openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Update API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Update
paths:
  /api/v2/actions/connections/{connection_id}:
    patch:
      description: Update an existing Action Connection
      operationId: UpdateActionConnection
      parameters:
      - $ref: '#/components/parameters/ConnectionId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateActionConnectionRequest'
        description: Update an existing Action Connection request body
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateActionConnectionResponse'
          description: Successfully updated Action Connection
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not Found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too Many Request
      summary: Datadog Update an Existing Action Connection
      tags:
      - Update
      x-menu-order: 3
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/apicatalog/api/{id}/openapi:
    put:
      deprecated: true
      description: 'Update information about a specific API. The given content will replace all API content of the given ID.

        The ID is returned by the create API, or can be found in the URL in the API catalog UI.

        '
      operationId: UpdateOpenAPI
      parameters:
      - description: ID of the API to modify
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/ApiID'
        example: abc-123-def
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/OpenAPIFile'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateOpenAPIResponse'
          description: API updated successfully
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: API not found error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_api_catalog_write
      summary: Datadog Update an Api
      tags:
      - Update
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - apm_api_catalog_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/apm/config/metrics/{metric_id}:
    patch:
      description: 'Update a specific span-based metric from your organization.

        Returns the span-based metric object from the request body when the request is successful.'
      operationId: UpdateSpansMetric
      parameters:
      - $ref: '#/components/parameters/SpansMetricIDParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SpansMetricUpdateRequest'
        description: New definition of the span-based metric.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpansMetricResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Span-based Metric
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - apm_generate_metrics
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/apm/config/retention-filters/{filter_id}:
    put:
      description: 'Update a retention filter from your organization.


        Default filters (filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor) cannot be renamed or removed.'
      operationId: UpdateApmRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RetentionFilterIdParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RetentionFilterUpdateRequest'
        description: The updated definition of the retention filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RetentionFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Retention Filter
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - apm_retention_filter_write
        - apm_pipelines_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/app-builder/apps/{app_id}:
    patch:
      description: Update an existing app. This creates a new version of the app.
      operationId: UpdateApp
      parameters:
      - description: The ID of the app to update.
        example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
        in: path
        name: app_id
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAppRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateAppResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update App
      tags:
      - Update
      x-menu-order: 5
      x-permission:
        operator: AND
        permissions:
        - apps_write
        - connections_resolve
        - workflows_run
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cases/{case_id}/priority:
    post:
      description: Update case priority
      operationId: UpdatePriority
      parameters:
      - $ref: '#/components/parameters/CaseIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CaseUpdatePriorityRequest'
        description: Case priority update payload
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaseResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cases_write
      summary: Datadog Update Case Priority
      tags:
      - Update
      x-menu-order: 5
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cases/{case_id}/status:
    post:
      description: Update case status
      operationId: UpdateStatus
      parameters:
      - $ref: '#/components/parameters/CaseIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CaseUpdateStatusRequest'
        description: Case status update payload
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaseResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cases_write
      summary: Datadog Update Case Status
      tags:
      - Update
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/catalog/entity:
    post:
      description: Create or update entities in Software Catalog.
      operationId: UpsertCatalogEntity
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertCatalogEntityRequest'
        description: Entity YAML or JSON.
        required: true
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpsertCatalogEntityResponse'
          description: ACCEPTED
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Create or Update Entities
      tags:
      - Update
      x-codegen-request-body-name: body
      x-given:
        entity:
          parameters:
          - name: body
            value: "{\n  \"apiVersion\": \"v3\",\n  \"kind\": \"service\",\n  \"metadata\": {\n    \"name\": \"service-{{ unique_lower_alnum }}\",\n    \"displayName\": \"Shopping Cart\",\n    \"inheritFrom\": \"service:otherService\",\n    \"tags\": [\n      \"tag:value\"\n    ],\n    \"links\": [\n      {\n        \"name\": \"shopping-cart runbook\",\n        \"type\": \"runbook\",\n        \"url\": \"https://runbook/shopping-cart\"\n      },\n      {\n        \"name\": \"shopping-cart architecture\",\n        \"provider\": \"gdoc\",\n        \"url\": \"https://google.drive/shopping-cart-architecture\",\n        \"type\": \"doc\"\n      },\n      {\n        \"name\": \"shopping-cart Wiki\",\n        \"provider\": \"wiki\",\n        \"url\": \"https://wiki/shopping-cart\",\n        \"type\": \"doc\"\n      },\n      {\n        \"name\": \"shopping-cart source code\",\n        \"provider\": \"github\",\n        \"url\": \"http://github/shopping-cart\",\n        \"type\": \"repo\"\n      }\n    ],\n    \"contacts\": [\n      {\n        \"name\": \"Support Email\",\n        \"type\": \"email\",\n        \"contact\": \"team@shopping.com\"\n      },\n      {\n        \"name\": \"Support Slack\",\n        \"type\": \"slack\",\n        \"contact\": \"https://www.slack.com/archives/shopping-cart\"\n      }\n    ],\n    \"owner\": \"myteam\",\n    \"additionalOwners\": [\n      {\n        \"name\": \"opsTeam\",\n        \"type\": \"operator\"\n      }\n    ]\n  },\n  \"integrations\": {\n    \"pagerduty\": {\n      \"serviceURL\": \"https://www.pagerduty.com/service-directory/Pshopping-cart\"\n    },\n    \"opsgenie\": {\n      \"serviceURL\": \"https://www.opsgenie.com/service/shopping-cart\",\n      \"region\": \"US\"\n    }\n  },\n  \"extensions\": {\n    \"datadoghq.com/shopping-cart\": {\n      \"customField\": \"customValue\"\n    }\n  },\n  \"spec\": {\n    \"lifecycle\": \"production\",\n    \"tier\": \"1\",\n    \"type\": \"web\",\n    \"languages\": [\n      \"go\",\n      \"python\"\n    ],\n    \"dependsOn\": [\n      \"service:serviceA\",\n      \"service:serviceB\"\n    ]\n  },\n  \"datadog\": {\n    \"performanceData\": {\n      \"tags\": [\n        \"service:shopping-cart\",\n        \"hostname:shopping-cart\"\n      ]\n    },\n    \"events\": [\n      {\n        \"name\": \"deployment events\",\n        \"query\": \"app:myapp AND type:github\"\n      },\n      {\n        \"name\": \"event type B\",\n        \"query\": \"app:myapp AND type:github\"\n      }\n    ],\n    \"logs\": [\n      {\n        \"name\": \"critical logs\",\n        \"query\": \"app:myapp AND type:github\"\n      },\n      {\n        \"name\": \"ops logs\",\n        \"query\": \"app:myapp AND type:github\"\n      }\n    ],\n    \"pipelines\": {\n      \"fingerprints\": [\n        \"fp1\",\n        \"fp2\"\n      ]\n    },\n    \"codeLocations\": [\n      {\n        \"repositoryURL\": \"http://github/shopping-cart.git\",\n        \"paths\": [\n          \"baz/*.c\",\n          \"bat/**/*\",\n          \"../plop/*.java\"\n        ]\n      },\n      {\n        \"repositoryURL\": \"http://github/shopping-cart-2.git\",\n        \"paths\": [\n          \"baz/*.c\",\n          \"bat/**/*\",\n          \"../plop/*.java\"\n        ]\n      }\n    ]\n  }\n}"
          step: there is a valid entity in the system
      x-menu-order: 2
      x-undo:
        operationId: DeleteCatalogEntity
        parameters:
        - name: entity_id
          source: data[0].id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cloud_security_management/custom_frameworks/{handle}/{version}:
    put:
      description: Update a custom framework.
      operationId: UpdateCustomFramework
      parameters:
      - $ref: '#/components/parameters/CustomFrameworkHandle'
      - $ref: '#/components/parameters/CustomFrameworkVersion'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateCustomFrameworkRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateCustomFrameworkResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
        '500':
          $ref: '#/components/responses/BadRequestResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_read
        - security_monitoring_rules_write
      summary: Datadog Update a Custom Framework
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: AND
        permissions:
        - security_monitoring_rules_read
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cloud_security_management/resource_filters:
    put:
      description: Update resource filters.
      operationId: UpdateResourceEvaluationFilters
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateResourceEvaluationFiltersRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateResourceEvaluationFiltersResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_write
      summary: Datadog Update Resource Filters
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 27
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/aws_cur_config/{cloud_account_id}:
    patch:
      description: Update the status (active/archived) and/or account filtering configuration of an AWS CUR config.
      operationId: UpdateCostAWSCURConfig
      parameters:
      - $ref: '#/components/parameters/CloudAccountID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsCURConfigPatchRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AwsCURConfigsResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_write
      summary: Datadog Update Cloud Cost Management Aws Cur Config
      tags:
      - Update
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - cloud_cost_management_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/azure_uc_config/{cloud_account_id}:
    x-merge-override:
      delete: true
    patch:
      description: Update the status of an  Azure config (active/archived).
      operationId: UpdateCostAzureUCConfigs
      parameters:
      - $ref: '#/components/parameters/CloudAccountID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AzureUCConfigPatchRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureUCConfigPairsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_write
      summary: Datadog Update Cloud Cost Management Azure Config
      tags:
      - Update
      x-menu-order: 7
      x-permission:
        operator: OR
        permissions:
        - cloud_cost_management_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cost/budget:
    put:
      description: Create a new budget or update an existing one.
      operationId: UpsertBudget
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BudgetWithEntries'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BudgetWithEntries'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cloud_cost_management_write
      summary: Datadog Create or Update a Budget
      tags:
      - Update
      x-menu-order: 14
      x-undo:
        operationId: DeleteBudget
        parameters:
        - name: budget_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/dashboard/lists/manual/{dashboard_list_id}/dashboards:
    put:
      description: Update dashboards of an existing dashboard list.
      operationId: UpdateDashboardListItems
      parameters:
      - description: ID of the dashboard list to update items from.
        in: path
        name: dashboard_list_id
        required: true
        schema:
          format: int64
          type: integer
        example: 42
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DashboardListUpdateItemsRequest'
        description: New dashboards of the dashboard list.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DashboardListUpdateItemsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Items of a Dashboard List
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/downtime/{downtime_id}:
    patch:
      description: Update a downtime by `downtime_id`.
      operationId: UpdateDowntime
      parameters:
      - description: ID of the downtime to update.
        in: path
        name: downtime_id
        required: true
        schema:
          example: 00e000000-0000-1234-0000-000000000000
          type: string
        example: 00e000000-0000-1234-0000-000000000000
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DowntimeUpdateRequest'
        description: Update a downtime request body.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DowntimeResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Downtime not found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitors_downtime
      summary: Datadog Update a Downtime
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - monitors_downtime
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/config/types/{incident_type_id}:
    patch:
      description: Update an incident type.
      operationId: UpdateIncidentType
      parameters:
      - $ref: '#/components/parameters/IncidentTypeIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentTypePatchRequest'
        description: Incident type payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTypeResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Incident Type
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 22
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}:
    x-merge-override:
      delete: true
    patch:
      description: Updates an incident. Provide only the attributes that should be updated as this request is a partial update.
      operationId: UpdateIncident
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentIncludeQueryParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentUpdateRequest'
        description: Incident Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Existing Incident
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/attachments:
    patch:
      description: The bulk update endpoint for creating, updating, and deleting attachments for a given incident.
      operationId: UpdateIncidentAttachments
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentAttachmentIncludeQueryParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentAttachmentUpdateRequest'
        description: Incident Attachment Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentAttachmentUpdateResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create, Update, and Delete Incident Attachments
      tags:
      - Update
      x-codegen-request-body-name: body
      x-given:
        incident_attachment:
          parameters:
          - name: incident_id
            source: incident.data.id
          - name: body
            value: "{\n  \"data\": [\n    {\n      \"attributes\": {\n        \"attachment_type\": \"link\",\n        \"attachment\": {\n          \"documentUrl\": \"https://www.example.com/doc\",\n          \"title\": \"Important Doc\"\n        }\n      },\n      \"type\": \"incident_attachments\"\n    }\n  ]\n}"
          step: the "incident" has an "incident_attachment"
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - incident_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/relationships/integrations/{integration_metadata_id}:
    patch:
      description: Update an existing incident integration metadata.
      operationId: UpdateIncidentIntegration
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentIntegrationMetadataIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentIntegrationMetadataPatchRequest'
        description: Incident integration metadata payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentIntegrationMetadataResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Existing Incident Integration Metadata
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 12
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/relationships/todos/{todo_id}:
    patch:
      description: Update an incident todo.
      operationId: UpdateIncidentTodo
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentTodoIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentTodoPatchRequest'
        description: Incident todo payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTodoResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Incident Todo
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 17
      x-permission:
        operator: OR
        permissions:
        - incident_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/aws/accounts/{aws_account_config_id}:
    patch:
      description: Update an AWS Account Integration Config by config ID.
      operationId: UpdateAWSAccount
      parameters:
      - $ref: '#/components/parameters/AWSAccountConfigIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSAccountUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSAccountResponse'
          description: AWS Account object
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update an Aws Integration
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - aws_configuration_edit
      x-undo:
        type: idempotent
      x-unstable: '**Note: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).**'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/gcp/accounts/{account_id}:
    x-merge-override:
      patch: false
    patch:
      description: Update an STS enabled service account.
      operationId: UpdateGCPSTSAccount
      parameters:
      - $ref: '#/components/parameters/GCPSTSServiceAccountID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GCPSTSServiceAccountUpdateRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GCPSTSServiceAccountResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Sts Service Account
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - gcp_configuration_edit
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/ms-teams/configuration/tenant-based-handles/{handle_id}:
    x-merge-override:
      delete: true
      get: true
      patch: true
    patch:
      description: Update a tenant-based handle from the Datadog Microsoft Teams integration.
      operationId: UpdateTenantBasedHandle
      parameters:
      - $ref: '#/components/parameters/MicrosoftTeamsTenantBasedHandleIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MicrosoftTeamsUpdateTenantBasedHandleRequest'
        description: Tenant-based handle payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '412':
          $ref: '#/components/responses/PreconditionFailedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Tenant-based Handle
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/ms-teams/configuration/workflows-webhook-handles/{handle_id}:
    patch:
      description: Update a Workflows webhook handle from the Datadog Microsoft Teams integration.
      operationId: UpdateWorkflowsWebhookHandle
      parameters:
      - $ref: '#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MicrosoftTeamsUpdateWorkflowsWebhookHandleRequest'
        description: Workflows Webhook handle payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '412':
          $ref: '#/components/responses/PreconditionFailedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Workflows Webhook Handle
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integration/opsgenie/services/{integration_service_id}:
    x-merge-override:
      delete: true
      get: true
      patch: true
    patch:
      description: Update a single service object in the Datadog Opsgenie integration.
      operationId: UpdateOpsgenieService
      parameters:
      - $ref: '#/components/parameters/OpsgenieServiceIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OpsgenieServiceUpdateRequest'
        description: Opsgenie service payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OpsgenieServiceResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Single Service Object
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/cloudflare/accounts/{account_id}:
    x-merge-override:
      delete: true
      patch: true
    patch:
      description: Update a Cloudflare account.
      operationId: UpdateCloudflareAccount
      parameters:
      - description: None
        in: path
        name: account_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudflareAccountUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudflareAccountResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Cloudflare Account
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/confluent-cloud/accounts/{account_id}:
    x-merge-override:
      delete: true
    patch:
      description: Update the Confluent account with the provided account ID.
      operationId: UpdateConfluentAccount
      parameters:
      - $ref: '#/components/parameters/ConfluentAccountID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfluentAccountUpdateRequest'
        description: Confluent payload
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfluentAccountResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Confluent Account
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/confluent-cloud/accounts/{account_id}/resources/{resource_id}:
    x-merge-override:
      delete: true
    patch:
      description: Update a Confluent resource with the provided resource id for the account associated with the provided account ID.
      operationId: UpdateConfluentResource
      parameters:
      - $ref: '#/components/parameters/ConfluentAccountID'
      - $ref: '#/components/parameters/ConfluentResourceID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfluentResourceRequest'
        description: Confluent payload
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfluentResourceResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Resource in Confluent Account
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/fastly/accounts/{account_id}:
    x-merge-override:
      delete: true
      patch: true
    patch:
      description: Update a Fastly account.
      operationId: UpdateFastlyAccount
      parameters:
      - $ref: '#/components/parameters/FastlyAccountID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FastlyAccountUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FastlyAccountResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Fastly Account
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/fastly/accounts/{account_id}/services/{service_id}:
    x-merge-override:
      delete: true
      get: true
      patch: true
    patch:
      description: Update a Fastly service for an account.
      operationId: UpdateFastlyService
      parameters:
      - $ref: '#/components/parameters/FastlyAccountID'
      - $ref: '#/components/parameters/FastlyServiceID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FastlyServiceRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FastlyServiceResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Fastly Service
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/integrations/okta/accounts/{account_id}:
    x-merge-override:
      delete: true
      get: true
      patch: true
    patch:
      description: Update an Okta account.
      operationId: UpdateOktaAccount
      parameters:
      - description: None
        in: path
        name: account_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OktaAccountUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OktaAccountResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Okta Account
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - manage_integrations
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ip_allowlist:
    patch:
      description: Edit the entries in the IP allowlist, and enable or disable it.
      operationId: UpdateIPAllowlist
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IPAllowlistUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IPAllowlistResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - org_management
      summary: Datadog Update Ip Allowlist
      tags:
      - Update
      x-codegen-request-body-name: body
      x-given:
        ip_allowlist_empty_disabled:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"attributes\": {\n      \"enabled\": false,\n      \"entries\": []\n    },\n    \"type\": \"ip_allowlist\"\n  }\n}"
          step: the "ip_allowlist_empty_disabled" has no entries and is disabled
        ip_allowlist_nonempty_disabled:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"attributes\": {\n      \"enabled\": false,\n      \"entries\": [\n        {\n          \"data\": {\n            \"attributes\": {\n              \"cidr_block\": \"127.0.0.1\",\n              \"note\": \"{{ unique }}\"\n            },\n            \"type\": \"ip_allowlist_entry\"\n          }\n        },\n        {\n          \"data\": {\n            \"attributes\": {\n              \"cidr_block\": \"0.0.0.0\",\n              \"note\": \"{{ unique }}\"\n            },\n            \"type\": \"ip_allowlist_entry\"\n          }\n        }\n      ]\n    },\n    \"type\": \"ip_allowlist\"\n  }\n}"
          step: the "ip_allowlist_nonempty_disabled" has two entries and is disabled
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - org_management
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/archive-order:
    put:
      description: 'Update the order of your archives. Since logs are processed sequentially, reordering an archive may change

        the structure and content of the data processed by other archives.


        **Note**: Using the `PUT` method updates your archive''s order by replacing the current order

        with the new one.'
      operationId: UpdateLogsArchiveOrder
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogsArchiveOrder'
        description: An object containing the new ordered list of archive IDs.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogsArchiveOrder'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Unprocessable Entity
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Archive Order
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 10
      x-permission:
        operator: OR
        permissions:
        - logs_write_archives
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/archives/{archive_id}:
    put:
      description: 'Update a given archive configuration.


        **Note**: Using this method updates your archive configuration by **replacing**

        your current configuration with the new one sent to your Datadog organization.'
      operationId: UpdateLogsArchive
      parameters:
      - $ref: '#/components/parameters/ArchiveID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogsArchiveCreateRequest'
        description: New definition of the archive.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogsArchive'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update an Archive
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - logs_write_archives
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/custom-destinations/{custom_destination_id}:
    patch:
      description: Update the given fields of a specific custom destination in your organization.
      operationId: UpdateLogsCustomDestination
      parameters:
      - $ref: '#/components/parameters/CustomDestinationId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomDestinationUpdateRequest'
        description: New definition of the custom destination's fields.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomDestinationResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Custom Destination
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - logs_write_forwarding_rules
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/metrics/{metric_id}:
    patch:
      description: 'Update a specific log-based metric from your organization.

        Returns the log-based metric object from the request body when the request is successful.'
      operationId: UpdateLogsMetric
      parameters:
      - $ref: '#/components/parameters/MetricID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogsMetricUpdateRequest'
        description: New definition of the log-based metric.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogsMetricResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Log-based Metric
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - logs_generate_metrics
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/config/restriction_queries/{restriction_query_id}:
    patch:
      description: Edit a restriction query.
      operationId: UpdateRestrictionQuery
      parameters:
      - $ref: '#/components/parameters/RestrictionQueryID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestrictionQueryUpdatePayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestrictionQueryWithoutRelationshipsResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Restriction Query
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - user_access_manage
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/metrics/{metric_name}/tags:
    patch:
      description: 'Update the tag configuration of a metric or percentile aggregations of a distribution metric or custom aggregations

        of a count, rate, or gauge metric. By setting `exclude_tags_mode` to true the behavior is changed

        from an allow-list to a deny-list, and tags in the defined list will not be queryable.

        Can only be used with application keys from users with the `Manage Tags for Metrics` permission. This endpoint requires

        a tag configuration to be created first.'
      operationId: UpdateTagConfiguration
      parameters:
      - $ref: '#/components/parameters/MetricName'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MetricTagConfigurationUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricTagConfigurationResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Unprocessable Entity
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Too Many Requests
      summary: Datadog Update a Tag Configuration
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - metric_tags_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/monitor/notification_rule/{rule_id}:
    patch:
      description: Updates a monitor notification rule by `rule_id`.
      operationId: UpdateMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to update.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MonitorNotificationRuleUpdateRequest'
        description: Request body to update the monitor notification rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Update a Monitor Notification Rule
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 17
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ndm/tags/devices/{device_id}:
    patch:
      description: Update the tags for a device.
      operationId: UpdateDeviceUserTags
      parameters:
      - description: The id of the device to update tags for.
        example: example:1.2.3.4
        in: path
        name: device_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListTagsResponse'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTagsResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update the Tags for a Device
      tags:
      - Update
      x-menu-order: 5
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/on-call/escalation-policies/{policy_id}:
    put:
      description: Update an On-Call escalation policy
      operationId: UpdateOnCallEscalationPolicy
      parameters:
      - description: The ID of the escalation policy
        in: path
        name: policy_id
        required: true
        schema:
          example: a3000000-0000-0000-0000-000000000000
          type: string
        example: a3000000-0000-0000-0000-000000000000
      - description: 'Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`.'
        in: query
        name: include
        schema:
          type: string
        example: example_value
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EscalationPolicyUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EscalationPolicy'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Update On-call Escalation Policy
      tags:
      - Update
      x-menu-order: 6
      x-permission:
        operator: AND
        permissions:
        - on_call_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/on-call/schedules/{schedule_id}:
    put:
      description: Update a new On-Call schedule
      operationId: UpdateOnCallSchedule
      parameters:
      - description: 'Comma-separated list of included relationships to be returned. Allowed values: `teams`, `layers`, `layers.members`, `layers.members.user`.'
        in: query
        name: include
        schema:
          type: string
        example: example_value
      - description: The ID of the schedule
        in: path
        name: schedule_id
        required: true
        schema:
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduleUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Schedule'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Update On-call Schedule
      tags:
      - Update
      x-menu-order: 4
      x-permission:
        operator: AND
        permissions:
        - on_call_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/org_configs/{org_config_name}:
    patch:
      description: Update the value of a specific Org Config.
      operationId: UpdateOrgConfig
      parameters:
      - $ref: '#/components/parameters/OrgConfigName'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrgConfigWriteRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgConfigGetResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Specific Org Config
      tags:
      - Update
      x-menu-order: 102
      x-permission:
        operator: OR
        permissions:
        - org_management
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/powerpacks/{powerpack_id}:
    x-merge-override:
      delete: true
    patch:
      description: Update a powerpack.
      operationId: UpdatePowerpack
      parameters:
      - description: ID of the powerpack.
        in: path
        name: powerpack_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Powerpack'
        description: Update a powerpack request body.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PowerpackResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Powerpack Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - dashboards_write
      summary: Datadog Update a Powerpack
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - dashboards_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}:
    put:
      description: 'Update a specific WAF custom Rule.

        Returns the Custom Rule object when the request is successful.'
      operationId: UpdateApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateRequest'
        description: New definition of the WAF Custom Rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Waf Custom Rule
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/exclusion_filters/{exclusion_filter_id}:
    put:
      description: 'Update a specific WAF exclusion filter using its identifier.

        Returns the exclusion filter object when the request is successful.'
      operationId: UpdateApplicationSecurityWafExclusionFilter
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafExclusionFilterID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateRequest'
        description: The exclusion filter to update.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Waf Exclusion Filter
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 5
      x-permission:
        operator: AND
        permissions:
        - appsec_protect_write
      x-terraform-resource: appsec_waf_exclusion_filter
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}:
    patch:
      description: 'Update a specific Workload Protection Agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: UpdateCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/policy/{policy_id}:
    patch:
      description: 'Update a specific Workload Protection policy.

        Returns the policy object when the request is successful.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: UpdateCSMThreatsAgentPolicy
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateRequest'
        description: New definition of the Agent policy
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Policy
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/obs_pipelines/pipelines/{pipeline_id}:
    put:
      description: Update a pipeline.
      operationId: UpdatePipeline
      parameters:
      - description: The ID of the pipeline to update.
        in: path
        name: pipeline_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObservabilityPipeline'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObservabilityPipeline'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Pipeline
      tags:
      - Update
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - observability_pipelines_deploy
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in Preview.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/restriction_policy/{resource_id}:
    post:
      description: 'Updates the restriction policy associated with a resource.


