        format: int64
        type: integer
    ApplicationKeysSortParameter:
      description: 'Application key attribute used to sort results. Sort order is ascending

        by default. In order to specify a descending sort, prefix the

        attribute with a minus sign.'
      in: query
      name: sort
      required: false
      schema:
        $ref: '#/components/schemas/ApplicationKeysSort'
    IncidentServiceIncludeQueryParameter:
      description: Specifies which types of related objects should be included in the response.
      in: query
      name: include
      required: false
      schema:
        $ref: '#/components/schemas/IncidentRelatedObject'
  responses:
    FindingsNotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: 'Not Found: The requested finding cannot be found.'
    FindingsTooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: 'Too many requests: The rate limit set by the API has been exceeded.'
    NotAuthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Authorized
    NotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Found
    ForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Forbidden
    SpansUnprocessableEntityResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: Unprocessable Entity.
    FindingsBadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: 'Bad Request: The server cannot process the request due to invalid syntax in the request.'
    TooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Too many requests
    SpansBadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: Bad Request.
    UnauthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Unauthorized
    SpansForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: 'Forbidden: Access denied.'
    NotificationRulesList:
      content:
        application/json:
          schema:
            properties:
              data:
                items:
                  $ref: '#/components/schemas/NotificationRule'
                type: array
            type: object
      description: The list of notification rules.
    FindingsForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: 'Forbidden: Access denied'
    SpansTooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: 'Too many requests: The rate limit set by the API has been exceeded.'
    BadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Bad Request
  securitySchemes:
    AuthZ:
      description: This API uses OAuth 2 with the implicit grant flow.
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          scopes:
            apm_api_catalog_read: View API catalog and API definitions.
            apm_api_catalog_write: Add, modify, and delete API catalog definitions.
            apm_read: Read and query APM and Trace Analytics.
            apm_service_catalog_read: View service catalog and service definitions.
            apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
            appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source.
            cases_read: View Cases.
            cases_write: Create and update cases.
            ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API.
            ci_visibility_read: View CI Visibility.
            cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.
            cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.
            code_analysis_read: View Code Analysis.
            continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO).
            create_webhooks: Create webhooks integrations.
            dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'.
            dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'.
            dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally.
            dashboards_read: View dashboards.
            dashboards_write: Create and change dashboards.
            data_scanner_read: View Data Scanner configurations.
            data_scanner_write: Edit Data Scanner configurations.
            embeddable_graphs_share: Generate public links to share embeddable graphs externally.
            events_read: Read Events data.
            hosts_read: List hosts and their attributes.
            incident_notification_settings_write: Configure Incidents Notification settings.
            incident_read: View incidents in Datadog.
            incident_settings_write: Configure Incident Settings.
            incident_write: Create, view, and manage incidents in Datadog.
            metrics_read: View custom metrics.
            monitor_config_policy_write: Edit and delete monitor configuration.
            monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.
            monitors_read: View monitors.
            monitors_write: Edit, delete, and resolve individual monitors.
            org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.
            security_comments_read: Read comments of vulnerabilities.
            security_monitoring_filters_read: Read Security Filters.
            security_monitoring_filters_write: Create, edit, and delete Security Filters.
            security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks.
            security_monitoring_notification_profiles_read: View Rule Security Notification rules.
            security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules.
            security_monitoring_rules_read: Read Detection Rules.
            security_monitoring_rules_write: Create and edit Detection Rules.
            security_monitoring_signals_read: View Security Signals.
            security_monitoring_suppressions_read: Read Rule Suppressions.
            security_monitoring_suppressions_write: Write Rule Suppressions.
            security_pipelines_read: View Security Pipelines.
            security_pipelines_write: Create, edit, and delete CSM Security Pipelines.
            slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.
            slos_read: View SLOs and status corrections.
            slos_write: Create, edit, and delete SLOs.
            synthetics_global_variable_read: View, search, and use Synthetics global variables.
            synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics.
            synthetics_private_location_read: View, search, and use Synthetics private locations.
            synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines.
            synthetics_read: List and view configured Synthetic tests and test results.
            synthetics_write: Create, edit, and delete Synthetic tests.
            teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.
            teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.
            test_optimization_read: View Test Optimization.
            timeseries_query: Query Timeseries data.
            usage_read: View your organization's usage and usage attribution.
            user_access_invite: Invite other users to your organization.
            user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
            user_access_read: View users and their roles and settings.
            workflows_read: View workflows.
            workflows_run: Run workflows.
            workflows_write: Create, edit, and delete workflows.
          tokenUrl: /oauth2/v1/token
      type: oauth2
    apiKeyAuth:
      description: Your Datadog API Key.
      in: header
      name: DD-API-KEY
      type: apiKey
      x-env-name: DD_API_KEY
    appKeyAuth:
      description: Your Datadog APP Key.
      in: header
      name: DD-APPLICATION-KEY
      type: apiKey
      x-env-name: DD_APP_KEY
    bearerAuth:
      scheme: bearer
      type: http
      x-env-name: DD_BEARER_TOKEN
x-group-parameters: true
x-merge-override:
  paths: false