        #### Supported resources

        Restriction policies can be applied to the following resources:

        - Dashboards: `dashboard`

        - Integration Accounts: `integration-account`

        - Integration Services: `integration-service`

        - Integration Webhooks: `integration-webhook`

        - Notebooks: `notebook`

        - Powerpacks: `powerpack`

        - Reference Tables: `reference-table`

        - Security Rules: `security-rule`

        - Service Level Objectives: `slo`

        - Synthetic Global Variables: `synthetics-global-variable`

        - Synthetic Tests: `synthetics-test`

        - Synthetic Private Locations: `synthetics-private-location`

        - Monitors: `monitor`

        - Workflows: `workflow`

        - App Builder Apps: `app-builder-app`

        - Connections: `connection`

        - Connection Groups: `connection-group`

        - RUM Applications: `rum-application`


        #### Supported relations for resources

        Resource Type               | Supported Relations

        ----------------------------|--------------------------

        Dashboards                  | `viewer`, `editor`

        Integration Accounts        | `viewer`, `editor`

        Integration Services        | `viewer`, `editor`

        Integration Webhooks        | `viewer`, `editor`

        Notebooks                   | `viewer`, `editor`

        Powerpacks                  | `viewer`, `editor`

        Security Rules              | `viewer`, `editor`

        Service Level Objectives    | `viewer`, `editor`

        Synthetic Global Variables  | `viewer`, `editor`

        Synthetic Tests             | `viewer`, `editor`

        Synthetic Private Locations | `viewer`, `editor`

        Monitors                    | `viewer`, `editor`

        Reference Tables            | `viewer`, `editor`

        Workflows                   | `viewer`, `runner`, `editor`

        App Builder Apps            | `viewer`, `editor`

        Connections                 | `viewer`, `resolver`, `editor`

        Connection Groups           | `viewer`, `editor`

        RUM Application             | `viewer`, `editor`'
      operationId: UpdateRestrictionPolicy
      parameters:
      - $ref: '#/components/parameters/ResourceID'
      - description: Allows admins (users with the `user_access_manage` permission) to remove their own access from the resource if set to `true`. By default, this is set to `false`, preventing admins from locking themselves out.
        in: query
        name: allow_self_lockout
        required: false
        schema:
          type: boolean
        example: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestrictionPolicyUpdateRequest'
        description: Restriction policy payload
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestrictionPolicyResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Update a Restriction Policy
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-permission:
        operator: OPEN
        permissions: []
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/roles/{role_id}:
    x-merge-override:
      delete: true
      patch: true
    patch:
      description: Edit a role. Can only be used with application keys belonging to administrators.
      operationId: UpdateRole
      parameters:
      - $ref: '#/components/parameters/RoleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleUpdateResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Unprocessable Entity
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_manage
      summary: Datadog Update a Role
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - user_access_manage
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/applications/{app_id}/retention_filters/{rf_id}:
    patch:
      description: 'Update a RUM retention filter for a RUM application.

        Returns RUM retention filter objects from the request body when the request is successful.'
      operationId: UpdateRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RumApplicationIDParameter'
      - $ref: '#/components/parameters/RumRetentionFilterIDParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RumRetentionFilterUpdateRequest'
        description: New definition of the RUM retention filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RumRetentionFilterResponse'
          description: Updated
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Rum Retention Filter
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/applications/{id}:
    x-merge-override:
      delete: true
      get: false
      patch: false
    patch:
      description: Update the RUM application with given ID in your organization.
      operationId: UpdateRUMApplication
      parameters:
      - description: RUM application ID.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RUMApplicationUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RUMApplicationResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Unprocessable Entity.
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Rum Application
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - rum_apps_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/config/metrics/{metric_id}:
    patch:
      description: 'Update a specific rum-based metric from your organization.

        Returns the rum-based metric object from the request body when the request is successful.'
      operationId: UpdateRumMetric
      parameters:
      - $ref: '#/components/parameters/RumMetricIDParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RumMetricUpdateRequest'
        description: New definition of the rum-based metric.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RumMetricResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Rum-based Metric
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scim/Groups/{group_id}:
    put:
      description: Update the group with the given `group_id`.
      operationId: UpdateSCIMGroup
      parameters:
      - description: None
        in: path
        name: group_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            examples:
              json-request-body:
                value:
                  displayName: Group 1
                  externalId: group1
                  id: e43536e9-33fe-43f8-90b8-d3e39a7dd6ad
                  members:
                  - $ref: https://app.datadoghq.com/api/scim/v2/Users/d34a5f93-5690-4d3f-a293-f2ad5c7a82a4
                    display: John Doe
                    type: User
                    value: d34a5f93-5690-4d3f-a293-f2ad5c7a82a4
                  - $ref: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
                    display: Jane Doe
                    type: User
                    value: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
                  schemas:
                  - urn:ietf:params:scim:schemas:core:2.0:Group
            schema:
              $ref: '#/components/schemas/ExternalUserGroup'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalUserGroup'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - bearerAuth: []
      summary: Datadog Update Group
      tags:
      - Update
      x-menu-order: 10
      x-permission:
        operator: AND
        permissions:
        - user_access_invite
        - user_access_manage
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scim/Users/{user_uuid}:
    put:
      description: Update the user with the given `user_uuid`.
      operationId: UpdateSCIMUser
      parameters:
      - description: None
        in: path
        name: user_uuid
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            examples:
              json-request-body:
                value:
                  active: true
                  emails:
                  - primary: true
                    type: work
                    value: john.doe@datadoghq.com
                  id: e43536e9-33fe-43f8-90b8-d3e39a7dd6ad
                  name:
                    formatted: John Doe
                  schemas:
                  - urn:ietf:params:scim:schemas:core:2.0:User
                  title: Mr.
                  userName: john.doe@datadoghq.com
            schema:
              $ref: '#/components/schemas/ExternalUser'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalUser'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - bearerAuth: []
      summary: Datadog Update User
      tags:
      - Update
      x-menu-order: 4
      x-permission:
        operator: AND
        permissions:
        - user_access_invite
        - user_access_manage
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules/{rule_id}:
    put:
      description: Updates an existing rule.
      operationId: UpdateScorecardRule
      parameters:
      - $ref: '#/components/parameters/RuleId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRuleRequest'
        description: Rule attributes.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRuleResponse'
          description: Rule updated successfully
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Update an Existing Rule
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}:
    patch:
      description: 'Update a specific agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: UpdateCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule (us1-fed)
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/configuration/security_filters/{security_filter_id}:
    patch:
      description: 'Update a specific security filter.

        Returns the security filter object when the request is successful.'
      operationId: UpdateSecurityFilter
      parameters:
      - $ref: '#/components/parameters/SecurityFilterID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityFilterUpdateRequest'
        description: New definition of the security filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_write
      summary: Datadog Update a Security Filter
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
    patch:
      description: Update a specific suppression rule.
      operationId: UpdateSecurityMonitoringSuppression
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringSuppressionID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateRequest'
        description: New definition of the suppression rule. Supports partial updates.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_write
      summary: Datadog Update a Suppression Rule
      tags:
      - Update
      x-menu-order: 0
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}:
    put:
      description: 'Update an existing rule. When updating `cases`, `queries` or `options`, the whole field

        must be included. For example, when modifying a query all queries must be included.

        Default rules can only be updated to be enabled, to change notifications, or to update

        the tags (default tags cannot be removed).'
      operationId: UpdateSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleUpdatePayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Update an Existing Rule
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config/groups/{group_id}:
    patch:
      description: 'Update a group, including the order of the rules.

        Rules within the group are reordered by including a rules relationship. If the rules

        relationship is present, its data section MUST contain linkages for all of the rules

        currently in the group, and MUST NOT contain any others.'
      operationId: UpdateScanningGroup
      parameters:
      - $ref: '#/components/parameters/SensitiveDataScannerGroupID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SensitiveDataScannerGroupUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerGroupUpdateResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Scanning Group
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - data_scanner_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config/rules/{rule_id}:
    patch:
      description: 'Update a scanning rule.

        The request body MUST NOT include a standard_pattern relationship, as that relationship

        is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern

        relationship will also result in an error.'
      operationId: UpdateScanningRule
      parameters:
      - $ref: '#/components/parameters/SensitiveDataScannerRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SensitiveDataScannerRuleUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerRuleUpdateResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Scanning Rule
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - data_scanner_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/services/definitions:
    post:
      description: Create or update service definition in the Datadog Service Catalog.
      operationId: CreateOrUpdateServiceDefinitions
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceDefinitionsCreateRequest'
        description: Service Definition YAML/JSON.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceDefinitionCreateResponse'
          description: CREATED
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Create or Update Service Definition
      tags:
      - Update
      x-codegen-request-body-name: body
      x-given:
        service_definition:
          parameters:
          - name: body
            value: "{\n  \"dd-service\": \"service-{{ unique_lower_alnum }}\",\n  \"dd-team\": \"my-team\",\n  \"docs\": [{\"name\": \"Architecture\",\n            \"provider\": \"google drive\",\n            \"url\": \"https://gdrive/mygivedoc\"}],\n  \"extensions\": {\"frogextension\": \"extensionfrogvalue\"},\n  \"integrations\": {\"opsgenie\": {\"region\": \"US\",\n                                \"service-url\": \"https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000\"},\n                   \"pagerduty\": \"https://my-org.pagerduty.com/service-directory/PMyService\"},\n  \"links\": [{\"name\": \"Runbook\", \"type\": \"runbook\", \"url\": \"https://my-runbook\"}],\n  \"repos\": [{\"name\": \"Source Code\",\n             \"provider\": \"GitHub\",\n             \"url\": \"https://github.com/DataDog/given\"}],\n  \"schema-version\": \"v2\",\n  \"tags\": [\"this:tag\", \"service:tag\"],\n  \"team\": \"super-team\"\n}"
          step: there is a valid "service_definition" in the system
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - apm_service_catalog_write
      x-undo:
        operationId: DeleteServiceDefinition
        parameters:
        - name: service_name
          source: data[0].attributes.schema.dd-service
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/services/{service_id}:
    patch:
      deprecated: true
      description: Updates an existing incident service. Only provide the attributes which should be updated as this request is a partial update.
      operationId: UpdateIncidentService
      parameters:
      - $ref: '#/components/parameters/IncidentServiceIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentServiceUpdateRequest'
        description: Incident Service Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentServiceResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Existing Incident Service
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/team/{team_id}:
    x-merge-override:
      delete: true
      get: false
      patch: false
    patch:
      description: 'Update a team using the team''s `id`.

        If the `team_links` relationship is present, the associated links are updated to be in the order they appear in the array, and any existing team links not present are removed.'
      operationId: UpdateTeam
      parameters:
      - description: None
        in: path
        name: team_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: API error response.
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: API error response.
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: API error response.
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - teams_read
      summary: Datadog Update a Team
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - teams_read
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/team/{team_id}/links/{link_id}:
    patch:
      description: Update a team link.
      operationId: UpdateTeamLink
      parameters:
      - description: None
        in: path
        name: team_id
        required: true
        schema:
          type: string
        example: abc-123-def
      - description: None
        in: path
        name: link_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamLinkCreateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamLinkResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: API error response.
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - teams_read
      summary: Datadog Update a Team Link
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 13
      x-permission:
        operator: OR
        permissions:
        - teams_read
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/team/{team_id}/memberships/{user_id}:
    x-merge-override:
      delete: true
    patch:
      description: Update a user's membership attributes on a team.
      operationId: UpdateTeamMembership
      parameters:
      - description: None
        in: path
        name: team_id
        required: true
        schema:
          type: string
        example: abc-123-def
      - description: None
        in: path
        name: user_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserTeamUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTeamResponse'
          description: Represents a user's association to a team
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: API error response.
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - teams_read
      summary: Datadog Update a User's Membership Attributes on a Team
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - teams_read
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/team/{team_id}/permission-settings/{action}:
    put:
      description: Update a team permission setting for a given team.
      operationId: UpdateTeamPermissionSetting
      parameters:
      - description: None
        in: path
        name: team_id
        required: true
        schema:
          type: string
        example: abc-123-def
      - description: None
        in: path
        name: action
        required: true
        schema:
          type: string
        example: example_value
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamPermissionSettingUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamPermissionSettingResponse'
          description: OK
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: API error response.
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - teams_read
      summary: Datadog Update Permission Setting for Team
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 18
      x-permission:
        operator: OR
        permissions:
        - teams_read
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/teams/{team_id}:
    patch:
      deprecated: true
      description: Updates an existing incident team. Only provide the attributes which should be updated as this request is a partial update.
      operationId: UpdateIncidentTeam
      parameters:
      - $ref: '#/components/parameters/IncidentTeamIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentTeamUpdateRequest'
        description: Incident Team Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTeamResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Existing Incident Team
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/users/{user_id}:
    x-merge-override:
      delete: true
    patch:
      description: 'Edit a user. Can only be used with an application key belonging

        to an administrator user.'
      operationId: UpdateUser
      parameters:
      - $ref: '#/components/parameters/UserID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication error
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Unprocessable Entity
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - user_access_manage
      summary: Datadog Update a User
      tags:
      - Update
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - user_access_manage
        - service_account_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/workflows/{workflow_id}:
    patch:
      description: Update a workflow by ID. This API requires an application key scoped with the `workflows_write` permission.
      operationId: UpdateWorkflow
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWorkflowRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateWorkflowResponse'
          description: Successfully updated a workflow.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too many requests
      summary: Datadog Update an Existing Workflow
      tags:
      - Update
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - workflows_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ServiceDefinitionV2:
      description: Service definition V2 for providing service metadata and integrations.
      properties:
        contacts:
          description: A list of contacts related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Contact'
          type: array
        dd-service:
          description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog.
          example: my-service
          type: string
        dd-team:
          description: Experimental feature. A Team handle that matches a Team in the Datadog Teams product.
          example: my-team
          type: string
        docs:
          description: A list of documentation related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Doc'
          type: array
        extensions:
          additionalProperties: {}
          description: Extensions to V2 schema.
          example:
            myorg/extension: extensionValue
          type: object
        integrations:
          $ref: '#/components/schemas/ServiceDefinitionV2Integrations'
        links:
          description: A list of links related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Link'
          type: array
        repos:
          description: A list of code repositories related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Repo'
          type: array
        schema-version:
          $ref: '#/components/schemas/ServiceDefinitionV2Version'
        tags:
          description: A set of custom tags.
          example:
          - my:tag
          - service:tag
          items:
            type: string
          type: array
        team:
          description: Team that owns the service.
          example: my-team
          type: string
      required:
      - schema-version
      - dd-service
      type: object
    ScheduleMemberRelationshipsUserDataType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    LogsArchiveDestinationAzure:
      description: The Azure archive destination.
      properties:
        container:
          description: The container where the archive will be stored.
          example: container-name
          type: string
        integration:
          $ref: '#/components/schemas/LogsArchiveIntegrationAzure'
        path:
          description: The archive path.
          type: string
          example: example_value
        region:
          description: The region where the archive will be stored.
          type: string
          example: example_value
        storage_account:
          description: The associated storage account.
          example: account-name
          type: string
        type:
          $ref: '#/components/schemas/LogsArchiveDestinationAzureType'
      required:
      - storage_account
      - container
      - integration
      - type
      type: object
    ActionQueryCondition:
      description: Whether to run this query. If specified, the query will only run if this condition evaluates to `true` in JavaScript and all other conditions are also met.
      oneOf:
      - type: boolean
      - example: ${true}
        type: string
    OrganizationAttributes:
      description: Attributes of the organization.
      properties:
        created_at:
          description: Creation time of the organization.
          format: date-time
          type: string
          example: example_value
        description:
          description: Description of the organization.
          type: string
          example: example_value
        disabled:
          description: Whether or not the organization is disabled.
          type: boolean
          example: true
        modified_at:
          description: Time of last organization modification.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the organization.
          type: string
          example: Example Monitor
        public_id:
          description: Public ID of the organization.
          type: string
          example: abc-123-def
        sharing:
          description: Sharing type of the organization.
          type: string
          example: example_value
        url:
          description: URL of the site that this organization exists at.
          type: string
          example: https://app.datadoghq.com
      type: object
    ServiceDefinitionV2Dot1SlackType:
      description: Contact type.
      enum:
      - slack
      example: slack
      type: string
      x-enum-varnames:
      - SLACK
    ListTagsResponse:
      description: List tags response.
      properties:
        data:
          $ref: '#/components/schemas/ListTagsResponseData'
      type: object
    OrgConfigReadAttributes:
      description: Readable attributes of an Org Config.
      properties:
        description:
          description: The description of an Org Config.
          example: Frobulate the turbo encabulator manifold
          type: string
        modified_at:
          description: The timestamp of the last Org Config update (if any).
          format: date-time
          nullable: true
          type: string
          example: example_value
        name:
          description: The machine-friendly name of an Org Config.
          example: monitor_timezone
          type: string
        value:
          description: The value of an Org Config.
          example: example_value
        value_type:
          description: The type of an Org Config value.
          example: bool
          type: string
      required:
      - name
      - description
      - value_type
      - value
      type: object
    ScheduleUpdateRequestDataAttributesLayersItems:
      description: 'Represents a layer within a schedule update, including rotation details, members,

        and optional restrictions.'
      properties:
        effective_date:
          description: When this updated layer takes effect (ISO 8601 format).
          example: '2025-02-03T05:00:00Z'
          format: date-time
          type: string
        end_date:
          description: When this updated layer should stop being active (ISO 8601 format).
          example: '2025-12-31T00:00:00Z'
          format: date-time
          type: string
        id:
          description: A unique identifier for the layer being updated.
          example: 00000000-0000-0000-0000-000000000001
          type: string
        interval:
          $ref: '#/components/schemas/LayerAttributesInterval'
        members:
          description: The members assigned to this layer.
          items:
            $ref: '#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItems'
          type: array
        name:
          description: The name for this layer (for example, "Secondary Coverage").
          example: Primary On-Call Layer
          type: string
        restrictions:
          description: Any time restrictions that define when this layer is active.
          items:
            $ref: '#/components/schemas/TimeRestriction'
          type: array
        rotation_start:
          description: The date/time at which the rotation begins (ISO 8601 format).
          example: '2025-02-01T00:00:00Z'
          format: date-time
          type: string
      required:
      - effective_date
      - interval
      - members
      - name
      - rotation_start
      type: object
    CustomConnectionAttributesOnPremRunner:
      description: Information about the Private Action Runner used by the custom connection, if the custom connection is associated with a Private Action Runner.
      properties:
        id:
          description: The Private Action Runner ID.
          type: string
          example: abc-123-def
        url:
          description: The URL of the Private Action Runner.
          type: string
          example: https://app.datadoghq.com
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction:
      description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content.
      enum:
      - hash
      example: hash
      type: string
      x-enum-varnames:
      - HASH
    RelationshipToRuleDataObject:
      description: Rule relationship data.
      properties:
        id:
          description: The unique ID for a scorecard.
          example: q8MQxk8TCqrHnWkp
          type: string
        type:
          $ref: '#/components/schemas/ScorecardType'
      type: object
    RelationshipToTeamLinks:
      description: Relationship between a team and a team link
      properties:
        data:
          description: Related team links
          items:
            $ref: '#/components/schemas/RelationshipToTeamLinkData'
          type: array
        links:
          $ref: '#/components/schemas/TeamRelationshipsLinks'
      type: object
      x-merge-override:
        required: false
    TeamPermissionSettingSerializerAction:
      description: The identifier for the action
      enum:
      - manage_membership
      - edit
      readOnly: true
      type: string
      x-enum-varnames:
      - MANAGE_MEMBERSHIP
      - EDIT
    FastlyServiceType:
      default: fastly-services
      description: The JSON:API type for this API. Should always be `fastly-services`.
      enum:
      - fastly-services
      example: fastly-services
      type: string
      x-enum-varnames:
      - FASTLY_SERVICES
    SpansMetricGroupBy:
      description: A group by rule.
      properties:
        path:
          description: The path to the value the span-based metric will be aggregated over.
          example: resource_name
          type: string
        tag_name:
          description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name.
          example: resource_name
          type: string
      required:
      - path
      type: object
    AccountFilteringConfig:
      description: The account filtering configuration.
      properties:
        excluded_accounts:
          description: The AWS account IDs to be excluded from your billing dataset. This field is used when `include_new_accounts` is `true`.
          example:
          - '123456789123'
          - '123456789143'
          items:
            type: string
          type: array
        include_new_accounts:
          description: Whether or not to automatically include new member accounts by default in your billing dataset.
          example: true
          type: boolean
        included_accounts:
          description: The AWS account IDs to be included in your billing dataset. This field is used when `include_new_accounts` is `false`.
          example:
          - '123456789123'
          - '123456789143'
          items:
            type: string
          type: array
      type: object
    EntityToOncalls:
      description: Entity to oncalls relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipArray'
      type: object
    ScheduleUpdateRequestDataAttributes:
      description: Defines the updatable attributes for a schedule, such as name, time zone, and layers.
      properties:
        layers:
          description: The updated list of layers (rotations) for this schedule.
          items:
            $ref: '#/components/schemas/ScheduleUpdateRequestDataAttributesLayersItems'
          type: array
        name:
          description: A short name for the schedule.
          example: Primary On-Call
          type: string
        time_zone:
          description: The time zone used when interpreting rotation times.
          example: America/New_York
          type: string
      required:
      - name
      - time_zone
      - layers
      type: object
    ServiceNowTicket:
      description: ServiceNow ticket attached to case
      nullable: true
      properties:
        result:
          $ref: '#/components/schemas/ServiceNowTicketResult'
        status:
          $ref: '#/components/schemas/Case3rdPartyTicketStatus'
      readOnly: true
      type: object
    TeamRelationships:
      description: Resources related to a team
      properties:
        team_links:
          $ref: '#/components/schemas/RelationshipToTeamLinks'
        user_team_permissions:
          $ref: '#/components/schemas/RelationshipToUserTeamPermission'
      type: object
    DashboardListUpdateItemsResponse:
      description: Response containing a list of updated dashboards.
      properties:
        dashboards:
          description: List of dashboards in the dashboard list.
          items:
            $ref: '#/components/schemas/DashboardListItemResponse'
          type: array
      type: object
    ObservabilityPipelineDedupeProcessorMode:
      description: The deduplication mode to apply to the fields.
      enum:
      - match
      - ignore
      example: match
      type: string
      x-enum-varnames:
      - MATCH
      - IGNORE
    ConfluentResourceType:
      default: confluent-cloud-resources
      description: The JSON:API type for this request.
      enum:
      - confluent-cloud-resources
      example: confluent-cloud-resources
      type: string
      x-enum-varnames:
      - CONFLUENT_CLOUD_RESOURCES
    LogsMetricUpdateCompute:
      description: The compute rule to compute the log-based metric.
      properties:
        include_percentiles:
          $ref: '#/components/schemas/LogsMetricComputeIncludePercentiles'
      type: object
    Deployment:
      description: The version of the app that was published.
      properties:
        attributes:
          $ref: '#/components/schemas/DeploymentAttributes'
        id:
          description: The deployment ID.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        meta:
          $ref: '#/components/schemas/DeploymentMetadata'
        type:
          $ref: '#/components/schemas/AppDeploymentType'
      type: object
    RelationshipToUserTeamTeamData:
      description: The team associated with the membership
      properties:
        id:
          description: The ID of the team associated with the membership
          example: d7e15d9d-d346-43da-81d8-3d9e71d9a5e9
          type: string
        type:
          $ref: '#/components/schemas/UserTeamTeamType'
      required:
      - id
      - type
      type: object
    EntityV3DatastoreDatadog:
      additionalProperties: false
      description: Datadog product integrations for the datastore entity.
      properties:
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
      type: object
      x-ignore-duplicate-object: true
    AzureStorageDestinationType:
      default: azure_storage
      description: The destination type. The value should always be `azure_storage`.
      enum:
      - azure_storage
      example: azure_storage
      type: string
      x-enum-varnames:
      - AZURE_STORAGE
    CloudWorkloadSecurityAgentRuleUpdaterAttributes:
      description: The attributes of the user who last updated the Agent rule
      properties:
        handle:
          description: The handle of the user
          example: datadog.user@example.com
          type: string
        name:
          description: The name of the user
          example: Datadog User
          nullable: true
          type: string
      type: object
    ObservabilityPipelineMetadataEntry:
      description: A custom metadata entry.
      properties:
        name:
          description: The metadata key.
          example: environment
          type: string
        value:
          description: The metadata value.
          example: production
          type: string
      required:
      - name
      - value
      type: object
    DashboardListUpdateItemsRequest:
      description: Request containing the list of dashboards to update to.
      properties:
        dashboards:
          description: List of dashboards to update the dashboard list to.
          items:
            $ref: '#/components/schemas/DashboardListItemRequest'
          type: array
      type: object
    PowerpackGroupWidgetDefinition:
      description: Powerpack group widget object.
      properties:
        layout_type:
          description: Layout type of widgets.
          example: ordered
          type: string
        show_title:
          description: Boolean indicating whether powerpack group title should be visible or not.
          example: true
          type: boolean
        title:
          description: Name for the group widget.
          example: Sample Powerpack
          type: string
        type:
          description: Type of widget, must be group.
          example: group
          type: string
        widgets:
          description: Widgets inside the powerpack.
          example:
          - definition:
              content: example
              type: note
            layout:
              height: 5
              width: 10
              x: 0
              y: 0
          items:
            $ref: '#/components/schemas/PowerpackInnerWidgets'
          type: array
      required:
      - widgets
      - layout_type
      - type
      type: object
    Permission:
      description: Permission object.
      properties:
        attributes:
          $ref: '#/components/schemas/PermissionAttributes'
        id:
          description: ID of the permission.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/PermissionsType'
      required:
      - type
      type: object
    ScheduleUpdateRequestDataRelationships:
      description: Houses relationships for the schedule update, typically referencing teams.
      properties:
        teams:
          $ref: '#/components/schemas/DataRelationshipsTeams'
      type: object
    TeamReference:
      description: Provides a reference to a team, including ID, type, and basic attributes/relationships.
      properties:
        attributes:
          $ref: '#/components/schemas/TeamReferenceAttributes'
        id:
          description: The team's unique identifier.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/TeamReferenceType'
      required:
      - type
      type: object
    LogsArchiveIntegrationGCS:
      description: The GCS archive's integration destination.
      properties:
        client_email:
          description: A client email.
          example: youremail@example.com
          type: string
        project_id:
          description: A project ID.
          example: project-id
          type: string
      required:
      - client_email
      type: object
    CustomDestinationUpdateRequestAttributes:
      description: The attributes associated with the custom destination.
      properties:
        enabled:
          default: true
          description: Whether logs matching this custom destination should be forwarded or not.
          example: true
          type: boolean
        forward_tags:
          default: true
          description: Whether tags from the forwarded logs should be forwarded or not.
          example: true
          type: boolean
        forward_tags_restriction_list:
          default: []
          description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be restricted from being forwarded.

            An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.'
          example:
          - datacenter
          - host
          items:
            description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags).
            type: string
          maxItems: 10
          minItems: 0
          type: array
        forward_tags_restriction_list_type:
          $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType'
        forwarder_destination:
          $ref: '#/components/schemas/CustomDestinationForwardDestination'
        name:
          description: The custom destination name.
          example: Nginx logs
          type: string
        query:
          default: ''
          description: The custom destination query and filter. Logs matching this query are forwarded to the destination.
          example: source:nginx
          type: string
      type: object
    CustomDestinationHttpDestinationAuthCustomHeader:
      description: Custom header access authentication.
      properties:
        header_name:
          description: The header name of the authentication.
          example: CUSTOM-HEADER-NAME
          type: string
        header_value:
          description: The header value of the authentication. This field is not returned by the API.
          example: CUSTOM-HEADER-AUTHENTICATION-VALUE
          type: string
          writeOnly: true
        type:
          $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeaderType'
      required:
      - type
      - header_name
      - header_value
      type: object
    ActionConnectionDataUpdate:
      description: Data related to the connection update.
      properties:
        attributes:
          $ref: '#/components/schemas/ActionConnectionAttributesUpdate'
        type:
          $ref: '#/components/schemas/ActionConnectionDataType'
      required:
      - type
      - attributes
      type: object
    GCPSTSServiceAccountAttributes:
      description: Attributes associated with your service account.
      properties:
        account_tags:
          description: Tags to be associated with GCP metrics and service checks from your account.
          items:
            description: Account Level Tag
            type: string
          type: array
        automute:
          description: Silence monitors for expected GCE instance shutdowns.
          type: boolean
          example: true
        client_email:
          description: Your service account email address.
          example: datadog-service-account@test-project.iam.gserviceaccount.com
          type: string
        cloud_run_revision_filters:
          description: 'List of filters to limit the Cloud Run revisions that are pulled into Datadog by using tags.

            Only Cloud Run revision resources that apply to specified filters are imported into Datadog.'
          example:
          - $KEY:$VALUE
          items:
            description: Cloud Run Filters
            type: string
          type: array
        host_filters:
          description: Your Host Filters.
          items:
            description: Host Filters
            type: string
          type: array
        is_cspm_enabled:
          description: 'When enabled, Datadog will activate the Cloud Security Monitoring product for this service account. Note: This requires resource_collection_enabled to be set to true.'
          type: boolean
          example: true
        is_per_project_quota_enabled:
          default: false
          description: When enabled, Datadog applies the `X-Goog-User-Project` header, attributing Google Cloud billing and quota usage to the project being monitored rather than the default service account project.
          example: true
          type: boolean
        is_resource_change_collection_enabled:
          default: false
          description: When enabled, Datadog scans for all resource change data in your Google Cloud environment.
          example: true
          type: boolean
        is_security_command_center_enabled:
          default: false
          description: 'When enabled, Datadog will attempt to collect Security Command Center Findings. Note: This requires additional permissions on the service account.'
          example: true
          type: boolean
        metric_namespace_configs:
          description: Configurations for GCP metric namespaces.
          example:
          - disabled: true
            id: aiplatform
          items:
            $ref: '#/components/schemas/GCPMetricNamespaceConfig'
          type: array
        resource_collection_enabled:
          description: When enabled, Datadog scans for all resources in your GCP environment.
          type: boolean
          example: true
      type: object
      x-merge-override:
        required: false
    ServiceDefinitionV2Dot2:
      description: Service definition v2.2 for providing service metadata and integrations.
      properties:
        application:
          description: Identifier for a group of related services serving a product feature, which the service is a part of.
          example: my-app
          type: string
        ci-pipeline-fingerprints:
          description: A set of CI fingerprints.
          example:
          - j88xdEy0J5lc
          - eZ7LMljCk8vo
          items:
            type: string
          type: array
        contacts:
          description: A list of contacts related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Dot2Contact'
          type: array
        dd-service:
          description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog.
          example: my-service
          type: string
        description:
          description: A short description of the service.
          example: My service description
          type: string
        extensions:
          additionalProperties: {}
          description: Extensions to v2.2 schema.
          example:
            myorg/extension: extensionValue
          type: object
        integrations:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot2Integrations'
        languages:
          description: 'The service''s programming language. Datadog recognizes the following languages: `dotnet`, `go`, `java`, `js`, `php`, `python`, `ruby`, and `c++`.'
          example:
          - dotnet
          - go
          - java
          - js
          - php
          - python
          - ruby
          - c++
          items:
            type: string
          type: array
        lifecycle:
          description: The current life cycle phase of the service.
          example: sandbox
          type: string
        links:
          description: A list of links related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Dot2Link'
          type: array
        schema-version:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot2Version'
        tags:
          description: A set of custom tags.
          example:
          - my:tag
          - service:tag
          items:
            type: string
          type: array
        team:
          description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists.
          example: my-team
          type: string
        tier:
          description: Importance of the service.
          example: High
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot2Type'
      required:
      - schema-version
      - dd-service
      type: object
    AzureUCConfigPair:
      description: Azure config pair.
      properties:
        attributes:
          $ref: '#/components/schemas/AzureUCConfigPairAttributes'
        id:
          description: The ID of Cloud Cost Management account.
          format: int64
          type: integer
          example: 42
        type:
          $ref: '#/components/schemas/AzureUCConfigPairType'
      required:
      - attributes
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineSyslogNgDestinationType:
      default: syslog_ng
      description: The destination type. The value should always be `syslog_ng`.
      enum:
      - syslog_ng
      example: syslog_ng
      type: string
      x-enum-varnames:
      - SYSLOG_NG
    PowerpackAttributes:
      description: Powerpack attribute object.
      properties:
        description:
          description: Description of this powerpack.
          example: Powerpack for ABC
          type: string
        group_widget:
          $ref: '#/components/schemas/PowerpackGroupWidget'
        name:
          description: Name of the powerpack.
          example: Sample Powerpack
          type: string
        tags:
          description: List of tags to identify this powerpack.
          example:
          - tag:foo1
          items:
            maxLength: 80
            type: string
          maxItems: 8
          type: array
        template_variables:
          description: List of template variables for this powerpack.
          example:
          - defaults:
            - '*'
            name: test
          items:
            $ref: '#/components/schemas/PowerpackTemplateVariable'
          type: array
      required:
      - group_widget
      - name
      type: object
    ObservabilityPipelineEnrichmentTableFileEncodingType:
      description: Specifies the encoding format (e.g., CSV) used for enrichment tables.
      enum:
      - csv
      example: csv
      type: string
      x-enum-varnames:
      - CSV
    ServiceDefinitionsCreateRequest:
      description: Create service definitions request.
      oneOf:
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot2'
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot1'
      - $ref: '#/components/schemas/ServiceDefinitionV2'
      - $ref: '#/components/schemas/ServiceDefinitionRaw'
    ObservabilityPipelineFluentdSourceType:
      default: fluentd
      description: The source type. The value should always be `fluentd.
      enum:
      - fluentd
      example: fluentd
      type: string
      x-enum-varnames:
      - FLUENTD
    RetentionFilterAll:
      description: The definition of the retention filter.
      properties:
        attributes:
          $ref: '#/components/schemas/RetentionFilterAllAttributes'
        id:
          description: The ID of the retention filter.
          example: 7RBOb7dLSYWI01yc3pIH8w
          type: string
        type:
          $ref: '#/components/schemas/ApmRetentionFilterType'
      required:
      - id
      - type
      - attributes
      type: object
    IPAllowlistAttributes:
      description: Attributes of the IP allowlist.
      properties:
        enabled:
          description: Whether the IP allowlist logic is enabled or not.
          type: boolean
          example: true
        entries:
          description: Array of entries in the IP allowlist.
          items:
            $ref: '#/components/schemas/IPAllowlistEntry'
          type: array
      type: object
    TokenType:
      description: The definition of `TokenType` object.
      enum:
      - SECRET
      example: SECRET
      type: string
      x-enum-varnames:
      - SECRET
    ObservabilityPipelineOcsfMapperProcessorMappingMapping:
      description: Defines a single mapping rule for transforming logs into the OCSF schema.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineOcsfMappingLibrary'
    XRayServicesIncludeAll:
      description: Include all services.
      properties:
        include_all:
          description: Include all services.
          example: false
          type: boolean
      required:
      - include_all
      type: object
    MSTeamsIntegrationMetadataTeamsItem:
      description: Item in the Microsoft Teams integration metadata teams array.
      properties:
        ms_channel_id:
          description: Microsoft Teams channel ID.
          example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2
          type: string
        ms_channel_name:
          description: Microsoft Teams channel name.
          example: incident-0001-example
          type: string
        ms_tenant_id:
          description: Microsoft Teams tenant ID.
          example: 00000000-abcd-0005-0000-000000000000
          type: string
        redirect_url:
          description: URL redirecting to the Microsoft Teams channel.
          example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000
          type: string
      required:
      - ms_tenant_id
      - ms_channel_id
      - ms_channel_name
      - redirect_url
      type: object
    LogsArchiveEncryptionS3:
      description: The S3 encryption settings.
      properties:
        key:
          description: An Amazon Resource Name (ARN) used to identify an AWS KMS key.
          example: arn:aws:kms:us-east-1:012345678901:key/DatadogIntegrationRoleKms
          type: string
        type:
          $ref: '#/components/schemas/LogsArchiveEncryptionS3Type'
      required:
      - type
      type: object
    AWSNamespaceTagFilter:
      description: 'AWS Metrics Collection tag filters list. Defaults to `[]`.

        The array of custom AWS resource tags (in the form `key:value`) defines a filter that Datadog uses when collecting metrics from a specified service.

        Wildcards, such as `?` (match a single character) and `*` (match multiple characters), and exclusion using `!` before the tag are supported.

        For EC2, only hosts that match one of the defined tags will be imported into Datadog. The rest will be ignored.

        For example, `env:production,instance-type:c?.*,!region:us-east-1`.'
      properties:
        namespace:
          description: The AWS service for which the tag filters defined in `tags` will be applied.
          example: AWS/EC2
          type: string
        tags:
          description: The AWS resource tags to filter on for the service specified by `namespace`.
          items:
            description: Tag in the form `key:value`.
            example: datadog:true
            type: string
          nullable: true
          type: array
      type: object
    UpdateRuleResponseData:
      description: The data for a rule update response.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        relationships:
          $ref: '#/components/schemas/RelationshipToRule'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    ObservabilityPipelineGoogleCloudStorageDestinationType:
      default: google_cloud_storage
      description: The destination type. Always `google_cloud_storage`.
      enum:
      - google_cloud_storage
      example: google_cloud_storage
      type: string
      x-enum-varnames:
      - GOOGLE_CLOUD_STORAGE
    DowntimeNotifyEndStateActions:
      description: Action that will trigger a monitor notification if the downtime is in the `notify_end_types` state.
      enum:
      - canceled
      - expired
      example: canceled
      type: string
      x-enum-varnames:
      - CANCELED
      - EXPIRED
    FrameworkHandleAndVersionResponseData:
      description: Contains type and attributes for custom frameworks.
      properties:
        attributes:
          $ref: '#/components/schemas/CustomFrameworkDataHandleAndVersion'
        id:
          description: The ID of the custom framework.
          example: handle-version
          type: string
        type:
          $ref: '#/components/schemas/CustomFrameworkType'
      required:
      - id
      - type
      - attributes
      type: object
    DataRelationshipsTeamsDataItems:
      description: Relates a team to this schedule, identified by `id` and `type` (must be `teams`).
      properties:
        id:
          description: The unique identifier of the team in this relationship.
          example: 00000000-da3a-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/DataRelationshipsTeamsDataItemsType'
      required:
      - type
      - id
      type: object
    SensitiveDataScannerConfigurationData:
      description: A Sensitive Data Scanner configuration data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerConfiguration'
      type: object
    ApplicationSecurityWafExclusionFilterScope:
      description: Deploy on services based on their environment and/or service name.
      properties:
        env:
          description: Deploy on this environment.
          example: www
          type: string
        service:
          description: Deploy on this service.
          example: prod
          type: string
      type: object
    AnnotationDisplayBounds:
      description: The definition of `AnnotationDisplayBounds` object.
      properties:
        height:
          description: The `bounds` `height`.
          format: double
          type: number
          example: 95.5
        width:
          description: The `bounds` `width`.
          format: double
          type: number
          example: 95.5
        x:
          description: The `bounds` `x`.
          format: double
          type: number
          example: 95.5
        y:
          description: The `bounds` `y`.
          format: double
          type: number
          example: 95.5
      type: object
    IncidentTodoAssigneeHandle:
      description: Assignee's @-handle.
      example: '@test.user@test.com'
      type: string
    BudgetWithEntriesData:
      description: A budget and all its entries.
      properties:
        attributes:
          $ref: '#/components/schemas/BudgetAttributes'
        id:
          description: The `BudgetWithEntriesData` `id`.
          example: 00000000-0a0a-0a0a-aaa0-00000000000a
          type: string
        type:
          description: The type of the object, must be `budget`.
          type: string
          example: metric alert
      type: object
    LogsArchiveState:
      description: The state of the archive.
      enum:
      - UNKNOWN
      - WORKING
      - FAILING
      - WORKING_AUTH_LEGACY
      example: WORKING
      type: string
      x-enum-varnames:
      - UNKNOWN
      - WORKING
      - FAILING
      - WORKING_AUTH_LEGACY
    DowntimeScheduleOneTimeCreateUpdateRequest:
      additionalProperties: false
      description: A one-time downtime definition.
      properties:
        end:
          description: 'ISO-8601 Datetime to end the downtime. Must include a UTC offset of zero. If not provided, the

            downtime continues forever.'
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          nullable: true
          type: string
        start:
          description: 'ISO-8601 Datetime to start the downtime. Must include a UTC offset of zero. If not provided, the

            downtime starts the moment it is created.'
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          nullable: true
          type: string
      type: object
    ObservabilityPipelineQuotaProcessorLimitEnforceType:
      description: Unit for quota enforcement in bytes for data size or events for count.
      enum:
      - bytes
      - events
      example: bytes
      type: string
      x-enum-varnames:
      - BYTES
      - EVENTS
    AwsCURConfigPatchRequestType:
      default: aws_cur_config_patch_request
      description: Type of AWS CUR config Patch Request.
      enum:
      - aws_cur_config_patch_request
      example: aws_cur_config_patch_request
      type: string
      x-enum-varnames:
      - AWS_CUR_CONFIG_PATCH_REQUEST
    SecurityMonitoringRuleNewValueOptionsLearningDuration:
      default: 0
      description: 'The duration in days during which values are learned, and after which signals will be generated for values that

        weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.'
      enum:
      - 0
      - 1
      - 7
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_DAYS
      - ONE_DAY
      - SEVEN_DAYS
    SlackTriggerWrapper:
      description: Schema for a Slack-based trigger.
      properties:
        slackTrigger:
          description: Trigger a workflow from Slack. The workflow must be published.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - slackTrigger
      type: object
    ObservabilityPipelineRsyslogDestinationType:
      default: rsyslog
      description: The destination type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    MonitorNotificationRuleFilter:
      description: Filter used to associate the notification rule with monitors.
      oneOf:
      - $ref: '#/components/schemas/MonitorNotificationRuleFilterTags'
    SecurityFilterUpdateAttributes:
      description: The security filters properties to be updated.
      properties:
        exclusion_filters:
          description: Exclusion filters to exclude some logs from the security filter.
          example: []
          items:
            $ref: '#/components/schemas/SecurityFilterExclusionFilter'
          type: array
        filtered_data_type:
          $ref: '#/components/schemas/SecurityFilterFilteredDataType'
        is_enabled:
          description: Whether the security filter is enabled.
          example: true
          type: boolean
        name:
          description: The name of the security filter.
          example: Custom security filter
          type: string
        query:
          description: The query of the security filter.
          example: service:api
          type: string
        version:
          description: The version of the security filter to update.
          example: 1
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    ErrorHandler:
      description: Used to handle errors in an action.
      properties:
        fallbackStepName:
          description: The `ErrorHandler` `fallbackStepName`.
          example: ''
          type: string
        retryStrategy:
          $ref: '#/components/schemas/RetryStrategy'
      required:
      - retryStrategy
      - fallbackStepName
      type: object
    ScheduleUpdateRequest:
      description: A top-level wrapper for a schedule update request, referring to the `data` object with the new details.
      example:
        data:
          attributes:
            layers:
            - effective_date: '2025-02-03T05:00:00Z'
              end_date: '2025-12-31T00:00:00Z'
              interval:
                seconds: 300
              members:
              - user:
                  id: 00000000-aba1-0000-0000-000000000000
              name: Layer 1
              restrictions:
              - end_day: friday
                end_time: '17:00:00'
                start_day: monday
                start_time: 09:00:00
              rotation_start: '2025-02-01T00:00:00Z'
            name: On-Call Schedule Updated
            time_zone: America/New_York
          id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          relationships:
            teams:
              data:
              - id: 00000000-da3a-0000-0000-000000000000
                type: teams
          type: schedules
      properties:
        data:
          $ref: '#/components/schemas/ScheduleUpdateRequestData'
      required:
      - data
      type: object
    ObservabilityPipelineParseGrokProcessorType:
      default: parse_grok
      description: The processor type. The value should always be `parse_grok`.
      enum:
      - parse_grok
      example: parse_grok
      type: string
      x-enum-varnames:
      - PARSE_GROK
    TeamTarget:
      description: Represents a team target for an escalation policy step, including the team's ID and resource type.
      properties:
        id:
          description: Specifies the unique identifier of the team resource.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/TeamTargetType'
      required:
      - type
      - id
      type: object
    ObservabilityPipelineAmazonOpenSearchDestinationType:
      default: amazon_opensearch
      description: The destination type. The value should always be `amazon_opensearch`.
      enum:
      - amazon_opensearch
      example: amazon_opensearch
      type: string
      x-enum-varnames:
      - AMAZON_OPENSEARCH
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    RestrictionQueryAttributes:
      description: Attributes of the restriction query.
      properties:
        created_at:
          description: Creation time of the restriction query.
          example: '2020-03-17T21:06:44.000Z'
          format: date-time
          readOnly: true
          type: string
        modified_at:
          description: Time of last restriction query modification.
          example: '2020-03-17T21:15:15.000Z'
          format: date-time
          readOnly: true
          type: string
        restriction_query:
          description: The query that defines the restriction. Only the content matching the query can be returned.
          example: env:sandbox
          type: string
      type: object
    ObservabilityPipelineGeneratedMetric:
      description: 'Defines a log-based custom metric, including its name, type, filter, value computation strategy,

        and optional grouping fields.

        '
      properties:
        group_by:
          description: Optional fields used to group the metric series.
          example:
          - service
          - env
          items:
            type: string
          type: array
        include:
          description: Datadog filter query to match logs for metric generation.
          example: service:billing
          type: string
        metric_type:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType'
        name:
          description: Name of the custom metric to be created.
          example: logs.processed
          type: string
        value:
          $ref: '#/components/schemas/ObservabilityPipelineMetricValue'
      required:
      - name
      - include
      - metric_type
      - value
      type: object
    AWSRegionsIncludeAll:
      description: Include all regions. Defaults to `true`.
      properties:
        include_all:
          description: Include all regions.
          example: true
          type: boolean
      required:
      - include_all
      type: object
    ObservabilityPipelineGoogleChronicleDestination:
      description: The `google_chronicle` destination sends logs to Google Chronicle.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        customer_id:
          description: The Google Chronicle customer ID.
          example: abcdefg123456789
          type: string
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding'
        id:
          description: The unique identifier for this component.
          example: google-chronicle-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        log_type:
          description: The log type metadata associated with the Chronicle destination.
          example: nginx_logs
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType'
      required:
      - id
      - type
      - inputs
      - auth
      - customer_id
      type: object
    MicrosoftTeamsTenantBasedHandleType:
      default: tenant-based-handle
      description: Specifies the tenant-based handle resource type.
      enum:
      - tenant-based-handle
      example: tenant-based-handle
      type: string
      x-enum-varnames:
      - TENANT_BASED_HANDLE
    LogsArchiveStorageClassS3Type:
      default: STANDARD
      description: The storage class where the archive will be stored.
      enum:
      - STANDARD
      - STANDARD_IA
      - ONEZONE_IA
      - INTELLIGENT_TIERING
      - GLACIER_IR
      example: STANDARD
      type: string
      x-enum-varnames:
      - STANDARD
      - STANDARD_IA
      - ONEZONE_IA
      - INTELLIGENT_TIERING
      - GLACIER_IR
    LayerAttributesInterval:
      description: Defines how often the rotation repeats, using a combination of days and optional seconds.
      properties:
        days:
          description: The number of days in each rotation cycle.
          example: 1
          format: int32
          maximum: 400
          type: integer
        seconds:
          description: Any additional seconds for the rotation cycle (up to 30 days).
          example: 300
          format: int64
          maximum: 2592000
          type: integer
      type: object
    MicrosoftTeamsWorkflowsWebhookHandleAttributes:
      description: Workflows Webhook handle attributes.
      properties:
        name:
          description: Workflows Webhook handle name.
          example: fake-handle-name
          maxLength: 255
          type: string
        url:
          description: Workflows Webhook URL.
          example: https://fake.url.com
          maxLength: 255
          type: string
      type: object
    AWSRegions:
      description: AWS Regions to collect data from. Defaults to `include_all`.
      oneOf:
      - $ref: '#/components/schemas/AWSRegionsIncludeAll'
      - $ref: '#/components/schemas/AWSRegionsIncludeOnly'
    ListTagsResponseDataAttributes:
      description: The definition of ListTagsResponseDataAttributes object.
      properties:
        tags:
          description: The list of tags
          example:
          - tag:test
          - tag:testbis
          items:
            type: string
          type: array
      type: object
    ObservabilityPipelineKafkaSource:
      description: The `kafka` source ingests data from Apache Kafka topics.
      properties:
        group_id:
          description: Consumer group ID used by the Kafka client.
          example: consumer-group-0
          type: string
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: kafka-source
          type: string
        librdkafka_options:
          description: Optional list of advanced Kafka client configuration options, defined as key-value pairs.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceLibrdkafkaOption'
          type: array
        sasl:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceSasl'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        topics:
          description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified.
          example:
          - topic1
          - topic2
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceType'
      required:
      - id
      - type
      - group_id
      - topics
      type: object
    ObservabilityPipelineSplunkTcpSource:
      description: 'The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.

        TLS is supported for secure transmission.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-tcp-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSourceType'
      required:
      - id
      - type
      type: object
    ActionQueryMockedOutputsObject:
      description: The mocked outputs of the action query.
      properties:
        enabled:
          $ref: '#/components/schemas/ActionQueryMockedOutputsEnabled'
        outputs:
          description: The mocked outputs of the action query, serialized as JSON.
          example: '{"status": "success"}'
          type: string
      required:
      - enabled
      type: object
    OpenAPIEndpoint:
      description: Endpoint info extracted from an `OpenAPI` specification.
      properties:
        method:
          description: The endpoint method.
          type: string
          example: example_value
        path:
          description: The endpoint path.
          type: string
          example: example_value
      type: object
    UserTeamPermissionType:
      default: user_team_permissions
      description: User team permission type
      enum:
      - user_team_permissions
      example: user_team_permissions
      type: string
      x-enum-varnames:
      - USER_TEAM_PERMISSIONS
    RetentionFilterUpdateRequest:
      description: The body of the retention filter to be updated.
      properties:
        data:
          $ref: '#/components/schemas/RetentionFilterUpdateData'
      required:
      - data
      type: object
    LogsMetricResponseGroupBy:
      description: A group by rule.
      properties:
        path:
          description: The path to the value the log-based metric will be aggregated over.
          example: '@http.status_code'
          type: string
        tag_name:
          description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name.
          example: status_code
          type: string
      type: object
    IncidentAttachmentUpdateRequest:
      description: The update request for an incident's attachments.
      properties:
        data:
          description: 'An array of incident attachments. An attachment object without an "id" key indicates that you want to

            create that attachment. An attachment object without an "attributes" key indicates that you want to

            delete that attachment. An attachment object with both the "id" key and a populated "attributes" object

            indicates that you want to update that attachment.'
          example:
          - attributes:
              attachment:
                documentUrl: https://app.datadoghq.com/notebook/123
                title: Postmortem IR-123
              attachment_type: postmortem
            id: 00000000-abcd-0002-0000-000000000000
            type: incident_attachments
          - attributes:
              attachment:
                documentUrl: https://www.example.com/webstore-failure-runbook
                title: Runbook for webstore service failures
              attachment_type: link
            type: incident_attachments
          - id: 00000000-abcd-0003-0000-000000000000
            type: incident_attachments
          items:
            $ref: '#/components/schemas/IncidentAttachmentUpdateData'
          type: array
      required:
      - data
      type: object
    IncidentTeamResponseAttributes:
      description: The incident team's attributes from a response.
      properties:
        created:
          description: Timestamp of when the incident team was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified:
          description: Timestamp of when the incident team was modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the incident team.
          example: team name
          type: string
      type: object
    IncidentTypeObject:
      description: Incident type response data.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTypeAttributes'
        id:
          description: The incident type's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentTypeType'
      required:
      - id
      - type
      type: object
    ActionQueryDebounceInMs:
      description: The minimum time in milliseconds that must pass before the query can be triggered again. This is useful for preventing accidental double-clicks from triggering the query multiple times.
      oneOf:
      - example: 310.5
        format: double
        type: number
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a number.
        example: ${1000}
        type: string
    WorkflowDataUpdateAttributes:
      description: The definition of `WorkflowDataUpdateAttributes` object.
      properties:
        createdAt:
          description: When the workflow was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        description:
          description: Description of the workflow.
          type: string
          example: example_value
        name:
          description: Name of the workflow.
          type: string
          example: Example Monitor
        published:
          description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
          type: boolean
          example: true
        spec:
          $ref: '#/components/schemas/Spec'
        tags:
          description: Tags of the workflow.
          items:
            type: string
          type: array
        updatedAt:
          description: When the workflow was last updated.
          format: date-time
          readOnly: true
          type: string
          example: '2026-04-17T12:00:00Z'
        webhookSecret:
          description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
          type: string
          writeOnly: true
          example: example_value
      type: object
    TeamPermissionSettingUpdateAttributes:
      description: Team permission setting update attributes
      properties:
        value:
          $ref: '#/components/schemas/TeamPermissionSettingValue'
      type: object
    ApplicationSecurityWafExclusionFilterUpdateAttributes:
      description: Attributes for updating a WAF exclusion filter.
      properties:
        description:
          description: A description for the exclusion filter.
          example: Exclude false positives on a path
          type: string
        enabled:
          description: Indicates whether the exclusion filter is enabled.
          example: true
          type: boolean
        ip_list:
          description: The client IP addresses matched by the exclusion filter (CIDR notation is supported).
          items:
            example: 198.51.100.72
            type: string
          type: array
        on_match:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch'
        parameters:
          description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character.
          items:
            example: list.search.query
            type: string
          type: array
        path_glob:
          description: The HTTP path glob expression matched by the exclusion filter.
          example: /accounts/*
          type: string
        rules_target:
          description: The WAF rules targeted by the exclusion filter.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget'
          type: array
        scope:
          description: The services where the exclusion filter is deployed.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterScope'
          type: array
      required:
      - description
      - enabled
      type: object
    AppBuilderEvent:
      additionalProperties: {}
      description: An event on a UI component that triggers a response or action in an app.
      properties:
        name:
          $ref: '#/components/schemas/AppBuilderEventName'
        type:
          $ref: '#/components/schemas/AppBuilderEventType'
      type: object
    ApplicationSecurityWafCustomRuleData:
      description: Object for a single WAF custom rule.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAttributes'
        id:
          description: The ID of the custom rule.
          example: 2857c47d-1e3a-4300-8b2f-dc24089c084b
          readOnly: true
          type: string
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType'
      type: object
    EscalationPolicyStepTargetType:
      description: Specifies the type of escalation target (example `users`, `schedules`, or `teams`).
      enum:
      - users
      - schedules
      - teams
      example: users
      type: string
      x-enum-varnames:
      - USERS
      - SCHEDULES
      - TEAMS
    TeamType:
      default: team
      description: Team type
      enum:
      - team
      example: team
      type: string
      x-enum-varnames:
      - TEAM
    EntityV3QueueDatadog:
      additionalProperties: false
      description: Datadog product integrations for the datastore entity.
      properties:
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
      type: object
      x-ignore-duplicate-object: true
    IncidentTypeResponse:
      description: Incident type response data.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTypeObject'
      required:
      - data
      type: object
    ObservabilityPipelineSentinelOneDestination:
      description: The `sentinel_one` destination sends logs to SentinelOne.
      properties:
        id:
          description: The unique identifier for this component.
          example: sentinelone-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        region:
          $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationRegion'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationType'
      required:
      - id
      - type
      - inputs
      - region
      type: object
    Case:
      description: A case
      properties:
        attributes:
          $ref: '#/components/schemas/CaseAttributes'
        id:
          description: Case's identifier
          example: aeadc05e-98a8-11ec-ac2c-da7ad0900001
          type: string
        relationships:
          $ref: '#/components/schemas/CaseRelationships'
        type:
          $ref: '#/components/schemas/CaseResourceType'
      required:
      - id
      - type
      - attributes
      type: object
    ScheduleDataType:
      default: schedules
      description: Schedules resource type.
      enum:
      - schedules
      example: schedules
      type: string
      x-enum-varnames:
      - SCHEDULES
    ServiceDefinitionV2Opsgenie:
      description: Opsgenie integration for the service.
      properties:
        region:
          $ref: '#/components/schemas/ServiceDefinitionV2OpsgenieRegion'
        service-url:
          description: Opsgenie service url.
          example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000
          type: string
      required:
      - service-url
      type: object
    RoleUpdateRequest:
      description: Update a role.
      properties:
        data:
          $ref: '#/components/schemas/RoleUpdateData'
      required:
      - data
      type: object
    LogsArchiveOrderDefinitionType:
      default: archive_order
      description: Type of the archive order definition.
      enum:
      - archive_order
      example: archive_order
      type: string
      x-enum-varnames:
      - ARCHIVE_ORDER
    DowntimeNotifyEndStates:
      description: States that will trigger a monitor notification when the `notify_end_types` action occurs.
      example:
      - alert
      - warn
      items:
        $ref: '#/components/schemas/DowntimeNotifyEndStateTypes'
      type: array
    ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy:
      description: The authentication strategy to use.
      enum:
      - basic
      - aws
      example: aws
      type: string
      x-enum-varnames:
      - BASIC
      - AWS
    CustomFrameworkType:
      default: custom_framework
      description: The type of the resource. The value must be `custom_framework`.
      enum:
      - custom_framework
      example: custom_framework
      type: string
      x-enum-varnames:
      - CUSTOM_FRAMEWORK
    MicrosoftSentinelDestination:
      description: The `microsoft_sentinel` destination forwards logs to Microsoft Sentinel.
      properties:
        client_id:
          description: Azure AD client ID used for authentication.
          example: a1b2c3d4-5678-90ab-cdef-1234567890ab
          type: string
        dcr_immutable_id:
          description: The immutable ID of the Data Collection Rule (DCR).
          example: dcr-uuid-1234
          type: string
        id:
          description: The unique identifier for this component.
          example: sentinel-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        table:
          description: The name of the Log Analytics table where logs are sent.
          example: CustomLogsTable
          type: string
        tenant_id:
          description: Azure AD tenant ID.
          example: abcdef12-3456-7890-abcd-ef1234567890
          type: string
        type:
          $ref: '#/components/schemas/MicrosoftSentinelDestinationType'
      required:
      - id
      - type
      - inputs
      - client_id
      - tenant_id
      - dcr_immutable_id
      - table
      type: object
    CloudConfigurationRegoRule:
      description: Rule details.
      properties:
        policy:
          description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/'
          example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n"
          type: string
        resourceTypes:
          description: List of resource types that will be evaluated upon. Must have at least one element.
          example:
          - gcp_iam_service_account
          - gcp_iam_policy
          items:
            type: string
          type: array
      required:
      - policy
      - resourceTypes
      type: object
    CompletionConditionOperator:
      description: The definition of `CompletionConditionOperator` object.
      enum:
      - OPERATOR_EQUAL
      - OPERATOR_NOT_EQUAL
      - OPERATOR_GREATER_THAN
      - OPERATOR_LESS_THAN
      - OPERATOR_GREATER_THAN_OR_EQUAL_TO
      - OPERATOR_LESS_THAN_OR_EQUAL_TO
      - OPERATOR_CONTAINS
      - OPERATOR_DOES_NOT_CONTAIN
      - OPERATOR_IS_NULL
      - OPERATOR_IS_NOT_NULL
      - OPERATOR_IS_EMPTY
      - OPERATOR_IS_NOT_EMPTY
      example: OPERATOR_EQUAL
      type: string
      x-enum-varnames:
      - OPERATOR_EQUAL
      - OPERATOR_NOT_EQUAL
      - OPERATOR_GREATER_THAN
      - OPERATOR_LESS_THAN
      - OPERATOR_GREATER_THAN_OR_EQUAL_TO
      - OPERATOR_LESS_THAN_OR_EQUAL_TO
      - OPERATOR_CONTAINS
      - OPERATOR_DOES_NOT_CONTAIN
      - OPERATOR_IS_NULL
      - OPERATOR_IS_NOT_NULL
      - OPERATOR_IS_EMPTY
      - OPERATOR_IS_NOT_EMPTY
    ActionConnectionIntegrationUpdate:
      description: The definition of `ActionConnectionIntegrationUpdate` object.
      oneOf:
      - $ref: '#/components/schemas/AWSIntegrationUpdate'
      - $ref: '#/components/schemas/HTTPIntegrationUpdate'
    MicrosoftTeamsWorkflowsWebhookHandleType:
      default: workflows-webhook-handle
      description: Specifies the Workflows webhook handle resource type.
      enum:
      - workflows-webhook-handle
      example: workflows-webhook-handle
      type: string
      x-enum-varnames:
      - WORKFLOWS_WEBHOOK_HANDLE
    ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude:
      description: Excludes specific fields from sensitive data scanning.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions'
        target:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget'
      required:
      - target
      - options
      type: object
    RumRetentionFilterUpdateRequest:
      description: The RUM retention filter body to update.
      properties:
        data:
          $ref: '#/components/schemas/RumRetentionFilterUpdateData'
      required:
      - data
      type: object
    AzureUCConfigPairsResponse:
      description: Response of Azure config pair.
      properties:
        data:
          $ref: '#/components/schemas/AzureUCConfigPair'
      type: object
    ServiceDefinitionV2Pagerduty:
      description: PagerDuty service URL for the service.
      example: https://my-org.pagerduty.com/service-directory/PMyService
      type: string
    IncidentTeamResponseData:
      description: Incident Team data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTeamResponseAttributes'
        id:
          description: The incident team's ID.
          example: 00000000-7ea3-0000-000a-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTeamRelationships'
        type:
          $ref: '#/components/schemas/IncidentTeamType'
      type: object
    CustomDestinationHttpDestinationAuthBasic:
      description: Basic access authentication.
      properties:
        password:
          description: The password of the authentication. This field is not returned by the API.
          example: datadog-custom-destination-password
          type: string
          writeOnly: true
        type:
          $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthBasicType'
        username:
          description: The username of the authentication. This field is not returned by the API.
          example: datadog-custom-destination-username
          type: string
          writeOnly: true
      required:
      - type
      - username
      - password
      type: object
    Connection:
      description: The definition of `Connection` object.
      properties:
        connectionId:
          description: The `Connection` `connectionId`.
          example: ''
          type: string
        label:
          description: The `Connection` `label`.
          example: ''
          type: string
      required:
      - connectionId
      - label
      type: object
    IncidentNonDatadogCreator:
      description: Incident's non Datadog creator.
      nullable: true
      properties:
        image_48_px:
          description: Non Datadog creator `48px` image.
          type: string
          example: example_value
        name:
          description: Non Datadog creator name.
          type: string
          example: Example Monitor
      type: object
    ScheduleUserAttributes:
      description: Provides basic user information for a schedule, including a name and email address.
      properties:
        email:
          description: The user's email address.
          example: jane.doe@example.com
          type: string
        name:
          description: The user's name.
          example: Jane Doe
          type: string
        status:
          $ref: '#/components/schemas/UserAttributesStatus'
      type: object
    EntityV3DatadogEvents:
      additionalProperties: false
      description: Events associations.
      items:
        $ref: '#/components/schemas/EntityV3DatadogEventItem'
      type: array
    ObservabilityPipelineDatadogLogsDestination:
      description: The `datadog_logs` destination forwards logs to Datadog Log Management.
      properties:
        id:
          description: The unique identifier for this component.
          example: datadog-logs-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    IncidentIntegrationMetadataResponse:
      description: Response with an incident integration metadata.
      properties:
        data:
          $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem'
          readOnly: true
          type: array
      required:
      - data
      type: object
    Team:
      description: A team
      properties:
        attributes:
          $ref: '#/components/schemas/TeamAttributes'
        id:
          description: The team's identifier
          example: aeadc05e-98a8-11ec-ac2c-da7ad0900001
          type: string
        relationships:
          $ref: '#/components/schemas/TeamRelationships'
        type:
          $ref: '#/components/schemas/TeamType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineAddEnvVarsProcessor:
      description: The `add_env_vars` processor adds environment variable values to log events.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this processor in the pipeline.
          example: add-env-vars-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorType'
        variables:
          description: A list of environment variable mappings to apply to log fields.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorVariable'
          type: array
      required:
      - id
      - type
      - include
      - inputs
      - variables
      type: object
    MonitorNotificationRuleAttributes:
      additionalProperties: false
      description: Attributes of the monitor notification rule.
      properties:
        filter:
          $ref: '#/components/schemas/MonitorNotificationRuleFilter'
        name:
          $ref: '#/components/schemas/MonitorNotificationRuleName'
        recipients:
          $ref: '#/components/schemas/MonitorNotificationRuleRecipients'
      required:
      - name
      - recipients
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorPattern:
      description: Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern'
    ObservabilityPipelineSensitiveDataScannerProcessorActionRedact:
      description: Configuration for completely redacting matched sensitive data.
      properties:
        action:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction'
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions'
      required:
      - action
      - options
      type: object
    UserTeamIncluded:
      description: Included resources related to the team membership
      oneOf:
      - $ref: '#/components/schemas/User'
      - $ref: '#/components/schemas/Team'
    ConfluentResourceRequest:
      description: The JSON:API request for updating a Confluent resource.
      properties:
        data:
          $ref: '#/components/schemas/ConfluentResourceRequestData'
      required:
      - data
      type: object
    ApplicationSecurityWafExclusionFilterRulesTarget:
      description: Target WAF rules based either on an identifier or tags.
      properties:
        rule_id:
          description: Target a single WAF rule based on its identifier.
          example: dog-913-009
          type: string
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTargetTags'
      type: object
    MonitorTriggerWrapper:
      description: Schema for a Monitor-based trigger.
      properties:
        monitorTrigger:
          $ref: '#/components/schemas/MonitorTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - monitorTrigger
      type: object
    LogsMetricComputeIncludePercentiles:
      description: 'Toggle to include or exclude percentile aggregations for distribution metrics.

        Only present when the `aggregation_type` is `distribution`.'
      example: true
      type: boolean
    DowntimeScope:
      description: The scope to which the downtime applies. Must follow the [common search syntax](https://docs.datadoghq.com/logs/explorer/search_syntax/).
      example: env:(staging OR prod) AND datacenter:us-east-1
      type: string
    AWSAccountPartition:
      description: 'AWS partition your AWS account is scoped to. Defaults to `aws`.

        See [Partitions](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html) in the AWS documentation for more information.'
      enum:
      - aws
      - aws-cn
      - aws-us-gov
      example: aws
      type: string
      x-enum-varnames:
      - AWS
      - AWS_CN
      - AWS_US_GOV
    EntityData:
      description: Entity data.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityAttributes'
        id:
          description: Entity ID.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/EntityMeta'
        relationships:
          $ref: '#/components/schemas/EntityRelationships'
        type:
          description: Entity.
          type: string
          example: metric alert
      type: object
    IncidentIntegrationMetadataPatchRequest:
      description: Patch request for an incident integration metadata.
      properties:
        data:
          $ref: '#/components/schemas/IncidentIntegrationMetadataPatchData'
      required:
      - data
      type: object
    ServiceDefinitionV2MSTeamsType:
      description: Contact type.
      enum:
      - microsoft-teams
      example: microsoft-teams
      type: string
      x-enum-varnames:
      - MICROSOFT_TEAMS
    SensitiveDataScannerStandardPattern:
      description: Data containing the standard pattern id.
      properties:
        id:
          description: ID of the standard pattern.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternType'
      type: object
    ApplicationSecurityWafCustomRuleTagsCategory:
      description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`.
      enum:
      - attack_attempt
      - business_logic
      - security_response
      example: business_logic
      type: string
      x-enum-varnames:
      - ATTACK_ATTEMPT
      - BUSINESS_LOGIC
      - SECURITY_RESPONSE
    CustomDestinationForwardDestinationSplunk:
      description: The Splunk HTTP Event Collector (HEC) destination.
      properties:
        access_token:
          description: Access token of the Splunk HTTP Event Collector. This field is not returned by the API.
          example: splunk_access_token
          type: string
          writeOnly: true
        endpoint:
          description: 'The destination for which logs will be forwarded to.

            Must have HTTPS scheme and forwarding back to Datadog is not allowed.'
          example: https://example.com
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunkType'
      required:
      - type
      - endpoint
      - access_token
      type: object
    IncidentTodoResponseIncludedItem:
      description: An object related to an incident todo that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    ObservabilityPipelineSumoLogicSource:
      description: The `sumo_logic` source receives logs from Sumo Logic collectors.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sumo-logic-source
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSourceType'
      required:
      - id
      - type
      type: object
    OutputSchemaParametersType:
      description: The definition of `OutputSchemaParametersType` object.
      enum:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
      example: STRING
      type: string
      x-enum-varnames:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
    EntityV3APIVersion:
      description: The schema version of entity type. The field is known as schema-version in the previous version.
      enum:
      - v3
      example: v3
      type: string
      x-enum-varnames:
      - V3
    ObservabilityPipelineHttpClientSourceAuthStrategy:
      description: Optional authentication strategy for HTTP requests.
      enum:
      - basic
      - bearer
      example: basic
      type: string
      x-enum-varnames:
      - BASIC
      - BEARER
    SecurityMonitoringSuppressionID:
      description: The ID of the suppression rule.
      example: 3dd-0uc-h1s
      type: string
    TeamLinkCreateRequest:
      description: Team link create request
      properties:
        data:
          $ref: '#/components/schemas/TeamLinkCreate'
      required:
      - data
      type: object
    ObservabilityPipelineOcsfMapperProcessorMapping:
      description: Defines how specific events are transformed to OCSF using a mapping configuration.
      properties:
        include:
          description: A Datadog search query used to select the logs that this mapping should apply to.
          example: service:my-service
          type: string
        mapping:
          $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping'
      required:
      - include
      - mapping
      type: object
    MicrosoftSentinelDestinationType:
      default: microsoft_sentinel
      description: The destination type. The value should always be `microsoft_sentinel`.
      enum:
      - microsoft_sentinel
      example: microsoft_sentinel
      type: string
      x-enum-varnames:
      - MICROSOFT_SENTINEL
    ObservabilityPipelineQuotaProcessorLimit:
      description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events.
      properties:
        enforce:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType'
        limit:
          description: The limit for quota enforcement.
          example: 1000
          format: int64
          type: integer
      required:
      - enforce
      - limit
      type: object
    ActionConnectionAttributes:
      description: The definition of `ActionConnectionAttributes` object.
      properties:
        integration:
          $ref: '#/components/schemas/ActionConnectionIntegration'
        name:
          description: Name of the connection
          example: My AWS Connection
          type: string
      required:
      - name
      - integration
      type: object
    DataRelationshipsTeams:
      description: Associates teams with this schedule in a data structure.
      properties:
        data:
          description: An array of team references for this schedule.
          items:
            $ref: '#/components/schemas/DataRelationshipsTeamsDataItems'
          type: array
      type: object
    ServiceDefinitionV2Dot1Integrations:
      description: Third party integrations that Datadog supports.
      properties:
        opsgenie:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1Opsgenie'
        pagerduty:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1Pagerduty'
      type: object
    OpsgenieServiceResponse:
      description: Response of an Opsgenie service.
      properties:
        data:
          $ref: '#/components/schemas/OpsgenieServiceResponseData'
      required:
      - data
      type: object
    RelationshipToIncidentImpacts:
      description: Relationship to impacts.
      properties:
        data:
          description: An array of incident impacts.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentImpactData'
          type: array
      required:
      - data
      type: object
    EntityToRelatedEntities:
      description: Entity to related entities relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipArray'
      type: object
    IncidentAttachmentPostmortemAttributes:
      description: The attributes object for a postmortem attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType'
      required:
      - attachment_type
      - attachment
      type: object
    ComponentProperties:
      additionalProperties: {}
      description: Properties of a UI component. Different component types can have their own additional unique properties. See the [components documentation](https://docs.datadoghq.com/service_management/app_builder/components/) for more detail on each component type and its properties.
      properties:
        children:
          description: The child components of the UI component.
          items:
            $ref: '#/components/schemas/Component'
          type: array
        isVisible:
          $ref: '#/components/schemas/ComponentPropertiesIsVisible'
      type: object
    EscalationPolicyUser:
      description: Represents a user object in the context of an escalation policy, including their `id`, type, and basic attributes.
      properties:
        attributes:
          $ref: '#/components/schemas/EscalationPolicyUserAttributes'
        id:
          description: The unique user identifier.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/EscalationPolicyUserType'
      required:
      - type
      type: object
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior
      type: string
      x-enum-varnames:
      - BLOCK_IP
      - BLOCK_USER
      - USER_BEHAVIOR
    UpdateRuleRequest:
      description: Request to update a scorecard rule.
      properties:
        data:
          $ref: '#/components/schemas/UpdateRuleRequestData'
      type: object
    ObservabilityPipelineSampleProcessor:
      description: The `sample` processor allows probabilistic sampling of logs at a fixed rate.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: sample-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        percentage:
          description: The percentage of logs to sample.
          example: 10
          format: double
          type: number
        rate:
          description: Number of events to sample (1 in N).
          example: 10
          format: int64
          minimum: 1
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSampleProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    ObservabilityPipelineData:
      description: Contains the pipeline’s ID, type, and configuration attributes.
      properties:
        attributes:
          $ref: '#/components/schemas/ObservabilityPipelineDataAttributes'
        id:
          description: Unique identifier for the pipeline.
          example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
          type: string
        type:
          default: pipelines
          description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`.
          example: pipelines
          type: string
      required:
      - id
      - type
      - attributes
      type: object
    CaseUpdateStatusAttributes:
      description: Case update status attributes
      properties:
        status:
          $ref: '#/components/schemas/CaseStatus'
      required:
      - status
      type: object
    ServiceDefinitionV2Dot1Version:
      default: v2.1
      description: Schema version being used.
      enum:
      - v2.1
      example: v2.1
      type: string
      x-enum-varnames:
      - V2_1
    CustomConnectionAttributes:
      description: The custom connection attributes.
      properties:
        name:
          description: The name of the custom connection.
          type: string
          example: Example Monitor
        onPremRunner:
          $ref: '#/components/schemas/CustomConnectionAttributesOnPremRunner'
      type: object
    HTTPIntegration:
      description: The definition of `HTTPIntegration` object.
      properties:
        base_url:
          description: Base HTTP url for the integration
          example: http://datadoghq.com
          type: string
        credentials:
          $ref: '#/components/schemas/HTTPCredentials'
        type:
          $ref: '#/components/schemas/HTTPIntegrationType'
      required:
      - type
      - base_url
      - credentials
      type: object
    AzureUCConfigPatchRequestType:
      default: azure_uc_config_patch_request
      description: Type of Azure config Patch Request.
      enum:
      - azure_uc_config_patch_request
      example: azure_uc_config_patch_request
      type: string
      x-enum-varnames:
      - AZURE_UC_CONFIG_PATCH_REQUEST
    RuleType:
      default: rule
      description: The JSON:API type for scorecard rules.
      enum:
      - rule
      example: rule
      type: string
      x-enum-varnames:
      - RULE
    AnnotationDisplay:
      description: The definition of `AnnotationDisplay` object.
      properties:
        bounds:
          $ref: '#/components/schemas/AnnotationDisplayBounds'
      type: object
    AWSCredentials:
      description: The definition of `AWSCredentials` object.
      oneOf:
      - $ref: '#/components/schemas/AWSAssumeRole'
    CustomDestinationForwardDestinationElasticsearchType:
      default: elasticsearch
      description: Type of the Elasticsearch destination.
      enum:
      - elasticsearch
      example: elasticsearch
      type: string
      x-enum-varnames:
      - ELASTICSEARCH
    ObservabilityPipelineDedupeProcessor:
      description: The `dedupe` processor removes duplicate fields in log events.
      properties:
        fields:
          description: A list of log field paths to check for duplicates.
          example:
          - log.message
          - log.error
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: dedupe-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorMode'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - fields
      - mode
      type: object
    DowntimeMuteFirstRecoveryNotification:
      description: If the first recovery notification during a downtime should be muted.
      example: false
      type: boolean
    MSTeamsIntegrationMetadata:
      description: Incident integration metadata for the Microsoft Teams integration.
      properties:
        teams:
          description: Array of Microsoft Teams in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/MSTeamsIntegrationMetadataTeamsItem'
          type: array
      required:
      - teams
      type: object
    RelationshipToRuleData:
      description: Relationship data for a rule.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToRuleDataObject'
      type: object
    DowntimeMonitorIdentifier:
      description: Monitor identifier for the downtime.
      oneOf:
      - $ref: '#/components/schemas/DowntimeMonitorIdentifierId'
      - $ref: '#/components/schemas/DowntimeMonitorIdentifierTags'
    LogsArchiveDestinationAzureType:
      default: azure
      description: Type of the Azure archive destination.
      enum:
      - azure
      example: azure
      type: string
      x-enum-varnames:
      - AZURE
    LogsArchiveIntegrationS3:
      description: The S3 Archive's integration destination.
      properties:
        account_id:
          description: The account ID for the integration.
          example: '123456789012'
          type: string
        role_name:
          description: The path of the integration.
          example: role-name
          type: string
      required:
      - role_name
      - account_id
      type: object
    CloudWorkloadSecurityAgentRuleCreatorAttributes:
      description: The attributes of the user who created the Agent rule
      properties:
        handle:
          description: The handle of the user
          example: datadog.user@example.com
          type: string
        name:
          description: The name of the user
          example: Datadog User
          nullable: true
          type: string
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByOne:
      description: Strategy that increments a generated metric by one for each matching event.
      properties:
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOneStrategy'
      required:
      - strategy
      type: object
    SecurityMonitoringSignalRuleResponseQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to correlate by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        defaultRuleId:
          description: Default Rule ID to match on signals.
          example: d3f-ru1-e1d
          type: string
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      type: object
    EntityV3APIKind:
      description: The definition of Entity V3 API Kind object.
      enum:
      - api
      example: api
      type: string
      x-enum-varnames:
      - API
    UpdateAppResponseData:
      description: The data object containing the updated app definition.
      properties:
        attributes:
          $ref: '#/components/schemas/UpdateAppResponseDataAttributes'
        id:
          description: The ID of the updated app.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        type:
          $ref: '#/components/schemas/AppDefinitionType'
      required:
      - id
      - type
      - attributes
      type: object
    ObservabilityPipelineEnrichmentTableFileEncoding:
      description: File encoding format.
      properties:
        delimiter:
          description: The `encoding` `delimiter`.
          example: ','
          type: string
        includes_headers:
          description: The `encoding` `includes_headers`.
          example: true
          type: boolean
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncodingType'
      required:
      - type
      - delimiter
      - includes_headers
      type: object
    UpdateAppRequestDataAttributes:
      description: App definition attributes to be updated, such as name, description, and components.
      properties:
        components:
          description: The new UI components that make up the app. If this field is set, all existing components are replaced with the new components under this field.
          items:
            $ref: '#/components/schemas/ComponentGrid'
          type: array
        description:
          description: The new human-readable description for the app.
          type: string
          example: example_value
        name:
          description: The new name of the app.
          type: string
          example: Example Monitor
        queries:
          description: The new array of queries, such as external actions and state variables, that the app uses. If this field is set, all existing queries are replaced with the new queries under this field.
          items:
            $ref: '#/components/schemas/Query'
          type: array
        rootInstanceName:
          description: The new name of the root component of the app. This must be a `grid` component that contains all other components.
          type: string
          example: Example Monitor
        tags:
          description: The new list of tags for the app, which can be used to filter apps. If this field is set, any existing tags not included in the request are removed.
          example:
          - service:webshop-backend
          - team:webshop
          items:
            description: An individual tag for the app.
            type: string
          type: array
      type: object
    UserResponse:
      description: Response containing information about a single user.
      properties:
        data:
          $ref: '#/components/schemas/User'
        included:
          description: Array of objects related to the user.
          items:
            $ref: '#/components/schemas/UserResponseIncludedItem'
          type: array
      type: object
    EntityV3APIDatadog:
      additionalProperties: false
      description: Datadog product integrations for the API entity.
      properties:
        codeLocations:
          $ref: '#/components/schemas/EntityV3DatadogCodeLocations'
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
        pipelines:
          $ref: '#/components/schemas/EntityV3DatadogPipelines'
      type: object
    ScorecardType:
      default: scorecard
      description: The JSON:API type for scorecard.
      enum:
      - scorecard
      example: scorecard
      type: string
      x-enum-varnames:
      - SCORECARD
    EscalationPolicyDataRelationships:
      description: Represents the relationships for an escalation policy, including references to steps and teams.
      properties:
        steps:
          $ref: '#/components/schemas/EscalationPolicyDataRelationshipsSteps'
        teams:
          $ref: '#/components/schemas/DataRelationshipsTeams'
      required:
      - steps
      type: object
    ExternalUserNameType:
      description: The components of user's real name
      properties:
        formatted:
          description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
          type: string
          example: example_value
      type: object
    RetentionFilterResponse:
      description: The retention filters definition.
      properties:
        data:
          $ref: '#/components/schemas/RetentionFilterAll'
      type: object
    DowntimeMonitorIncludedItem:
      description: Information about the monitor identified by the downtime.
      properties:
        attributes:
          $ref: '#/components/schemas/DowntimeMonitorIncludedAttributes'
        id:
          description: ID of the monitor identified by the downtime.
          example: 12345
          format: int64
          type: integer
        type:
          $ref: '#/components/schemas/DowntimeIncludedMonitorType'
      type: object
    CloudWorkloadSecurityAgentPolicyUpdateData:
      description: Object for a single Agent policy
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateAttributes'
        id:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyID'
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyType'
      required:
      - attributes
      - type
      type: object
    DowntimeMonitorIdentifierTags:
      additionalProperties: {}
      description: Object of the monitor tags.
      properties:
        monitor_tags:
          description: 'A list of monitor tags. For example, tags that are applied directly to monitors,

            not tags that are used in monitor queries (which are filtered by the scope parameter), to which the downtime applies.

            The resulting downtime applies to monitors that match **all** provided monitor tags. Setting `monitor_tags`

            to `[*]` configures the downtime to mute all monitors for the given scope.'
          example:
          - service:postgres
          - team:frontend
          items:
            description: A list of monitor tags.
            example: service:postgres
            type: string
          minItems: 1
          type: array
      required:
      - monitor_tags
      type: object
    NullableUserRelationshipData:
      description: Relationship to user object.
      nullable: true
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UserResourceType'
      required:
      - id
      - type
      type: object
    UpdateAppResponse:
      description: The response object after an app is successfully updated.
      properties:
        data:
          $ref: '#/components/schemas/UpdateAppResponseData'
        included:
          description: Data on the version of the app that was published.
          items:
            $ref: '#/components/schemas/Deployment'
          type: array
        meta:
          $ref: '#/components/schemas/AppMeta'
        relationship:
          $ref: '#/components/schemas/AppRelationship'
      type: object
    SlackIntegrationMetadataChannelItem:
      description: Item in the Slack integration metadata channel array.
      properties:
        channel_id:
          description: Slack channel ID.
          example: C0123456789
          type: string
        channel_name:
          description: Name of the Slack channel.
          example: '#example-channel-name'
          type: string
        redirect_url:
          description: URL redirecting to the Slack channel.
          example: https://slack.com/app_redirect?channel=C0123456789&team=T01234567
          type: string
        team_id:
          description: Slack team ID.
          example: T01234567
          type: string
      required:
      - channel_id
      - channel_name
      - redirect_url
      type: object
    AWSIntegrationType:
      description: The definition of `AWSIntegrationType` object.
      enum:
      - AWS
      example: AWS
      type: string
      x-enum-varnames:
      - AWS
    EntityV3DatadogCodeLocationItem:
      additionalProperties: false
      description: Code location item.
      properties:
        paths:
          description: The paths (glob) to the source code of the service.
          items:
            type: string
          type: array
        repositoryURL:
          description: The repository path of the source code of the entity.
          type: string
          example: https://app.datadoghq.com
      type: object
    ComponentPropertiesIsVisible:
      description: Whether the UI component is visible. If this is a string, it must be a valid JavaScript expression that evaluates to a boolean.
      oneOf:
      - type: boolean
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean.
        example: ${true}
        type: string
    ServiceDefinitionV1Info:
      description: Basic information about a service.
      properties:
        dd-service:
          description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog.
          example: myservice
          type: string
        description:
          description: A short description of the service.
          example: A shopping cart service
          type: string
        display-name:
          description: A friendly name of the service.
          example: My Service
          type: string
        service-tier:
          description: Service tier.
          example: Tier 1
          type: string
      required:
      - dd-service
      type: object
    SensitiveDataScannerGroupUpdateRequest:
      description: Update group request.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerGroupUpdate'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      required:
      - data
      - meta
      type: object
    CustomFrameworkData:
      description: Contains type and attributes for custom frameworks.
      properties:
        attributes:
          $ref: '#/components/schemas/CustomFrameworkDataAttributes'
        type:
          $ref: '#/components/schemas/CustomFrameworkType'
      required:
      - type
      - attributes
      type: object
    SecurityFilter:
      description: The security filter's properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityFilterAttributes'
        id:
          $ref: '#/components/schemas/SecurityFilterID'
        type:
          $ref: '#/components/schemas/SecurityFilterType'
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions:
      description: Configuration for fully redacting sensitive data.
      properties:
        replace:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions` `replace`.
          example: '***'
          type: string
      required:
      - replace
      type: object
    WorkflowUserRelationship:
      description: The definition of `WorkflowUserRelationship` object.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowUserRelationshipData'
      type: object
    RuleAttributes:
      description: Details of a rule.
      properties:
        category:
          deprecated: true
          description: The scorecard name to which this rule must belong.
          type: string
          example: example_value
        created_at:
          description: Creation time of the rule outcome.
          format: date-time
          type: string
          example: example_value
        custom:
          description: Defines if the rule is a custom rule.
          type: boolean
          example: true
        description:
          description: Explanation of the rule.
          type: string
          example: example_value
        enabled:
          description: If enabled, the rule is calculated as part of the score.
          example: true
          type: boolean
        modified_at:
          description: Time of the last rule outcome modification.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the rule.
          example: Team Defined
          type: string
        owner:
          description: Owner of the rule.
          type: string
          example: example_value
        scorecard_name:
          description: The scorecard name to which this rule must belong.
          example: Deployments automated via Deployment Trains
          type: string
      type: object
    IncidentTypeType:
      default: incident_types
      description: Incident type resource type.
      enum:
      - incident_types
      example: incident_types
      type: string
      x-enum-varnames:
      - INCIDENT_TYPES
    LogsMetricFilter:
      description: The log-based metric filter. Logs matching this filter will be aggregated in this metric.
      properties:
        query:
          default: '*'
          description: The search query - following the log search syntax.
          example: service:web* AND @http.status_code:[200 TO 299]
          type: string
      type: object
    ServiceDefinitionV2MSTeams:
      description: Service owner's Microsoft Teams.
      properties:
        contact:
          description: Contact value.
          example: https://teams.microsoft.com/myteam
          type: string
        name:
          description: Contact Microsoft Teams.
          example: My team channel
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2MSTeamsType'
      required:
      - type
      - contact
      type: object
    LogsMetricUpdateData:
      description: The new log-based metric properties.
      properties:
        attributes:
          $ref: '#/components/schemas/LogsMetricUpdateAttributes'
        type:
          $ref: '#/components/schemas/LogsMetricType'
      required:
      - type
      - attributes
      type: object
    EscalationPolicyDataRelationshipsSteps:
      description: Defines the relationship to a collection of steps within an escalation policy. Contains an array of step data references.
      properties:
        data:
          description: An array of references to the steps defined in this escalation policy.
          items:
            $ref: '#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItems'
          type: array
      type: object
    Spec:
      description: The spec defines what the workflow does.
      properties:
        annotations:
          description: A list of annotations used in the workflow. These are like sticky notes for your workflow!
          items:
            $ref: '#/components/schemas/Annotation'
          type: array
        connectionEnvs:
          description: A list of connections or connection groups used in the workflow.
          items:
            $ref: '#/components/schemas/ConnectionEnv'
          type: array
        handle:
          description: Unique identifier used to trigger workflows automatically in Datadog.
          type: string
          example: example_value
        inputSchema:
          $ref: '#/components/schemas/InputSchema'
        outputSchema:
          $ref: '#/components/schemas/OutputSchema'
        steps:
          description: A `Step` is a sub-component of a workflow. Each `Step` performs an action.
          items:
            $ref: '#/components/schemas/Step'
          type: array
        triggers:
          description: The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
          items:
            $ref: '#/components/schemas/Trigger'
          type: array
      type: object
    AWSAuthConfigRole:
      description: AWS Authentication config to integrate your account using an IAM role.
      properties:
        external_id:
          description: AWS IAM External ID for associated role.
          type: string
          example: abc-123-def
        role_name:
          description: AWS IAM Role name.
          example: DatadogIntegrationRole
          maxLength: 576
          minLength: 1
          type: string
      required:
      - role_name
      type: object
    SecurityMonitoringRuleTypeRead:
      description: The rule type.
      enum:
      - log_detection
      - infrastructure_configuration
      - workload_security
      - cloud_configuration
      - application_security
      type: string
      x-enum-varnames:
      - LOG_DETECTION
      - INFRASTRUCTURE_CONFIGURATION
      - WORKLOAD_SECURITY
      - CLOUD_CONFIGURATION
      - APPLICATION_SECURITY
    MonitorNotificationRuleRelationships:
      description: All relationships associated with monitor notification rule.
      properties:
        created_by:
          $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedBy'
      type: object
    CloudWorkloadSecurityAgentRuleActionSet:
      description: The set action applied on the scope matching the rule
      properties:
        append:
          description: Whether the value should be appended to the field
          type: boolean
          example: true
        field:
          description: The field of the set action
          type: string
          example: example_value
        name:
          description: The name of the set action
          type: string
          example: Example Monitor
        scope:
          description: The scope of the set action
          type: string
          example: example_value
        size:
          description: The size of the set action
          format: int64
          type: integer
          example: 42
        ttl:
          description: The time to live of the set action
          format: int64
          type: integer
          example: 42
        value:
          description: The value of the set action
          type: string
          example: example_value
      type: object
    ObservabilityPipelineHttpServerSourceAuthStrategy:
      description: HTTP authentication method.
      enum:
      - none
      - plain
      example: plain
      type: string
      x-enum-varnames:
      - NONE
      - PLAIN
    ObservabilityPipelineFluentdSource:
      description: The `fluentd` source ingests logs from a Fluentd-compatible service.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentdSourceType'
      required:
      - id
      - type
      type: object
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    EntityRaw:
      description: Entity definition in raw JSON or YAML representation.
      example: "apiVersion: v3\nkind: service\nmetadata:\n  name: myservice\n"
      type: string
    StateVariableType:
      default: stateVariable
      description: The state variable type.
      enum:
      - stateVariable
      example: stateVariable
      type: string
      x-enum-varnames:
      - STATEVARIABLE
    ObservabilityPipelineFluentBitSource:
      description: The `fluent_bit` source ingests logs from Fluent Bit.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentBitSourceType'
      required:
      - id
      - type
      type: object
    IncidentIntegrationRelationships:
      description: The incident's integration relationships from a response.
      properties:
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    ServiceDefinitionV2Dot1LinkType:
      description: Link type.
      enum:
      - doc
      - repo
      - runbook
      - dashboard
      - other
      example: runbook
      type: string
      x-enum-varnames:
      - DOC
      - REPO
      - RUNBOOK
      - DASHBOARD
      - OTHER
    MetricCustomAggregation:
      description: A time and space aggregation combination for use in query.
      example:
        space: sum
        time: sum
      properties:
        space:
          $ref: '#/components/schemas/MetricCustomSpaceAggregation'
        time:
          $ref: '#/components/schemas/MetricCustomTimeAggregation'
      required:
      - time
      - space
      type: object
    ListTagsResponseData:
      description: The list tags response data.
      properties:
        attributes:
          $ref: '#/components/schemas/ListTagsResponseDataAttributes'
        id:
          description: The device ID
          example: example:1.2.3.4
          type: string
        type:
          description: The type of the resource. The value should always be tags.
          type: string
          example: metric alert
      type: object
    ScheduleDataAttributes:
      description: Provides core properties of a schedule object such as its name and time zone.
      properties:
        name:
          description: A short name for the schedule.
          example: Primary On-Call
          type: string
        time_zone:
          description: The time zone in which this schedule operates.
          example: America/New_York
          type: string
      type: object
    SecurityMonitoringRuleResponse:
      description: Create a new rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
    AppTriggerWrapper:
      description: Schema for an App-based trigger.
      properties:
        appTrigger:
          description: Trigger a workflow from an App.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - appTrigger
      type: object
    IncidentAttachmentType:
      default: incident_attachments
      description: The incident attachment resource type.
      enum:
      - incident_attachments
      example: incident_attachments
      type: string
      x-enum-varnames:
      - INCIDENT_ATTACHMENTS
    IncidentUserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        uuid:
          description: UUID of the user.
          type: string
          example: abc-123-def
      type: object
    SpansMetricUpdateCompute:
      description: The compute rule to compute the span-based metric.
      properties:
        include_percentiles:
          $ref: '#/components/schemas/SpansMetricComputeIncludePercentiles'
      type: object
    BudgetAttributes:
      description: The attributes of a budget.
      properties:
        created_at:
          description: The timestamp when the budget was created.
          example: 1738258683590
          format: int64
          type: integer
        created_by:
          description: The id of the user that created the budget.
          example: 00000000-0a0a-0a0a-aaa0-00000000000a
          type: string
        end_month:
          description: The month when the budget ends.
          example: 202502
          format: int64
          type: integer
        entries:
          description: The entries of the budget.
          items:
            $ref: '#/components/schemas/BudgetEntry'
          type: array
        metrics_query:
          description: The cost query used to track against the budget.
          example: aws.cost.amortized{service:ec2} by {service}
          type: string
        name:
          description: The name of the budget.
          example: my budget
          type: string
        org_id:
          description: The id of the org the budget belongs to.
          example: 123
          format: int64
          type: integer
        start_month:
          description: The month when the budget starts.
          example: 202501
          format: int64
          type: integer
        total_amount:
          description: The sum of all budget entries' amounts.
          example: 1000
          format: double
          type: number
        updated_at:
          description: The timestamp when the budget was last updated.
          example: 1738258683590
          format: int64
          type: integer
        updated_by:
          description: The id of the user that created the budget.
          example: 00000000-0a0a-0a0a-aaa0-00000000000a
          type: string
      type: object
    AzureUCConfigPatchRequestAttributes:
      description: Attributes for Azure config Patch Request.
      properties:
        is_enabled:
          description: Whether or not the Cloud Cost Management account is enabled.
          example: true
          type: boolean
      required:
      - is_enabled
      type: object
    WorkflowTriggerWrapper:
      description: Schema for a Workflow-based trigger.
      properties:
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
        workflowTrigger:
          description: Trigger a workflow from the Datadog UI. Only required if no other trigger exists.
          type: object
      required:
      - workflowTrigger
      type: object
    LayerAttributes:
      description: Describes key properties of a Layer, including rotation details, name, start/end times, and any restrictions.
      properties:
        effective_date:
          description: When the layer becomes active (ISO 8601).
          format: date-time
          type: string
          example: '2026-04-17T12:00:00Z'
        end_date:
          description: When the layer ceases to be active (ISO 8601).
          format: date-time
          type: string
          example: '2026-04-17T12:00:00Z'
        interval:
          $ref: '#/components/schemas/LayerAttributesInterval'
        name:
          description: The name of this layer.
          example: Weekend Layer
          type: string
        restrictions:
          description: An optional list of time restrictions for when this layer is in effect.
          items:
            $ref: '#/components/schemas/TimeRestriction'
          type: array
        rotation_start:
          description: The date/time when the rotation starts (ISO 8601).
          format: date-time
          type: string
          example: example_value
      type: object
    SensitiveDataScannerRuleUpdateRequest:
      description: Update rule request.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerRuleUpdate'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      required:
      - data
      - meta
      type: object
    ObservabilityPipelineKafkaSourceSasl:
      description: Specifies the SASL mechanism for authenticating with a Kafka cluster.
      properties:
        mechanism:
          $ref: '#/components/schemas/ObservabilityPipelinePipelineKafkaSourceSaslMechanism'
      type: object
    ObservabilityPipelineSplunkHecDestination:
      description: 'The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC).

        '
      properties:
        auto_extract_timestamp:
          description: 'If `true`, Splunk tries to extract timestamps from incoming log events.

            If `false`, Splunk assigns the time the event was received.

            '
          example: true
          type: boolean
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-hec-destination
          type: string
        index:
          description: Optional name of the Splunk index where logs are written.
          example: main
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        sourcetype:
          description: The Splunk sourcetype to assign to log events.
          example: custom_sourcetype
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    StepDisplay:
      description: The definition of `StepDisplay` object.
      properties:
        bounds:
          $ref: '#/components/schemas/StepDisplayBounds'
      type: object
    RelationshipToUserData:
      description: Relationship to user object.
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    ServiceDefinitionV1Version:
      default: v1
      description: Schema version being used.
      enum:
      - v1
      example: v1
      type: string
      x-enum-varnames:
      - V1
    DataRelationshipsTeamsDataItemsType:
      default: teams
      description: Teams resource type.
      enum:
      - teams
      example: teams
      type: string
      x-enum-varnames:
      - TEAMS
    Query:
      description: A data query used by an app. This can take the form of an external action, a data transformation, or a state variable.
      oneOf:
      - $ref: '#/components/schemas/ActionQuery'
      - $ref: '#/components/schemas/DataTransform'
      - $ref: '#/components/schemas/StateVariable'
    ActionQuerySpec:
      description: The definition of the action query.
      oneOf:
      - type: string
      - $ref: '#/components/schemas/ActionQuerySpecObject'
    ConnectionEnvEnv:
      description: The definition of `ConnectionEnvEnv` object.
      enum:
      - default
      example: default
      type: string
      x-enum-varnames:
      - DEFAULT
    IncidentAttachmentLinkAttributes:
      description: The attributes object for a link attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType'
        modified:
          description: Timestamp when the incident attachment link was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - attachment_type
      - attachment
      type: object
    AWSAccountUpdateRequest:
      description: AWS Account Update Request body.
      properties:
        data:
          $ref: '#/components/schemas/AWSAccountUpdateRequestData'
      required:
      - data
      type: object
    IncidentUserData:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentUserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    ObservabilityPipelineQuotaProcessorOverride:
      description: Defines a custom quota limit that applies to specific log events based on matching field values.
      properties:
        fields:
          description: A list of field matchers used to apply a specific override. If an event matches all listed key-value pairs, the corresponding override limit is enforced.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineFieldValue'
          type: array
        limit:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit'
      required:
      - fields
      - limit
      type: object
    AWSAssumeRoleType:
      description: The definition of `AWSAssumeRoleType` object.
      enum:
      - AWSAssumeRole
      example: AWSAssumeRole
      type: string
      x-enum-varnames:
      - AWSASSUMEROLE
    AppBuilderEventName:
      description: The triggering action for the event.
      enum:
      - pageChange
      - tableRowClick
      - _tableRowButtonClick
      - change
      - submit
      - click
      - toggleOpen
      - close
      - open
      - executionFinished
      example: click
      type: string
      x-enum-varnames:
      - PAGECHANGE
      - TABLEROWCLICK
      - TABLEROWBUTTONCLICK
      - CHANGE
      - SUBMIT
      - CLICK
      - TOGGLEOPEN
      - CLOSE
      - OPEN
      - EXECUTIONFINISHED
    CloudflareAccountUpdateRequestData:
      description: Data object for updating a Cloudflare account.
      properties:
        attributes:
          $ref: '#/components/schemas/CloudflareAccountUpdateRequestAttributes'
        type:
          $ref: '#/components/schemas/CloudflareAccountType'
      type: object
      x-merge-override:
        required: false
    EntityV3DatadogPerformance:
      additionalProperties: false
      description: Performance stats association.
      properties:
        tags:
          description: A list of APM entity tags that associates the APM Stats data with the entity.
          items:
            type: string
          type: array
      type: object
    AzureUCConfig:
      description: Azure config.
      properties:
        account_id:
          description: The tenant ID of the azure account.
          example: 1234abcd-1234-abcd-1234-1234abcd1234
          type: string
        client_id:
          description: The client ID of the Azure account.
          example: 1234abcd-1234-abcd-1234-1234abcd1234
          type: string
        created_at:
          description: The timestamp when the Azure config was created.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: example_value
        dataset_type:
          description: The dataset type of the Azure config.
          example: actual
          type: string
        error_messages:
          description: The error messages for the Azure config.
          items:
            type: string
          type: array
        export_name:
          description: The name of the configured Azure Export.
          example: dd-actual-export
          type: string
        export_path:
          description: The path where the Azure Export is saved.
          example: dd-export-path
          type: string
        id:
          description: The ID of the Azure config.
          format: int64
          type: integer
          example: 42
        months:
          deprecated: true
          description: The number of months the report has been backfilled.
          format: int32
          maximum: 36
          type: integer
          example: 42
        scope:
          description: The scope of your observed subscription.
          example: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234
          type: string
        status:
          description: The status of the Azure config.
          example: active
          type: string
        status_updated_at:
          description: The timestamp when the Azure config status was last updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: OK
        storage_account:
          description: The name of the storage account where the Azure Export is saved.
          example: dd-storage-account
          type: string
        storage_container:
          description: The name of the storage container where the Azure Export is saved.
          example: dd-storage-container
          type: string
        updated_at:
          description: The timestamp when the Azure config was last updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: '2026-04-17T12:00:00Z'
      required:
      - account_id
      - client_id
      - dataset_type
      - export_name
      - export_path
      - scope
      - status
      - storage_account
      - storage_container
      type: object
      x-merge-override:
        required: false
    SpansFilter:
      description: The spans filter used to index spans.
      properties:
        query:
          description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/).
          example: '@http.status_code:200 service:my-service'
          type: string
      type: object
    UpdateRuleResponse:
      description: The response from a rule update request.
      properties:
        data:
          $ref: '#/components/schemas/UpdateRuleResponseData'
      type: object
    RestrictionQueryUpdateAttributes:
      description: Attributes of the edited restriction query.
      properties:
        restriction_query:
          description: The restriction query.
          example: env:sandbox
          type: string
      type: object
    TeamReferenceAttributes:
      description: Encapsulates the basic attributes of a Team reference, such as name, handle, and an optional avatar or description.
      properties:
        avatar:
          description: URL or reference for the team's avatar (if available).
          type: string
          example: example_value
        description:
          description: A short text describing the team.
          type: string
          example: example_value
        handle:
          description: A unique handle/slug for the team.
          type: string
          example: example_value
        name:
          description: The full, human-readable name of the team.
          type: string
          example: Example Monitor
      type: object
    CustomDestinationResponseHttpDestinationAuthCustomHeaderType:
      default: custom_header
      description: Type of the custom header access authentication.
      enum:
      - custom_header
      example: custom_header
      type: string
      x-enum-varnames:
      - CUSTOM_HEADER
    MonitorNotificationRuleData:
      description: Monitor notification rule data.
      properties:
        attributes:
          $ref: '#/components/schemas/MonitorNotificationRuleResponseAttributes'
        id:
          $ref: '#/components/schemas/MonitorNotificationRuleId'
        relationships:
          $ref: '#/components/schemas/MonitorNotificationRuleRelationships'
        type:
          $ref: '#/components/schemas/MonitorNotificationRuleResourceType'
      type: object
    ObservabilityPipelineAmazonS3Source:
      description: 'The `amazon_s3` source ingests logs from an Amazon S3 bucket.

        It supports AWS authentication and TLS encryption.

        '
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAwsAuth'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: aws-s3-source
          type: string
        region:
          description: AWS region where the S3 bucket resides.
          example: us-east-1
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonS3SourceType'
      required:
      - id
      - type
      - region
      type: object
    SecurityFilterExclusionFilter:
      description: Exclusion filter for the security filter.
      example:
        name: Exclude staging
        query: source:staging
      properties:
        name:
          description: Exclusion filter name.
          example: Exclude staging
          type: string
        query:
          description: Exclusion filter query. Logs that match this query are excluded from the security filter.
          example: source:staging
          type: string
      required:
      - name
      - query
      type: object
    RumMetricComputeIncludePercentiles:
      description: 'Toggle to include or exclude percentile aggregations for distribution metrics.

        Only present when `aggregation_type` is `distribution`.'
      example: true
      type: boolean
    RelationshipToUserTeamPermissionData:
      description: Related user team permission data
      properties:
        id:
          description: The ID of the user team permission
          example: UserTeamPermissions-aeadc05e-98a8-11ec-ac2c-da7ad0900001-416595
          type: string
        type:
          $ref: '#/components/schemas/UserTeamPermissionType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    TeamUpdate:
      description: Team update request
      properties:
        attributes:
          $ref: '#/components/schemas/TeamUpdateAttributes'
        relationships:
          $ref: '#/components/schemas/TeamUpdateRelationships'
        type:
          $ref: '#/components/schemas/TeamType'
      required:
      - attributes
      - type
      type: object
    AWSCredentialsUpdate:
      description: The definition of `AWSCredentialsUpdate` object.
      oneOf:
      - $ref: '#/components/schemas/AWSAssumeRoleUpdate'
    CloudflareAccountResponse:
      description: The expected response schema when getting a Cloudflare account.
      properties:
        data:
          $ref: '#/components/schemas/CloudflareAccountResponseData'
      type: object
    ConfluentResourceResponseAttributes:
      description: Model representation of a Confluent Cloud resource.
      properties:
        enable_custom_metrics:
          default: false
          description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags.
          example: false
          type: boolean
        id:
          description: The ID associated with the Confluent resource.
          example: resource_id_abc123
          type: string
        resource_type:
          description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, or `schema_registry`.
          example: kafka
          type: string
        tags:
          description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - resource_type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineAmazonS3Destination:
      description: The `amazon_s3` destination sends your logs in Datadog-rehydratable format to an Amazon S3 bucket for archiving.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAwsAuth'
        bucket:
          description: S3 bucket name.
          example: error-logs
          type: string
        id:
          description: Unique identifier for the destination component.
          example: amazon-s3-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        key_prefix:
          description: Optional prefix for object keys.
          type: string
          example: example_value
        region:
          description: AWS region of the S3 bucket.
          example: us-east-1
          type: string
        storage_class:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationType'
      required:
      - id
      - type
      - inputs
      - bucket
      - region
      - storage_class
      type: object
    MetricTagConfigurationUpdateRequest:
      description: Request object that includes the metric that you would like to edit the tag configuration on.
      properties:
        data:
          $ref: '#/components/schemas/MetricTagConfigurationUpdateData'
      required:
      - data
      type: object
    ServiceDefinitionV2Dot2Type:
      description: The type of service.
      example: web
      type: string
    UpdateActionConnectionResponse:
      description: The response for an updated connection.
      properties:
        data:
          $ref: '#/components/schemas/ActionConnectionData'
      type: object
    AWSNamespaceFiltersExcludeOnly:
      description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`.

        `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.'
      properties:
        exclude_only:
          description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`.

            `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.'
          example:
          - AWS/SQS
          - AWS/ElasticMapReduce
          items:
            example: AWS/SQS
            type: string
          type: array
      required:
      - exclude_only
      type: object
    ObservabilityPipelineFieldValue:
      description: Represents a static key-value pair used in various processors.
      properties:
        name:
          description: The field name.
          example: field_name
          type: string
        value:
          description: The field value.
          example: field_value
          type: string
      required:
      - name
      - value
      type: object
    CaseResponse:
      description: Case response
      properties:
        data:
          $ref: '#/components/schemas/Case'
      type: object
    ObservabilityPipelineDataAttributes:
      description: Defines the pipeline’s name and its components (sources, processors, and destinations).
      properties:
        config:
          $ref: '#/components/schemas/ObservabilityPipelineConfig'
        name:
          description: Name of the pipeline.
          example: Main Observability Pipeline
          type: string
      required:
      - name
      - config
      type: object
    EntityV3Service:
      additionalProperties: false
      description: Schema for service entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3ServiceDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3ServiceKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3ServiceSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    EntityResponseIncludedSchemaType:
      description: Schema type.
      enum:
      - schema
      type: string
      x-enum-varnames:
      - SCHEMA
    SpansMetricResponseGroupBy:
      description: A group by rule.
      properties:
        path:
          description: The path to the value the span-based metric will be aggregated over.
          example: resource_name
          type: string
        tag_name:
          description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name.
          example: resource_name
          type: string
      type: object
    ObservabilityPipelineDatadogAgentSourceType:
      default: datadog_agent
      description: The source type. The value should always be `datadog_agent`.
      enum:
      - datadog_agent
      example: datadog_agent
      type: string
      x-enum-varnames:
      - DATADOG_AGENT
    TeamPermissionSettingResponse:
      description: Team permission setting response
      properties:
        data:
          $ref: '#/components/schemas/TeamPermissionSetting'
      type: object
    IncidentResponseIncludedItem:
      description: An object related to an incident that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/IncidentUserData'
      - $ref: '#/components/schemas/IncidentAttachmentData'
    ObservabilityPipelineFluentBitSourceType:
      default: fluent_bit
      description: The source type. The value should always be `fluent_bit`.
      enum:
      - fluent_bit
      example: fluent_bit
      type: string
      x-enum-varnames:
      - FLUENT_BIT
    WorkflowDataType:
      description: The definition of `WorkflowDataType` object.
      enum:
      - workflows
      example: workflows
      type: string
      x-enum-varnames:
      - WORKFLOWS
    SecurityMonitoringRuleQuery:
      description: Query for matching rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleQuery'
    RelationshipToTeamLinkData:
      description: Relationship between a link and a team
      properties:
        id:
          description: The team link's identifier
          example: f9bb8444-af7f-11ec-ac2c-da7ad0900001
          type: string
        type:
          $ref: '#/components/schemas/TeamLinkType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    RumMetricResponse:
      description: The rum-based metric object.
      properties:
        data:
          $ref: '#/components/schemas/RumMetricResponseData'
      type: object
    ActionQuerySpecInput:
      additionalProperties: {}
      description: The inputs to the action query. See the [Actions Catalog](https://docs.datadoghq.com/actions/actions_catalog/) for more detail on each action and its inputs.
      type: object
    DowntimeNotifyEndTypes:
      description: Actions that will trigger a monitor notification if the downtime is in the `notify_end_types` state.
      example:
      - canceled
      - expired
      items:
        $ref: '#/components/schemas/DowntimeNotifyEndStateActions'
      type: array
    RUMApplication:
      description: RUM application.
      properties:
        attributes:
          $ref: '#/components/schemas/RUMApplicationAttributes'
        id:
          description: RUM application ID.
          example: abcd1234-0000-0000-abcd-1234abcd5678
          type: string
          x-merge-override:
            format: false
        type:
          $ref: '#/components/schemas/RUMApplicationType'
      required:
      - attributes
      - id
      - type
      type: object
    ServiceDefinitionV1ResourceType:
      description: Link type.
      enum:
      - doc
      - wiki
      - runbook
      - url
      - repo
      - dashboard
      - oncall
      - code
      - link
      example: runbook
      type: string
      x-enum-varnames:
      - DOC
      - WIKI
      - RUNBOOK
      - URL
      - REPO
      - DASHBOARD
      - ONCALL
      - CODE
      - LINK
    DowntimeResourceType:
      default: downtime
      description: Downtime resource type.
      enum:
      - downtime
      example: downtime
      type: string
      x-enum-varnames:
      - DOWNTIME
    CaseStatus:
      description: Case status
      enum:
      - OPEN
      - IN_PROGRESS
      - CLOSED
      example: OPEN
      type: string
      x-enum-varnames:
      - OPEN
      - IN_PROGRESS
      - CLOSED
    IncidentUpdateRelationships:
      description: The incident's relationships for an update request.
      properties:
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        postmortem:
          $ref: '#/components/schemas/RelationshipToIncidentPostmortem'
      type: object
    TeamLinkType:
      default: team_links
      description: Team link type
      enum:
      - team_links
      example: team_links
      type: string
      x-enum-varnames:
      - TEAM_LINKS
    DowntimeMonitorIdentifierId:
      additionalProperties: {}
      description: Object of the monitor identifier.
      properties:
        monitor_id:
          description: ID of the monitor to prevent notifications.
          example: 123
          format: int64
          type: integer
      required:
      - monitor_id
      type: object
    ServiceDefinitionV2Dot2Contact:
      description: Service owner's contacts information.
      properties:
        contact:
          description: Contact value.
          example: https://teams.microsoft.com/myteam
          type: string
        name:
          description: Contact Name.
          example: My team channel
          type: string
        type:
          description: 'Contact type. Datadog recognizes the following types: `email`, `slack`, and `microsoft-teams`.'
          example: slack
          type: string
      required:
      - type
      - contact
      type: object
    BudgetEntry:
      description: The entry of a budget.
      properties:
        amount:
          description: The `amount` of the budget entry.
          example: 500
          format: double
          type: number
        month:
          description: The `month` of the budget entry.
          example: 202501
          format: int64
          type: integer
        tag_filters:
          description: The `tag_filters` of the budget entry.
          items:
            $ref: '#/components/schemas/TagFilter'
          type: array
      type: object
    CustomDestinationHttpDestinationAuth:
      description: Authentication method of the HTTP requests.
      oneOf:
      - $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthBasic'
      - $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeader'
    MicrosoftTeamsWorkflowsWebhookHandleResponse:
      description: Response of a Workflows webhook handle.
      properties:
        data:
          $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponseData'
      required:
      - data
      type: object
    FastlyServiceData:
      description: Data object for Fastly service requests.
      properties:
        attributes:
          $ref: '#/components/schemas/FastlyServiceAttributes'
        id:
          description: The ID of the Fastly service.
          example: abc123
          type: string
        type:
          $ref: '#/components/schemas/FastlyServiceType'
      required:
      - id
      - type
      type: object
    ConfluentAccountResponseAttributes:
      description: The attributes of a Confluent account.
      properties:
        api_key:
          description: The API key associated with your Confluent account.
          example: TESTAPIKEY123
          type: string
        resources:
          description: A list of Confluent resources associated with the Confluent account.
          items:
            $ref: '#/components/schemas/ConfluentResourceResponseAttributes'
          type: array
        tags:
          description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - api_key
      type: object
    EntityV3ServiceKind:
      description: The definition of Entity V3 Service Kind object.
      enum:
      - service
      example: service
      type: string
      x-enum-varnames:
      - SERVICE
    ObservabilityPipelineSensitiveDataScannerProcessorScopeAll:
      description: Applies scanning across all available fields.
      properties:
        target:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget'
      required:
      - target
      type: object
    DowntimeStatus:
      description: The current status of the downtime.
      enum:
      - active
      - canceled
      - ended
      - scheduled
      example: active
      type: string
      x-enum-varnames:
      - ACTIVE
      - CANCELED
      - ENDED
      - SCHEDULED
    CloudWorkloadSecurityAgentRuleType:
      default: agent_rule
      description: The type of the resource, must always be `agent_rule`
      enum:
      - agent_rule
      example: agent_rule
      type: string
      x-enum-varnames:
      - AGENT_RULE
    EntityV3DatadogIntegrationPagerduty:
      additionalProperties: false
      description: A PagerDuty integration schema.
      properties:
        serviceURL:
          description: The service URL for the PagerDuty integration.
          example: https://www.pagerduty.com/service-directory/Pshopping-cart
          minLength: 1
          type: string
      required:
      - serviceURL
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions:
      description: Fields to which the scope rule applies.
      properties:
        fields:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions` `fields`.
          example:
          - ''
          items:
            type: string
          type: array
      required:
      - fields
      type: object
    IncidentRelatedObject:
      description: Object related to an incident.
      enum:
      - users
      - attachments
      type: string
      x-enum-varnames:
      - USERS
      - ATTACHMENTS
    AWSMetricsConfig:
      description: AWS Metrics Collection config.
      properties:
        automute_enabled:
          description: Enable EC2 automute for AWS metrics. Defaults to `true`.
          example: true
          type: boolean
        collect_cloudwatch_alarms:
          description: Enable CloudWatch alarms collection. Defaults to `false`.
          example: false
          type: boolean
        collect_custom_metrics:
          description: Enable custom metrics collection. Defaults to `false`.
          example: false
          type: boolean
        enabled:
          description: Enable AWS metrics collection. Defaults to `true`.
          example: true
          type: boolean
        namespace_filters:
          $ref: '#/components/schemas/AWSNamespaceFilters'
        tag_filters:
          description: AWS Metrics collection tag filters list. Defaults to `[]`.
          items:
            $ref: '#/components/schemas/AWSNamespaceTagFilter'
          type: array
      type: object
    ObservabilityPipelineSplunkHecDestinationEncoding:
      description: Encoding format for log events.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    DowntimeRelationshipsMonitorData:
      description: Data for the monitor.
      nullable: true
      properties:
        id:
          description: Monitor ID of the downtime.
          example: '12345'
          type: string
        type:
          $ref: '#/components/schemas/DowntimeIncludedMonitorType'
      type: object
    UpdateWorkflowRequest:
      description: A request object for updating an existing workflow.
      example:
        data:
          attributes:
            description: A sample workflow.
            name: Example Workflow
            published: true
            spec:
              annotations:
              - display:
                  bounds:
                    height: 150
                    width: 300
                    x: -375
                    y: -0.5
                id: 99999999-9999-9999-9999-999999999999
                markdownTextAnnotation:
                  text: Example annotation.
              connectionEnvs:
              - connections:
                - connectionId: 11111111-1111-1111-1111-111111111111
                  label: INTEGRATION_DATADOG
                env: default
              handle: my-handle
              inputSchema:
                parameters:
                - defaultValue: default
                  name: input
                  type: STRING
              outputSchema:
                parameters:
                - name: output
                  type: ARRAY_OBJECT
                  value: '{{ Steps.Step1 }}'
              steps:
              - actionId: com.datadoghq.dd.monitor.listMonitors
                connectionLabel: INTEGRATION_DATADOG
                name: Step1
                outboundEdges:
                - branchName: main
                  nextStepName: Step2
                parameters:
                - name: tags
                  value: service:monitoring
              - actionId: com.datadoghq.core.noop
                name: Step2
              triggers:
              - monitorTrigger:
                  rateLimit:
                    count: 1
                    interval: 3600s
                startStepNames:
                - Step1
              - githubWebhookTrigger: {}
                startStepNames:
                - Step1
            tags:
            - team:infra
            - service:monitoring
            - foo:bar
          id: 22222222-2222-2222-2222-222222222222
          type: workflows
      properties:
        data:
          $ref: '#/components/schemas/WorkflowDataUpdate'
      required:
      - data
      type: object
    FastlyServiceResponse:
      description: The expected response schema when getting a Fastly service.
      properties:
        data:
          $ref: '#/components/schemas/FastlyServiceData'
      type: object
    RelationshipToIncidentUserDefinedFields:
      description: Relationship to incident user defined fields.
      properties:
        data:
          description: An array of user defined fields.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFieldData'
          type: array
      required:
      - data
      type: object
    DataTransform:
      description: A data transformer, which is custom JavaScript code that executes and transforms data when its inputs change.
      properties:
        id:
          description: The ID of the data transformer.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        name:
          description: A unique identifier for this data transformer. This name is also used to access the transformer's result throughout the app.
          example: combineTwoOrders
          type: string
        properties:
          $ref: '#/components/schemas/DataTransformProperties'
        type:
          $ref: '#/components/schemas/DataTransformType'
      required:
      - id
      - name
      - type
      - properties
      type: object
    IncidentTeamUpdateAttributes:
      description: The incident team's attributes for an update request.
      properties:
        name:
          description: Name of the incident team.
          example: team name
          type: string
      required:
      - name
      type: object
    UserResponseIncludedItem:
      description: An object related to a user.
      oneOf:
      - $ref: '#/components/schemas/Organization'
      - $ref: '#/components/schemas/Permission'
      - $ref: '#/components/schemas/Role'
    LayerType:
      default: layers
      description: Layers resource type.
      enum:
      - layers
      example: layers
      type: string
      x-enum-varnames:
      - LAYERS
    ObservabilityPipelineRsyslogSourceType:
      default: rsyslog
      description: The source type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    ObservabilityPipelineOcsfMappingLibrary:
      description: Predefined library mappings for common log formats.
      enum:
      - CloudTrail Account Change
      - GCP Cloud Audit CreateBucket
      - GCP Cloud Audit CreateSink
      - GCP Cloud Audit SetIamPolicy
      - GCP Cloud Audit UpdateSink
      - Github Audit Log API Activity
      - Google Workspace Admin Audit addPrivilege
      - Microsoft 365 Defender Incident
      - Microsoft 365 Defender UserLoggedIn
      - Okta System Log Authentication
      - Palo Alto Networks Firewall Traffic
      example: CloudTrail Account Change
      type: string
      x-enum-varnames:
      - CLOUDTRAIL_ACCOUNT_CHANGE
      - GCP_CLOUD_AUDIT_CREATEBUCKET
      - GCP_CLOUD_AUDIT_CREATESINK
      - GCP_CLOUD_AUDIT_SETIAMPOLICY
      - GCP_CLOUD_AUDIT_UPDATESINK
      - GITHUB_AUDIT_LOG_API_ACTIVITY
      - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE
      - MICROSOFT_365_DEFENDER_INCIDENT
      - MICROSOFT_365_DEFENDER_USERLOGGEDIN
      - OKTA_SYSTEM_LOG_AUTHENTICATION
      - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC
    ActionQueryOnlyTriggerManually:
      description: Determines when this query is executed. If set to `false`, the query will run when the app loads and whenever any query arguments change. If set to `true`, the query will only run when manually triggered from elsewhere in the app.
      oneOf:
      - type: boolean
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean.
        example: ${true}
        type: string
    CustomDestinationUpdateRequest:
      description: The custom destination.
      properties:
        data:
          $ref: '#/components/schemas/CustomDestinationUpdateRequestDefinition'
      type: object
    GCPSTSServiceAccountUpdateRequest:
      description: Service account info.
      properties:
        data:
          $ref: '#/components/schemas/GCPSTSServiceAccountUpdateRequestData'
      type: object
    EscalationPolicyUserAttributes:
      description: Provides basic user information for an escalation policy, including a name and email address.
      properties:
        email:
          description: The user's email address.
          example: jane.doe@example.com
          type: string
        name:
          description: The user's name.
          example: Jane Doe
          type: string
        status:
          $ref: '#/components/schemas/UserAttributesStatus'
      type: object
    MicrosoftTeamsTenantBasedHandleResponse:
      description: Response of a tenant-based handle.
      properties:
        data:
          $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleResponseData'
      required:
      - data
      type: object
    DowntimeMessage:
      description: 'A message to include with notifications for this downtime. Email notifications can be sent to specific users

        by using the same `@username` notation as events.'
      example: Message about the downtime
      nullable: true
      type: string
    UpdateResourceEvaluationFiltersRequestData:
      description: The definition of `UpdateResourceFilterRequestData` object.
      properties:
        attributes:
          $ref: '#/components/schemas/ResourceFilterAttributes'
        id:
          description: The `UpdateResourceEvaluationFiltersRequestData` `id`.
          example: csm_resource_filter
          type: string
        type:
          $ref: '#/components/schemas/ResourceFilterRequestType'
      required:
      - attributes
      - type
      type: object
    TeamUpdateRelationships:
      description: Team update relationships
      properties:
        team_links:
          $ref: '#/components/schemas/RelationshipToTeamLinks'
      type: object
    ActionConnectionDataType:
      description: The definition of `ActionConnectionDataType` object.
      enum:
      - action_connection
      example: action_connection
      type: string
      x-enum-varnames:
      - ACTION_CONNECTION
    EscalationPolicyIncluded:
      description: Represents included related resources when retrieving an escalation policy, such as teams, steps, or targets.
      oneOf:
      - $ref: '#/components/schemas/TeamReference'
      - $ref: '#/components/schemas/EscalationPolicyStep'
      - $ref: '#/components/schemas/EscalationPolicyUser'
      - $ref: '#/components/schemas/ScheduleData'
    ServiceDefinitionV2Version:
      default: v2
      description: Schema version being used.
      enum:
      - v2
      example: v2
      type: string
      x-enum-varnames:
      - V2
    SecurityMonitoringSignalRuleQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      required:
      - ruleId
      type: object
    SecurityTriggerWrapper:
      description: Schema for a Security-based trigger.
      properties:
        securityTrigger:
          $ref: '#/components/schemas/SecurityTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - securityTrigger
      type: object
    CloudflareAccountResponseData:
      description: Data object of a Cloudflare account.
      properties:
        attributes:
          $ref: '#/components/schemas/CloudflareAccountResponseAttributes'
        id:
          description: The ID of the Cloudflare account, a hash of the account name.
          example: c1a8e059bfd1e911cf10b626340c9a54
          type: string
        type:
          $ref: '#/components/schemas/CloudflareAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ScheduleDataRelationships:
      description: Groups the relationships for a schedule object, referencing layers and teams.
      properties:
        layers:
          $ref: '#/components/schemas/ScheduleDataRelationshipsLayers'
        teams:
          $ref: '#/components/schemas/DataRelationshipsTeams'
      type: object
    RelationshipToIncidentPostmortem:
      description: A relationship reference for postmortems.
      example:
        data:
          id: 00000000-0000-abcd-3000-000000000000
          type: incident_postmortems
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToIncidentPostmortemData'
      required:
      - data
      type: object
    IPAllowlistResponse:
      description: Response containing information about the IP allowlist.
      properties:
        data:
          $ref: '#/components/schemas/IPAllowlistData'
      type: object
    TeamPermissionSettingValue:
      description: What type of user is allowed to perform the specified action
      enum:
      - admins
      - members
      - organization
      - user_access_manage
      - teams_manage
      type: string
      x-enum-varnames:
      - ADMINS
      - MEMBERS
      - ORGANIZATION
      - USER_ACCESS_MANAGE
      - TEAMS_MANAGE
    RumRetentionFilterResponse:
      description: The RUM retention filter object.
      properties:
        data:
          $ref: '#/components/schemas/RumRetentionFilterData'
      type: object
    LogsRestrictionQueriesType:
      default: logs_restriction_queries
      description: Restriction query resource type.
      enum:
      - logs_restriction_queries
      example: logs_restriction_queries
      type: string
      x-enum-varnames:
      - LOGS_RESTRICTION_QUERIES
    EntityAttributes:
      description: Entity attributes.
      properties:
        apiVersion:
          description: The API version.
          type: string
          example: example_value
        description:
          description: The description.
          type: string
          example: example_value
        displayName:
          description: The display name.
          type: string
          example: Example Monitor
        kind:
          description: The kind.
          type: string
          example: example_value
        name:
          description: The name.
          type: string
          example: Example Monitor
        namespace:
          description: The namespace.
          type: string
          example: Example Monitor
        owner:
          description: The owner.
          type: string
          example: example_value
        tags:
          description: The tags.
          items:
            type: string
          type: array
      type: object
    ScheduleUpdateRequestData:
      description: Contains all data needed to update an existing schedule, including its attributes (such as name and time zone) and any relationships to teams.
      properties:
        attributes:
          $ref: '#/components/schemas/ScheduleUpdateRequestDataAttributes'
        id:
          description: The ID of the schedule to be updated.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        relationships:
          $ref: '#/components/schemas/ScheduleUpdateRequestDataRelationships'
        type:
          $ref: '#/components/schemas/ScheduleUpdateRequestDataType'
      required:
      - type
      - id
      - attributes
      type: object
    ServiceDefinitionV2Dot1MSTeamsType:
      description: Contact type.
      enum:
      - microsoft-teams
      example: microsoft-teams
      type: string
      x-enum-varnames:
      - MICROSOFT_TEAMS
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    ObservabilityPipelineAmazonOpenSearchDestination:
      description: The `amazon_opensearch` destination writes logs to Amazon OpenSearch.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuth'
        bulk_index:
          description: The index to write logs to.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: elasticsearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationType'
      required:
      - id
      - type
      - inputs
      - auth
      type: object
    LogsMetricID:
      description: The name of the log-based metric.
      example: logs.page.load.count
      type: string
    ActionQueryRequiresConfirmation:
      description: Whether to prompt the user to confirm this query before it runs.
      oneOf:
      - type: boolean
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean.
        example: ${true}
        type: string
    ObservabilityPipelineEnrichmentTableGeoIp:
      description: Uses a GeoIP database to enrich logs based on an IP field.
      properties:
        key_field:
          description: Path to the IP field in the log.
          example: log.source.ip
          type: string
        locale:
          description: Locale used to resolve geographical names.
          example: en
          type: string
        path:
          description: Path to the GeoIP database file.
          example: /etc/geoip/GeoLite2-City.mmdb
          type: string
      required:
      - key_field
      - locale
      - path
      type: object
    LayerRelationshipsMembersDataItemsType:
      default: members
      description: Members resource type.
      enum:
      - members
      example: members
      type: string
      x-enum-varnames:
      - MEMBERS
    IncidentUpdateAttributes:
      description: The incident's attributes for an update request.
      properties:
        customer_impact_end:
          description: Timestamp when customers were no longer impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impact_scope:
          description: A summary of the impact customers experienced during the incident.
          example: Example customer impact scope
          type: string
        customer_impact_start:
          description: Timestamp when customers began being impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impacted:
          description: A flag indicating whether the incident caused customer impact.
          example: false
          type: boolean
        detected:
          description: Timestamp when the incident was detected.
          format: date-time
          nullable: true
          type: string
          example: example_value
        fields:
          additionalProperties:
            $ref: '#/components/schemas/IncidentFieldAttributes'
          description: A condensed view of the user-defined fields for which to update selections.
          example:
            severity:
              type: dropdown
              value: SEV-5
          type: object
        notification_handles:
          description: Notification handles that will be notified of the incident during update.
          example:
          - display_name: Jane Doe
            handle: '@user@email.com'
          - display_name: Slack Channel
            handle: '@slack-channel'
          - display_name: Incident Workflow
            handle: '@workflow-from-incident'
          items:
            $ref: '#/components/schemas/IncidentNotificationHandle'
          type: array
        title:
          description: The title of the incident, which summarizes what happened.
          example: A test incident title
          type: string
      type: object
    OpenAPIFile:
      description: Object for API data in an `OpenAPI` format as a file.
      properties:
        openapi_spec_file:
          description: Binary `OpenAPI` spec file
          format: binary
          type: string
          example: example_value
      type: object
    RunRetentionFilterName:
      description: The name of a RUM retention filter.
      example: Retention filter for session
      type: string
    IncidentResponseAttributes:
      description: The incident's attributes from a response.
      properties:
        archived:
          description: Timestamp of when the incident was archived.
          format: date-time
          nullable: true
          readOnly: true
          type: string
          example: example_value
        case_id:
          description: The incident case id.
          format: int64
          nullable: true
          type: integer
          example: 42
        created:
          description: Timestamp when the incident was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        customer_impact_duration:
          description: 'Length of the incident''s customer impact in seconds.

            Equals the difference between `customer_impact_start` and `customer_impact_end`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        customer_impact_end:
          description: Timestamp when customers were no longer impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impact_scope:
          description: A summary of the impact customers experienced during the incident.
          example: An example customer impact scope
          nullable: true
          type: string
        customer_impact_start:
          description: Timestamp when customers began being impacted by the incident.
          format: date-time
          nullable: true
          type: string
          example: example_value
        customer_impacted:
          description: A flag indicating whether the incident caused customer impact.
          example: false
          type: boolean
        detected:
          description: Timestamp when the incident was detected.
          format: date-time
          nullable: true
          type: string
          example: example_value
        fields:
          additionalProperties:
            $ref: '#/components/schemas/IncidentFieldAttributes'
          description: A condensed view of the user-defined fields attached to incidents.
          example:
            severity:
              type: dropdown
              value: SEV-5
          type: object
        incident_type_uuid:
          description: A unique identifier that represents an incident type.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        modified:
          description: Timestamp when the incident was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        non_datadog_creator:
          $ref: '#/components/schemas/IncidentNonDatadogCreator'
        notification_handles:
          description: Notification handles that will be notified of the incident during update.
          example:
          - display_name: Jane Doe
            handle: '@user@email.com'
          - display_name: Slack Channel
            handle: '@slack-channel'
          - display_name: Incident Workflow
            handle: '@workflow-from-incident'
          items:
            $ref: '#/components/schemas/IncidentNotificationHandle'
          nullable: true
          type: array
        public_id:
          description: The monotonically increasing integer ID for the incident.
          example: 1
          format: int64
          type: integer
        resolved:
          description: Timestamp when the incident's state was last changed from active or stable to resolved or completed.
          format: date-time
          nullable: true
          type: string
          example: example_value
        severity:
          $ref: '#/components/schemas/IncidentSeverity'
        state:
          description: The state incident.
          nullable: true
          type: string
          example: example_value
        time_to_detect:
          description: 'The amount of time in seconds to detect the incident.

            Equals the difference between `customer_impact_start` and `detected`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_internal_response:
          description: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_repair:
          description: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_resolve:
          description: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        title:
          description: The title of the incident, which summarizes what happened.
          example: A test incident title
          type: string
        visibility:
          description: The incident visibility status.
          nullable: true
          type: string
          example: example_value
      required:
      - title
      type: object
    BudgetWithEntries:
      description: The definition of the `BudgetWithEntries` object.
      properties:
        data:
          $ref: '#/components/schemas/BudgetWithEntriesData'
      type: object
    EntityV3MetadataAdditionalOwnersItems:
      description: The definition of Entity V3 Metadata Additional Owners Items object.
      properties:
        name:
          description: Team name.
          example: ''
          type: string
        type:
          description: Team type.
          type: string
          example: metric alert
      required:
      - name
      type: object
    ApplicationSecurityWafCustomRuleActionParameters:
      description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object.
      properties:
        location:
          description: The location to redirect to when the WAF custom rule triggers.
          example: /blocking
          type: string
        status_code:
          default: 403
          description: The status code to return when the WAF custom rule triggers.
          example: 403
          format: int64
          type: integer
      type: object
    ServiceDefinitionV2Dot1MSTeams:
      description: Service owner's Microsoft Teams.
      properties:
        contact:
          description: Contact value.
          example: https://teams.microsoft.com/myteam
          type: string
        name:
          description: Contact Microsoft Teams.
          example: My team channel
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1MSTeamsType'
      required:
      - type
      - contact
      type: object
    SensitiveDataScannerRuleType:
      default: sensitive_data_scanner_rule
      description: Sensitive Data Scanner rule type.
      enum:
      - sensitive_data_scanner_rule
      example: sensitive_data_scanner_rule
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_RULE
    DowntimeScheduleUpdateRequest:
      description: Schedule for the downtime.
      oneOf:
      - $ref: '#/components/schemas/DowntimeScheduleRecurrencesUpdateRequest'
      - $ref: '#/components/schemas/DowntimeScheduleOneTimeCreateUpdateRequest'
    AWSNamespaceFilters:
      description: AWS Metrics namespace filters. Defaults to `exclude_only`.
      oneOf:
      - $ref: '#/components/schemas/AWSNamespaceFiltersExcludeOnly'
      - $ref: '#/components/schemas/AWSNamespaceFiltersIncludeOnly'
    ReadinessGate:
      description: Used to merge multiple branches into a single branch.
      properties:
        thresholdType:
          $ref: '#/components/schemas/ReadinessGateThresholdType'
      required:
      - thresholdType
      type: object
    AWSIntegrationUpdate:
      description: The definition of `AWSIntegrationUpdate` object.
      properties:
        credentials:
          $ref: '#/components/schemas/AWSCredentialsUpdate'
        type:
          $ref: '#/components/schemas/AWSIntegrationType'
      required:
      - type
      type: object
    UpdateResourceEvaluationFiltersResponse:
      description: The definition of `UpdateResourceEvaluationFiltersResponse` object.
      properties:
        data:
          $ref: '#/components/schemas/UpdateResourceEvaluationFiltersResponseData'
      required:
      - data
      type: object
    EntityV3DatadogPipelines:
      additionalProperties: false
      description: CI Pipelines association.
      properties:
        fingerprints:
          description: A list of CI Fingerprints that associate CI Pipelines with the entity.
          items:
            type: string
          type: array
      type: object
    ConfluentAccountUpdateRequestAttributes:
      description: Attributes object for updating a Confluent account.
      properties:
        api_key:
          description: The API key associated with your Confluent account.
          example: TESTAPIKEY123
          type: string
        api_secret:
          description: The API secret associated with your Confluent account.
          example: test-api-secret-123
          type: string
        tags:
          description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - api_key
      - api_secret
      type: object
    EntityV3System:
      additionalProperties: false
      description: Schema for system entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3SystemDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3SystemKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3SystemSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    EscalationPolicyData:
      description: Represents the data for a single escalation policy, including its attributes, ID, relationships, and resource type.
      properties:
        attributes:
          $ref: '#/components/schemas/EscalationPolicyDataAttributes'
        id:
          description: Specifies the unique identifier of the escalation policy.
          example: ab000000-0000-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/EscalationPolicyDataRelationships'
        type:
          $ref: '#/components/schemas/EscalationPolicyDataType'
      required:
      - type
      type: object
    EntityV3MetadataLinksItems:
      additionalProperties: false
      description: The definition of Entity V3 Metadata Links Items object.
      properties:
        name:
          description: Link name.
          example: mylink
          type: string
        provider:
          description: Link provider.
          type: string
          example: abc-123-def
        type:
          default: other
          description: Link type.
          example: link
          type: string
        url:
          description: Link URL.
          example: https://mylink
          type: string
      required:
      - name
      - type
      - url
      type: object
    RelationshipToOrganizations:
      description: Relationship to organizations.
      properties:
        data:
          description: Relationships to organization objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToOrganizationData'
          type: array
      required:
      - data
      type: object
    UserTeamUserType:
      default: users
      description: User team user type
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    MetricTagConfigurationUpdateData:
      description: Object for a single tag configuration to be edited.
      example:
        attributes:
          group_by:
          - app
          - datacenter
          include_percentiles: false
        id: http.endpoint.request
        type: manage_tags
      properties:
        attributes:
          $ref: '#/components/schemas/MetricTagConfigurationUpdateAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricTagConfigurationType'
      required:
      - id
      - type
      type: object
    SecurityFilterType:
      default: security_filters
      description: The type of the resource. The value should always be `security_filters`.
      enum:
      - security_filters
      example: security_filters
      type: string
      x-enum-varnames:
      - SECURITY_FILTERS
    WorkflowUserRelationshipData:
      description: The definition of `WorkflowUserRelationshipData` object.
      properties:
        id:
          description: The user identifier
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/WorkflowUserRelationshipType'
      required:
      - type
      - id
      type: object
    NullableRelationshipToUser:
      description: Relationship to user.
      nullable: true
      properties:
        data:
          $ref: '#/components/schemas/NullableRelationshipToUserData'
      required:
      - data
      type: object
    IncidentTriggerWrapper:
      description: Schema for an Incident-based trigger.
      properties:
        incidentTrigger:
          $ref: '#/components/schemas/IncidentTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - incidentTrigger
      type: object
    SecurityMonitoringRuleNewValueOptions:
      description: Options on new value detection method.
      properties:
        forgetAfter:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
        learningDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
        learningMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod'
        learningThreshold:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold'
      type: object
    DowntimeScheduleOneTimeResponse:
      description: A one-time downtime definition.
      properties:
        end:
          description: ISO-8601 Datetime to end the downtime.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          nullable: true
          type: string
        start:
          description: ISO-8601 Datetime to start the downtime.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          type: string
      required:
      - start
      type: object
    SensitiveDataScannerRule:
      description: Rule item included in the group.
      properties:
        id:
          description: ID of the rule.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      type: object
    ServiceDefinitionV1:
      deprecated: true
      description: Deprecated - Service definition V1 for providing additional service metadata and integrations.
      properties:
        contact:
          $ref: '#/components/schemas/ServiceDefinitionV1Contact'
        extensions:
          additionalProperties: {}
          description: Extensions to V1 schema.
          example:
            myorg/extension: extensionValue
          type: object
        external-resources:
          description: A list of external links related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV1Resource'
          type: array
        info:
          $ref: '#/components/schemas/ServiceDefinitionV1Info'
        integrations:
          $ref: '#/components/schemas/ServiceDefinitionV1Integrations'
        org:
          $ref: '#/components/schemas/ServiceDefinitionV1Org'
        schema-version:
          $ref: '#/components/schemas/ServiceDefinitionV1Version'
        tags:
          description: A set of custom tags.
          example:
          - my:tag
          - service:tag
          items:
            type: string
          type: array
      required:
      - schema-version
      - info
      type: object
    HTTPToken:
      description: The definition of `HTTPToken` object.
      properties:
        name:
          description: The `HTTPToken` `name`.
          example: MyToken
          pattern: ^[A-Za-z][A-Za-z\\d]*$
          type: string
        type:
          $ref: '#/components/schemas/TokenType'
        value:
          description: The `HTTPToken` `value`.
          example: Some Token Value
          type: string
      required:
      - name
      - value
      - type
      type: object
    ObservabilityPipelineSumoLogicDestinationEncoding:
      description: The output encoding format.
      enum:
      - json
      - raw_message
      - logfmt
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
      - LOGFMT
    LogsArchiveCreateRequestAttributes:
      description: The attributes associated with the archive.
      properties:
        destination:
          $ref: '#/components/schemas/LogsArchiveCreateRequestDestination'
        include_tags:
          default: false
          description: 'To store the tags in the archive, set the value "true".

            If it is set to "false", the tags will be deleted when the logs are sent to the archive.'
          example: false
          type: boolean
        name:
          description: The archive name.
          example: Nginx Archive
          type: string
        query:
          description: The archive query/filter. Logs matching this query are included in the archive.
          example: source:nginx
          type: string
        rehydration_max_scan_size_in_gb:
          description: Maximum scan size for rehydration from this archive.
          example: 100
          format: int64
          nullable: true
          type: integer
        rehydration_tags:
          description: An array of tags to add to rehydrated logs from an archive.
          example:
          - team:intake
          - team:app
          items:
            description: A given tag in the `<KEY>:<VALUE>` format.
            type: string
          type: array
      required:
      - name
      - query
      - destination
      type: object
    AWSAccountConfigID:
      description: 'Unique Datadog ID of the AWS Account Integration Config.

        To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations)

        endpoint and query by AWS Account ID.'
      example: 00000000-abcd-0001-0000-000000000000
      type: string
    FastlyServiceAttributes:
      description: Attributes object for Fastly service requests.
      properties:
        tags:
          description: A list of tags for the Fastly service.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      type: object
    ExternalUserGroupMeta:
      description: Metadata associated with a group.
      properties:
        created:
          description: The date and time the group was created.
          example: '2024-10-17T12:53:35.793Z'
          format: date-time
          type: string
        lastModified:
          description: The date and time the group was last changed.
          example: '2024-10-19T12:53:35.793Z'
          format: date-time
          type: string
        location:
          description: URL identifying the resource.
          example: https://app.datadoghq.com/api/scim/v2/Groups/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          type: string
        resourceType:
          description: Type of resource.
          example: Group
          type: string
      type: object
    CustomDestinationForwardDestinationHttp:
      description: The HTTP destination.
      properties:
        auth:
          $ref: '#/components/schemas/CustomDestinationHttpDestinationAuth'
        endpoint:
          description: 'The destination for which logs will be forwarded to.

            Must have HTTPS scheme and forwarding back to Datadog is not allowed.'
          example: https://example.com
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationForwardDestinationHttpType'
      required:
      - type
      - endpoint
      - auth
      type: object
    DataTransformType:
      default: dataTransform
      description: The data transform type.
      enum:
      - dataTransform
      example: dataTransform
      type: string
      x-enum-varnames:
      - DATATRANSFORM
    ExternalUserGroupMembersItems:
      description: The definition of a member belonging to a group.
      properties:
        $ref:
          description: The URI corresponding to a SCIM resource that is a member of this group.
          example: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          type: string
        display:
          description: A human-readable name for the group member.
          example: John Doe
          type: string
        type:
          description: A label indicating the type of resource.
          example: User
          type: string
        value:
          description: The identifier of the member of this group.
          example: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6
          type: string
      type: object
    IPAllowlistEntryAttributes:
      description: Attributes of the IP allowlist entry.
      properties:
        cidr_block:
          description: The CIDR block describing the IP range of the entry.
          type: string
          example: abc-123-def
        created_at:
          description: Creation time of the entry.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified_at:
          description: Time of last entry modification.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        note:
          description: A note describing the IP allowlist entry.
          type: string
          example: example_value
      type: object
    IncidentAttachmentRelatedObject:
      description: The object related to an incident attachment.
      enum:
      - users
      type: string
      x-enum-varnames:
      - USERS
    RumMetricUpdateRequest:
      description: The new rum-based metric body.
      properties:
        data:
          $ref: '#/components/schemas/RumMetricUpdateData'
      required:
      - data
      type: object
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    CustomDestinationResponseHttpDestinationAuthCustomHeader:
      description: Custom header access authentication.
      properties:
        header_name:
          description: The header name of the authentication.
          example: CUSTOM-HEADER-NAME
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeaderType'
      required:
      - type
      - header_name
      type: object
    DowntimeScheduleResponse:
      description: 'The schedule that defines when the monitor starts, stops, and recurs. There are two types of schedules:

        one-time and recurring. Recurring schedules may have up to five RRULE-based recurrences. If no schedules are

        provided, the downtime will begin immediately and never end.'
      oneOf:
      - $ref: '#/components/schemas/DowntimeScheduleRecurrencesResponse'
      - $ref: '#/components/schemas/DowntimeScheduleOneTimeResponse'
    MetricCustomAggregations:
      description: Deprecated. You no longer need to configure specific time and space aggregations for Metrics Without Limits.
      example:
      - space: sum
        time: sum
      - space: sum
        time: count
      items:
        $ref: '#/components/schemas/MetricCustomAggregation'
      type: array
    RetentionFilterUpdateData:
      description: The body of the retention filter to be updated.
      properties:
        attributes:
          $ref: '#/components/schemas/RetentionFilterUpdateAttributes'
        id:
          description: The ID of the retention filter.
          example: retention-filter-id
          type: string
        type:
          $ref: '#/components/schemas/ApmRetentionFilterType'
      required:
      - id
      - attributes
      - type
      type: object
    SecurityMonitoringStandardRuleQuery:
      description: Query for matching rule.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metric:
          deprecated: true
          description: '(Deprecated) The target field to aggregate over when using the sum or max

            aggregations. `metrics` field should be used instead.'
          type: string
          example: example_value
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    DowntimeIncludedMonitorType:
      default: monitors
      description: Monitor resource type.
      enum:
      - monitors
      example: monitors
      type: string
      x-enum-varnames:
      - MONITORS
    ScheduleMemberRelationshipsUser:
      description: Wraps the user data reference for a schedule member.
      properties:
        data:
          $ref: '#/components/schemas/ScheduleMemberRelationshipsUserData'
      required:
      - data
      type: object
    OrgConfigWrite:
      description: An Org Config write operation.
      properties:
        attributes:
          $ref: '#/components/schemas/OrgConfigWriteAttributes'
        type:
          $ref: '#/components/schemas/OrgConfigType'
      required:
      - type
      - attributes
      type: object
    MetricCustomSpaceAggregation:
      description: A space aggregation for use in query.
      enum:
      - avg
      - max
      - min
      - sum
      example: sum
      type: string
      x-enum-varnames:
      - AVG
      - MAX
      - MIN
      - SUM
    EntityV3MetadataContactsItems:
      additionalProperties: false
      description: The definition of Entity V3 Metadata Contacts Items object.
      properties:
        contact:
          description: Contact value.
          example: https://slack/
          type: string
        name:
          description: Contact name.
          minLength: 2
          type: string
          example: Example Monitor
        type:
          description: Contact type.
          example: slack
          type: string
      required:
      - type
      - contact
      type: object
    DowntimeDisplayTimezone:
      default: UTC
      description: 'The timezone in which to display the downtime''s start and end times in Datadog applications. This is not used

        as an offset for scheduling.'
      example: America/New_York
      nullable: true
      type: string
    ObservabilityPipelineElasticsearchDestination:
      description: The `elasticsearch` destination writes logs to an Elasticsearch cluster.
      properties:
        api_version:
          $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationApiVersion'
        bulk_index:
          description: The index to write logs to in Elasticsearch.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: elasticsearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    SpansMetricUpdateRequest:
      description: The new span-based metric body.
      properties:
        data:
          $ref: '#/components/schemas/SpansMetricUpdateData'
      required:
      - data
      type: object
    AwsCURConfigPatchRequest:
      description: AWS CUR config Patch Request.
      properties:
        data:
          $ref: '#/components/schemas/AwsCURConfigPatchData'
      required:
      - data
      type: object
    IncidentIntegrationMetadataPatchData:
      description: Incident integration metadata data for a patch request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes'
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - type
      - attributes
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType:
      description: Indicates a custom regular expression is used for matching.
      enum:
      - custom
      example: custom
      type: string
      x-enum-varnames:
      - CUSTOM
    ObservabilityPipelineGcpAuth:
      description: 'GCP credentials used to authenticate with Google Cloud Storage.

        '
      properties:
        credentials_file:
          description: Path to the GCP service account key file.
          example: /var/secrets/gcp-credentials.json
          type: string
      required:
      - credentials_file
      type: object
    ObservabilityPipelineRenameFieldsProcessor:
      description: The `rename_fields` processor changes field names.
      properties:
        fields:
          description: A list of rename rules specifying which fields to rename in the event, what to rename them to, and whether to preserve the original fields.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorField'
          type: array
        id:
          description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rename-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    IncidentTeamIncludedItems:
      description: An object related to an incident team which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    ObservabilityPipelineThrottleProcessorType:
      default: throttle
      description: The processor type. The value should always be `throttle`.
      enum:
      - throttle
      example: throttle
      type: string
      x-enum-varnames:
      - THROTTLE
    ApplicationSecurityWafExclusionFilterUpdateData:
      description: Object for updating a single WAF exclusion filter.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateAttributes'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType'
      required:
      - attributes
      - type
      type: object
    CustomDestinationUpdateRequestDefinition:
      description: The definition of a custom destination.
      properties:
        attributes:
          $ref: '#/components/schemas/CustomDestinationUpdateRequestAttributes'
        id:
          description: The custom destination ID.
          example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationType'
      required:
      - type
      - id
      type: object
    ObservabilityPipelineSampleProcessorType:
      default: sample
      description: The processor type. The value should always be `sample`.
      enum:
      - sample
      example: sample
      type: string
      x-enum-varnames:
      - SAMPLE
    ObservabilityPipelineEnrichmentTableProcessorType:
      default: enrichment_table
      description: The processor type. The value should always be `enrichment_table`.
      enum:
      - enrichment_table
      example: enrichment_table
      type: string
      x-enum-varnames:
      - ENRICHMENT_TABLE
    RelationshipArray:
      description: Relationships.
      items:
        $ref: '#/components/schemas/RelationshipItem'
      type: array
    SecurityMonitoringRuleSeverity:
      description: Severity of the Security Signal.
      enum:
      - info
      - low
      - medium
      - high
      - critical
      example: critical
      type: string
      x-enum-varnames:
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    ObservabilityPipelineSyslogSourceMode:
      description: Protocol used by the syslog source to receive messages.
      enum:
      - tcp
      - udp
      example: tcp
      type: string
      x-enum-varnames:
      - TCP
      - UDP
    SensitiveDataScannerGroupUpdate:
      description: Data related to the update of a group.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerGroupAttributes'
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerGroupRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    OpsgenieServiceResponseAttributes:
      description: The attributes from an Opsgenie service response.
      properties:
        custom_url:
          description: The custom URL for a custom region.
          example: null
          nullable: true
          type: string
        name:
          description: The name for the Opsgenie service.
          example: fake-opsgenie-service-name
          maxLength: 100
          type: string
        region:
          $ref: '#/components/schemas/OpsgenieServiceRegionType'
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineSplunkHecDestinationType:
      default: splunk_hec
      description: The destination type. Always `splunk_hec`.
      enum:
      - splunk_hec
      example: splunk_hec
      type: string
      x-enum-varnames:
      - SPLUNK_HEC
    SensitiveDataScannerGroupData:
      description: A scanning group data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerGroup'
      type: object
    RumRetentionFilterQuery:
      description: The query string for a RUM retention filter.
      example: '@session.has_replay:true'
      type: string
    SensitiveDataScannerGroupAttributes:
      description: Attributes of the Sensitive Data Scanner group.
      properties:
        description:
          description: Description of the group.
          type: string
          example: example_value
        filter:
          $ref: '#/components/schemas/SensitiveDataScannerFilter'
        is_enabled:
          description: Whether or not the group is enabled.
          type: boolean
          example: true
        name:
          description: Name of the group.
          type: string
          example: Example Monitor
        product_list:
          description: List of products the scanning group applies.
          items:
            $ref: '#/components/schemas/SensitiveDataScannerProduct'
          type: array
      type: object
    IncidentAttachmentUpdateData:
      description: A single incident attachment.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentAttachmentUpdateAttributes'
        id:
          description: A unique identifier that represents the incident attachment.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - type
      type: object
    ServiceDefinitionV2Dot1Email:
      description: Service owner's email.
      properties:
        contact:
          description: Contact value.
          example: contact@datadoghq.com
          type: string
        name:
          description: Contact email.
          example: Team Email
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1EmailType'
      required:
      - type
      - contact
      type: object
    SensitiveDataScannerRuleRelationships:
      description: Relationships of a scanning rule.
      properties:
        group:
          $ref: '#/components/schemas/SensitiveDataScannerGroupData'
        standard_pattern:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternData'
      type: object
    IncidentTeamUpdateRequest:
      description: Update request with an incident team payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTeamUpdateData'
      required:
      - data
      type: object
    RUMApplicationUpdateAttributes:
      description: RUM application update attributes.
      properties:
        name:
          description: Name of the RUM application.
          example: updated_name_for_my_existing_rum_application
          type: string
        type:
          description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`.
          example: browser
          type: string
      type: object
    RoleResponseRelationships:
      description: Relationships of the role object returned by the API.
      properties:
        permissions:
          $ref: '#/components/schemas/RelationshipToPermissions'
      type: object
    EntityV3ServiceSpec:
      additionalProperties: false
      description: The definition of Entity V3 Service Spec object.
      properties:
        componentOf:
          description: A list of components the service is a part of
          items:
            type: string
          type: array
        dependsOn:
          description: A list of components the service depends on.
          items:
            type: string
          type: array
        languages:
          description: The service's programming language.
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the component.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the component.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of service.
          type: string
          example: metric alert
      type: object
    IncidentTypePatchData:
      description: Incident type data for a patch request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTypeUpdateAttributes'
        id:
          description: The incident type's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentTypeType'
      required:
      - id
      - type
      - attributes
      type: object
    InputSchemaParameters:
      description: The definition of `InputSchemaParameters` object.
      properties:
        defaultValue:
          description: The `InputSchemaParameters` `defaultValue`.
          example: example_value
        description:
          description: The `InputSchemaParameters` `description`.
          type: string
          example: example_value
        label:
          description: The `InputSchemaParameters` `label`.
          type: string
          example: example_value
        name:
          description: The `InputSchemaParameters` `name`.
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/InputSchemaParametersType'
      required:
      - name
      - type
      type: object
    ObservabilityPipelineAddEnvVarsProcessorVariable:
      description: Defines a mapping between an environment variable and a log field.
      properties:
        field:
          description: The target field in the log event.
          example: log.environment.region
          type: string
        name:
          description: The name of the environment variable to read.
          example: AWS_REGION
          type: string
      required:
      - field
      - name
      type: object
    EntityV3Queue:
      additionalProperties: false
      description: Schema for queue entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3QueueDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3QueueKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3QueueSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    SecurityFilterExclusionFilterResponse:
      description: A single exclusion filter.
      properties:
        name:
          description: The exclusion filter name.
          example: Exclude staging
          type: string
        query:
          description: The exclusion filter query.
          example: source:staging
          type: string
      type: object
    IncidentRespondersType:
      description: The incident responders type.
      enum:
      - incident_responders
      example: incident_responders
      type: string
      x-enum-varnames:
      - INCIDENT_RESPONDERS
    ApmRetentionFilterType:
      default: apm_retention_filter
      description: The type of the resource.
      enum:
      - apm_retention_filter
      example: apm_retention_filter
      type: string
      x-enum-varnames:
      - apm_retention_filter
    RelationshipToIncidentAttachmentData:
      description: The attachment relationship data.
      properties:
        id:
          description: A unique identifier that represents the attachment.
          example: 00000000-0000-abcd-1000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineQuotaProcessorType:
      default: quota
      description: The processor type. The value should always be `quota`.
      enum:
      - quota
      example: quota
      type: string
      x-enum-varnames:
      - QUOTA
    ApplicationSecurityWafExclusionFilterType:
      default: exclusion_filter
      description: Type of the resource. The value should always be `exclusion_filter`.
      enum:
      - exclusion_filter
      example: exclusion_filter
      type: string
      x-enum-varnames:
      - EXCLUSION_FILTER
    JiraIssue:
      description: Jira issue attached to case
      nullable: true
      properties:
        result:
          $ref: '#/components/schemas/JiraIssueResult'
        status:
          $ref: '#/components/schemas/Case3rdPartyTicketStatus'
      readOnly: true
      type: object
    ConfluentResourceRequestAttributes:
      description: Attributes object for updating a Confluent resource.
      properties:
        enable_custom_metrics:
          default: false
          description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags.
          example: false
          type: boolean
        resource_type:
          description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, or `schema_registry`.
          example: kafka
          type: string
        tags:
          description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - resource_type
      type: object
    ObservabilityPipelineReduceProcessorType:
      default: reduce
      description: The processor type. The value should always be `reduce`.
      enum:
      - reduce
      example: reduce
      type: string
      x-enum-varnames:
      - REDUCE
    DowntimeRelationshipsMonitor:
      description: The monitor identified by the downtime.
      properties:
        data:
          $ref: '#/components/schemas/DowntimeRelationshipsMonitorData'
      type: object
    EscalationPolicyDataAttributes:
      description: Defines the main attributes of an escalation policy, such as its name and behavior on policy end.
      properties:
        name:
          description: Specifies the name of the escalation policy.
          example: On-Call Escalation Policy
          type: string
        resolve_page_on_policy_end:
          description: Indicates whether the page is automatically resolved when the policy ends.
          type: boolean
          example: true
        retries:
          description: Specifies how many times the escalation sequence is retried if there is no response.
          format: int64
          type: integer
          example: 42
      required:
      - name
      type: object
    ObservabilityPipelineTls:
      description: Configuration for enabling TLS encryption between the pipeline component and external services.
      properties:
        ca_file:
          description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate.
          type: string
          example: example_value
        crt_file:
          description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
          example: /path/to/cert.crt
          type: string
        key_file:
          description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
          type: string
          example: example_value
      required:
      - crt_file
      type: object
    EntityRelationships:
      description: Entity relationships.
      properties:
        incidents:
          $ref: '#/components/schemas/EntityToIncidents'
        oncall:
          $ref: '#/components/schemas/EntityToOncalls'
        rawSchema:
          $ref: '#/components/schemas/EntityToRawSchema'
        relatedEntities:
          $ref: '#/components/schemas/EntityToRelatedEntities'
        schema:
          $ref: '#/components/schemas/EntityToSchema'
      type: object
    ServiceDefinitionV2Dot1Contact:
      description: Service owner's contacts information.
      oneOf:
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot1Email'
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot1Slack'
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot1MSTeams'
    LogsArchiveDestinationS3:
      description: The S3 archive destination.
      properties:
        bucket:
          description: The bucket where the archive will be stored.
          example: bucket-name
          type: string
        encryption:
          $ref: '#/components/schemas/LogsArchiveEncryptionS3'
        integration:
          $ref: '#/components/schemas/LogsArchiveIntegrationS3'
        path:
          description: The archive path.
          type: string
          example: example_value
        storage_class:
          $ref: '#/components/schemas/LogsArchiveStorageClassS3Type'
        type:
          $ref: '#/components/schemas/LogsArchiveDestinationS3Type'
      required:
      - bucket
      - integration
      - type
      type: object
    ObservabilityPipelineEnrichmentTableFileSchemaItemsType:
      description: Declares allowed data types for enrichment table columns.
      enum:
      - string
      - boolean
      - integer
      - float
      - date
      - timestamp
      example: string
      type: string
      x-enum-varnames:
      - STRING
      - BOOLEAN
      - INTEGER
      - FLOAT
      - DATE
      - TIMESTAMP
    ObservabilityPipelineRenameFieldsProcessorField:
      description: Defines how to rename a field in log events.
      properties:
        destination:
          description: The field name to assign the renamed value to.
          example: destination_field
          type: string
        preserve_source:
          description: Indicates whether the original field, that is received from the source, should be kept (`true`) or removed (`false`) after renaming.
          example: false
          type: boolean
        source:
          description: The original field name in the log event that should be renamed.
          example: source_field
          type: string
      required:
      - source
      - destination
      - preserve_source
      type: object
    MetricTagConfiguration:
      description: Object for a single metric tag configuration.
      example:
        attributes:
          aggregations:
          - space: avg
            time: avg
          created_at: '2020-03-25T09:48:37.463835Z'
          metric_type: gauge
          modified_at: '2020-04-25T09:48:37.463835Z'
          tags:
          - app
          - datacenter
        id: http.request.latency
        type: manage_tags
      properties:
        attributes:
          $ref: '#/components/schemas/MetricTagConfigurationAttributes'
        id:
          $ref: '#/components/schemas/MetricName'
        type:
          $ref: '#/components/schemas/MetricTagConfigurationType'
      type: object
    IncidentServiceResponse:
      description: Response with an incident service payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentServiceResponseData'
        included:
          description: Included objects from relationships.
          items:
            $ref: '#/components/schemas/IncidentServiceIncludedItems'
          readOnly: true
          type: array
      required:
      - data
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningMethod:
      default: duration
      description: The learning method used to determine when signals should be generated for values that weren't learned.
      enum:
      - duration
      - threshold
      type: string
      x-enum-varnames:
      - DURATION
      - THRESHOLD
    SensitiveDataScannerGroupRelationships:
      description: Relationships of the group.
      properties:
        configuration:
          $ref: '#/components/schemas/SensitiveDataScannerConfigurationData'
        rules:
          $ref: '#/components/schemas/SensitiveDataScannerRuleData'
      type: object
    ServiceDefinitionV2Dot2Link:
      description: Service's external links.
      properties:
        name:
          description: Link name.
          example: Runbook
          type: string
        provider:
          description: Link provider.
          example: Github
          type: string
        type:
          description: 'Link type. Datadog recognizes the following types: `runbook`, `doc`, `repo`, `dashboard`, and `other`.'
          example: runbook
          type: string
        url:
          description: Link URL.
          example: https://my-runbook
          type: string
      required:
      - name
      - type
      - url
      type: object
    GCPSTSServiceAccountResponse:
      description: The account creation response.
      properties:
        data:
          $ref: '#/components/schemas/GCPSTSServiceAccount'
      type: object
    LogsArchiveOrder:
      description: A ordered list of archive IDs.
      properties:
        data:
          $ref: '#/components/schemas/LogsArchiveOrderDefinition'
      type: object
    ObservabilityPipelineOcsfMapperProcessor:
      description: The `ocsf_mapper` processor transforms logs into the OCSF schema using a predefined mapping configuration.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline.
          example: ocsf-mapper-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this processor.
          example:
          - filter-processor
          items:
            type: string
          type: array
        mappings:
          description: A list of mapping rules to convert events to the OCSF format.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMapping'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - mappings
      type: object
    UpdateCustomFrameworkRequest:
      description: Request object to update a custom framework.
      properties:
        data:
          $ref: '#/components/schemas/CustomFrameworkData'
      required:
      - data
      type: object
    UpdateResourceEvaluationFiltersResponseData:
      description: The definition of `UpdateResourceFilterResponseData` object.
      properties:
        attributes:
          $ref: '#/components/schemas/ResourceFilterAttributes'
        id:
          description: The `data` `id`.
          example: csm_resource_filter
          type: string
        type:
          $ref: '#/components/schemas/ResourceFilterRequestType'
      required:
      - attributes
      - type
      type: object
    RumRetentionFilterData:
      description: The RUM retention filter.
      properties:
        attributes:
          $ref: '#/components/schemas/RumRetentionFilterAttributes'
        id:
          $ref: '#/components/schemas/RumRetentionFilterID'
        type:
          $ref: '#/components/schemas/RumRetentionFilterType'
      type: object
    MicrosoftTeamsUpdateWorkflowsWebhookHandleRequestData:
      description: Workflows Webhook handle data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleAttributes'
        type:
          $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType'
      required:
      - type
      - attributes
      type: object
    RelationshipToPermissions:
      description: Relationship to multiple permissions objects.
      properties:
        data:
          description: Relationships to permission objects.
          items:
            $ref: '#/components/schemas/RelationshipToPermissionData'
          type: array
      type: object
      x-merge-override:
        required: false
    IncidentTeamRelationships:
      description: The incident team's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    ObservabilityPipelineGoogleCloudStorageDestinationStorageClass:
      description: Storage class used for objects stored in GCS.
      enum:
      - STANDARD
      - NEARLINE
      - COLDLINE
      - ARCHIVE
      example: STANDARD
      type: string
      x-enum-varnames:
      - STANDARD
      - NEARLINE
      - COLDLINE
      - ARCHIVE
    PowerpackRelationships:
      description: Powerpack relationship object.
      properties:
        author:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    ObservabilityPipelineRemoveFieldsProcessorType:
      default: remove_fields
      description: The processor type. The value should always be `remove_fields`.
      enum:
      - remove_fields
      example: remove_fields
      type: string
      x-enum-varnames:
      - REMOVE_FIELDS
    SensitiveDataScannerConfiguration:
      description: A Sensitive Data Scanner configuration.
      properties:
        id:
          description: ID of the configuration.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerConfigurationType'
      type: object
    AwsCURConfigType:
      default: aws_cur_config
      description: Type of AWS CUR config.
      enum:
      - aws_cur_config
      example: aws_cur_config
      type: string
      x-enum-varnames:
      - AWS_CUR_CONFIG
    CasePriority:
      default: NOT_DEFINED
      description: Case priority
      enum:
      - NOT_DEFINED
      - P1
      - P2
      - P3
      - P4
      - P5
      example: NOT_DEFINED
      type: string
      x-enum-varnames:
      - NOT_DEFINED
      - P1
      - P2
      - P3
      - P4
      - P5
    LogsArchiveDestination:
      description: An archive's destination.
      nullable: true
      oneOf:
      - $ref: '#/components/schemas/LogsArchiveDestinationAzure'
      - $ref: '#/components/schemas/LogsArchiveDestinationGCS'
      - $ref: '#/components/schemas/LogsArchiveDestinationS3'
      type: object
    ActionQueryShowToastOnError:
      description: Whether to display a toast to the user when the query returns an error.
      oneOf:
      - type: boolean
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean.
        example: ${true}
        type: string
    FastlyAccountUpdateRequestAttributes:
      description: Attributes object for updating a Fastly account.
      properties:
        api_key:
          description: The API key of the Fastly account.
          example: ABCDEFG123
          type: string
        name:
          description: The name of the Fastly account.
          type: string
          example: Example Monitor
      type: object
      x-merge-override:
        required: false
    EntityV3DatadogEventItem:
      additionalProperties: false
      description: Events association item.
      properties:
        name:
          description: The name of the query.
          type: string
          example: Example Monitor
        query:
          description: The query to run.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    IncidentTodoPatchData:
      description: Incident todo data for a patch request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTodoAttributes'
        type:
          $ref: '#/components/schemas/IncidentTodoType'
      required:
      - type
      - attributes
      type: object
    IncidentAttachmentRelationships:
      description: The incident attachment's relationships.
      properties:
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    ActionConnectionAttributesUpdate:
      description: The definition of `ActionConnectionAttributesUpdate` object.
      properties:
        integration:
          $ref: '#/components/schemas/ActionConnectionIntegrationUpdate'
        name:
          description: Name of the connection
          example: My AWS Connection
          type: string
      type: object
    RumMetricType:
      default: rum_metrics
      description: The type of the resource. The value should always be rum_metrics.
      enum:
      - rum_metrics
      example: rum_metrics
      type: string
      x-enum-varnames:
      - RUM_METRICS
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    RestrictionPolicyAttributes:
      description: Restriction policy attributes.
      example:
        bindings: []
      properties:
        bindings:
          description: An array of bindings.
          items:
            $ref: '#/components/schemas/RestrictionPolicyBinding'
          type: array
      required:
      - bindings
      type: object
    CaseAttributes:
      description: Case attributes
      properties:
        archived_at:
          description: Timestamp of when the case was archived
          format: date-time
          nullable: true
          readOnly: true
          type: string
          example: example_value
        closed_at:
          description: Timestamp of when the case was closed
          format: date-time
          nullable: true
          readOnly: true
          type: string
          example: example_value
        created_at:
          description: Timestamp of when the case was created
          format: date-time
          readOnly: true
          type: string
          example: example_value
        description:
          description: Description
          type: string
          example: example_value
        jira_issue:
          $ref: '#/components/schemas/JiraIssue'
        key:
          description: Key
          example: CASEM-4523
          type: string
        modified_at:
          description: Timestamp of when the case was last modified
          format: date-time
          nullable: true
          readOnly: true
          type: string
          example: example_value
        priority:
          $ref: '#/components/schemas/CasePriority'
        service_now_ticket:
          $ref: '#/components/schemas/ServiceNowTicket'
        status:
          $ref: '#/components/schemas/CaseStatus'
        title:
          description: Title
          example: Memory leak investigation on API
          type: string
        type:
          $ref: '#/components/schemas/CaseType'
      type: object
    RumMetricComputeAggregationType:
      description: The type of aggregation to use.
      enum:
      - count
      - distribution
      example: distribution
      type: string
      x-enum-varnames:
      - COUNT
      - DISTRIBUTION
    EntityV3ServiceDatadog:
      additionalProperties: false
      description: Datadog product integrations for the service entity.
      properties:
        codeLocations:
          $ref: '#/components/schemas/EntityV3DatadogCodeLocations'
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
        pipelines:
          $ref: '#/components/schemas/EntityV3DatadogPipelines'
      type: object
    RelationshipToIncidentResponderData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentRespondersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ApplicationSecurityWafCustomRuleConditionOperator:
      description: Operator to use for the WAF Condition.
      enum:
      - match_regex
      - '!match_regex'
      - phrase_match
      - '!phrase_match'
      - is_xss
      - is_sqli
      - exact_match
      - '!exact_match'
      - ip_match
      - '!ip_match'
      - capture_data
      example: match_regex
      type: string
      x-enum-varnames:
      - MATCH_REGEX
      - NOT_MATCH_REGEX
      - PHRASE_MATCH
      - NOT_PHRASE_MATCH
      - IS_XSS
      - IS_SQLI
      - EXACT_MATCH
      - NOT_EXACT_MATCH
      - IP_MATCH
      - NOT_IP_MATCH
      - CAPTURE_DATA
    OrgConfigWriteRequest:
      description: A request to update an Org Config.
      properties:
        data:
          $ref: '#/components/schemas/OrgConfigWrite'
      required:
      - data
      type: object
    ScheduleMemberRelationships:
      description: Defines relationships for a schedule member, primarily referencing a single user.
      properties:
        user:
          $ref: '#/components/schemas/ScheduleMemberRelationshipsUser'
      type: object
    UpsertCatalogEntityRequest:
      description: Create or update entity request.
      oneOf:
      - $ref: '#/components/schemas/EntityV3'
      - $ref: '#/components/schemas/EntityRaw'
    IPAllowlistUpdateRequest:
      description: Update the IP allowlist.
      properties:
        data:
          $ref: '#/components/schemas/IPAllowlistData'
      required:
      - data
      type: object
    EscalationPolicyUpdateRequest:
      description: Represents a request to update an existing escalation policy, including the updated policy data.
      example:
        data:
          attributes:
            name: Escalation Policy 1
            resolve_page_on_policy_end: false
            retries: 2
            steps:
            - assignment: default
              escalate_after_seconds: 3600
              id: 00000000-aba1-0000-0000-000000000000
              targets:
              - id: 00000000-aba1-0000-0000-000000000000
                type: users
              - id: 00000000-aba2-0000-0000-000000000000
                type: schedules
          id: a3000000-0000-0000-0000-000000000000
          relationships:
            teams:
              data:
              - id: 00000000-da3a-0000-0000-000000000000
                type: teams
          type: policies
      properties:
        data:
          $ref: '#/components/schemas/EscalationPolicyUpdateRequestData'
      required:
      - data
      type: object
    CustomDestinationResponseHttpDestinationAuth:
      description: Authentication method of the HTTP requests.
      oneOf:
      - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasic'
      - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeader'
    FastlyService:
      description: The schema representation of a Fastly service.
      properties:
        id:
          description: The ID of the Fastly service
          example: 6abc7de6893AbcDe9fghIj
          type: string
        tags:
          description: A list of tags for the Fastly service.
          example:
          - myTag
          - myTag2:myValue
          items:
            type: string
          type: array
      required:
      - id
      type: object
    OrgConfigType:
      description: Data type of an Org Config.
      enum:
      - org_configs
      example: org_configs
      type: string
      x-enum-varnames:
      - ORG_CONFIGS
    ServiceDefinitionMeta:
      description: Metadata about a service definition.
      properties:
        github-html-url:
          description: GitHub HTML URL.
          type: string
          example: https://app.datadoghq.com
        ingested-schema-version:
          description: Ingestion schema version.
          type: string
          example: example_value
        ingestion-source:
          description: Ingestion source of the service definition.
          type: string
          example: example_value
        last-modified-time:
          description: Last modified time of the service definition.
          type: string
          example: '2026-04-17T12:00:00Z'
        origin:
          description: User defined origin of the service definition.
          type: string
          example: example_value
        origin-detail:
          description: User defined origin's detail of the service definition.
          type: string
          example: example_value
        warnings:
          description: A list of schema validation warnings.
          items:
            $ref: '#/components/schemas/ServiceDefinitionMetaWarnings'
          type: array
      type: object
    SecurityMonitoringUser:
      description: A user.
      properties:
        handle:
          description: The handle of the user.
          example: john.doe@datadoghq.com
          type: string
        name:
          description: The name of the user.
          example: John Doe
          nullable: true
          type: string
      type: object
    EscalationPolicyDataRelationshipsStepsDataItemsType:
      default: steps
      description: Indicates that the resource is of type `steps`.
      enum:
      - steps
      example: steps
      type: string
      x-enum-varnames:
      - STEPS
    OktaAccount:
      description: Schema for an Okta account.
      properties:
        attributes:
          $ref: '#/components/schemas/OktaAccountAttributes'
        id:
          description: The ID of the Okta account, a UUID hash of the account name.
          example: f749daaf-682e-4208-a38d-c9b43162c609
          type: string
        type:
          $ref: '#/components/schemas/OktaAccountType'
      required:
      - attributes
      - type
      type: object
    MetricTagConfigurationAttributes:
      description: Object containing the definition of a metric tag configuration attributes.
      properties:
        aggregations:
          $ref: '#/components/schemas/MetricCustomAggregations'
        created_at:
          description: Timestamp when the tag configuration was created.
          example: '2020-03-25T09:48:37.463835Z'
          format: date-time
          type: string
        exclude_tags_mode:
          description: 'When set to true, the configuration will exclude the configured tags and include any other submitted tags.

            When set to false, the configuration will include the configured tags and exclude any other submitted tags.

            Defaults to false. Requires `tags` property.'
          type: boolean
          example: true
        include_percentiles:
          description: 'Toggle to include or exclude percentile aggregations for distribution metrics.

            Only present when the `metric_type` is `distribution`.'
          example: true
          type: boolean
        metric_type:
          $ref: '#/components/schemas/MetricTagConfigurationMetricTypes'
        modified_at:
          description: Timestamp when the tag configuration was last modified.
          example: '2020-03-25T09:48:37.463835Z'
          format: date-time
          type: string
        tags:
          description: List of tag keys on which to group.
          example:
          - app
          - datacenter
          items:
            description: Tag keys to group by.
            type: string
          type: array
      type: object
    UserTeamType:
      default: team_memberships
      description: Team membership type
      enum:
      - team_memberships
      example: team_memberships
      type: string
      x-enum-varnames:
      - TEAM_MEMBERSHIPS
    ScheduleTarget:
      description: Represents a schedule target for an escalation policy step, including its ID and resource type.
      properties:
        id:
          description: Specifies the unique identifier of the schedule resource.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/ScheduleTargetType'
      required:
      - type
      - id
      type: object
    LogsArchiveOrderDefinition:
      description: The definition of an archive order.
      properties:
        attributes:
          $ref: '#/components/schemas/LogsArchiveOrderAttributes'
        type:
          $ref: '#/components/schemas/LogsArchiveOrderDefinitionType'
      required:
      - type
      - attributes
      type: object
    SensitiveDataScannerProduct:
      default: logs
      description: Datadog product onto which Sensitive Data Scanner can be activated.
      enum:
      - logs
      - rum
      - events
      - apm
      type: string
      x-enum-varnames:
      - LOGS
      - RUM
      - EVENTS
      - APM
    ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget:
      description: Excludes specific fields from processing.
      enum:
      - exclude
      example: exclude
      type: string
      x-enum-varnames:
      - EXCLUDE
    ServiceDefinitionV2Email:
      description: Service owner's email.
      properties:
        contact:
          description: Contact value.
          example: contact@datadoghq.com
          type: string
        name:
          description: Contact email.
          example: Team Email
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2EmailType'
      required:
      - type
      - contact
      type: object
    IncidentFieldAttributesSingleValue:
      description: A field with a single value selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesSingleValueType'
        value:
          description: The single value selected for this field.
          example: SEV-1
          nullable: true
          type: string
      type: object
    ServiceDefinitionCreateResponse:
      description: Create service definitions response.
      properties:
        data:
          description: Create service definitions response payload.
          items:
            $ref: '#/components/schemas/ServiceDefinitionData'
          type: array
      type: object
    EscalationTargets:
      description: A list of escalation targets for a step
      properties:
        data:
          description: The `EscalationTargets` `data`.
          items:
            $ref: '#/components/schemas/EscalationTarget'
          type: array
      type: object
    DowntimeMonitorIncludedAttributes:
      description: Attributes of the monitor identified by the downtime.
      properties:
        name:
          description: The name of the monitor identified by the downtime.
          example: A monitor name
          type: string
      type: object
    RoleUpdateData:
      description: Data related to the update of a role.
      properties:
        attributes:
          $ref: '#/components/schemas/RoleUpdateAttributes'
        id:
          description: The unique identifier of the role.
          example: 00000000-0000-1111-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/RoleRelationships'
        type:
          $ref: '#/components/schemas/RolesType'
      required:
      - attributes
      - type
      - id
      type: object
      x-merge-override:
        required: false
    WorkflowDataRelationships:
      description: The definition of `WorkflowDataRelationships` object.
      properties:
        creator:
          $ref: '#/components/schemas/WorkflowUserRelationship'
        owner:
          $ref: '#/components/schemas/WorkflowUserRelationship'
      readOnly: true
      type: object
    ApplicationSecurityWafCustomRuleMetadata:
      description: Metadata associated with the WAF Custom Rule.
      properties:
        added_at:
          description: The date and time the WAF custom rule was created.
          example: '2021-01-01T00:00:00Z'
          format: date-time
          type: string
        added_by:
          description: The handle of the user who created the WAF custom rule.
          example: john.doe@datadoghq.com
          type: string
        added_by_name:
          description: The name of the user who created the WAF custom rule.
          example: John Doe
          type: string
        modified_at:
          description: The date and time the WAF custom rule was last updated.
          example: '2021-01-01T00:00:00Z'
          format: date-time
          type: string
        modified_by:
          description: The handle of the user who last updated the WAF custom rule.
          example: john.doe@datadoghq.com
          type: string
        modified_by_name:
          description: The name of the user who last updated the WAF custom rule.
          example: John Doe
          type: string
      readOnly: true
      type: object
    CloudflareAccountUpdateRequest:
      description: Payload schema when updating a Cloudflare account.
      properties:
        data:
          $ref: '#/components/schemas/CloudflareAccountUpdateRequestData'
      required:
      - data
      type: object
    UserResponseRelationships:
      description: Relationships of the user object returned by the API.
      properties:
        org:
          $ref: '#/components/schemas/RelationshipToOrganization'
        other_orgs:
          $ref: '#/components/schemas/RelationshipToOrganizations'
        other_users:
          $ref: '#/components/schemas/RelationshipToUsers'
        roles:
          $ref: '#/components/schemas/RelationshipToRoles'
      type: object
      x-merge-override:
        properties: false
    ConfluentResourceResponse:
      description: Response schema when interacting with a Confluent resource.
      properties:
        data:
          $ref: '#/components/schemas/ConfluentResourceResponseData'
      type: object
    UserTeamResponse:
      description: Team membership response
      properties:
        data:
          $ref: '#/components/schemas/UserTeam'
        included:
          description: Resources related to the team memberships
          items:
            $ref: '#/components/schemas/UserTeamIncluded'
          type: array
      type: object
    RumMetricGroupBy:
      description: A group by rule.
      properties:
        path:
          description: The path to the value the rum-based metric will be aggregated over.
          example: '@browser.name'
          type: string
        tag_name:
          description: Eventual name of the tag that gets created. By default, `path` is used as the tag name.
          example: browser_name
          type: string
      required:
      - path
      type: object
    MonitorNotificationRuleFilterTags:
      additionalProperties: false
      description: Filter monitors by tags. Monitors must match all tags.
      properties:
        tags:
          description: A list of monitor tags.
          example:
          - team:product
          - host:abc
          items:
            maxLength: 255
            type: string
          maxItems: 20
          minItems: 1
          type: array
          uniqueItems: true
      required:
      - tags
      type: object
    RetentionFilterUpdateAttributes:
      description: The object describing the configuration of the retention filter to create/update.
      properties:
        enabled:
          description: Enable/Disable the retention filter.
          example: true
          type: boolean
        filter:
          $ref: '#/components/schemas/SpansFilterCreate'
        filter_type:
          $ref: '#/components/schemas/RetentionFilterAllType'
        name:
          description: The name of the retention filter.
          example: my retention filter
          type: string
        rate:
          description: 'Sample rate to apply to spans going through this retention filter.

            A value of 1.0 keeps all spans matching the query.'
          example: 1
          format: double
          type: number
        trace_rate:
          description: 'Sample rate to apply to traces containing spans going through this retention filter.

            A value of 1.0 keeps all traces with spans matching the query.'
          example: 1
          format: double
          type: number
      required:
      - name
      - filter
      - enabled
      - filter_type
      - rate
      type: object
    Parameter:
      description: The definition of `Parameter` object.
      properties:
        name:
          description: The `Parameter` `name`.
          example: ''
          type: string
        value:
          description: The `Parameter` `value`.
          example: example_value
      required:
      - name
      - value
      type: object
    TeamPermissionSettingUpdate:
      description: Team permission setting update
      properties:
        attributes:
          $ref: '#/components/schemas/TeamPermissionSettingUpdateAttributes'
        type:
          $ref: '#/components/schemas/TeamPermissionSettingType'
      required:
      - type
      type: object
    ApplicationSecurityWafCustomRuleUpdateRequest:
      description: Request object that includes the Custom Rule to update.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateData'
      required:
      - data
      type: object
    ActionConnectionData:
      description: Data related to the connection.
      properties:
        attributes:
          $ref: '#/components/schemas/ActionConnectionAttributes'
        id:
          description: The connection identifier
          readOnly: true
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/ActionConnectionDataType'
      required:
      - type
      - attributes
      type: object
    ObservabilityPipelineSyslogNgDestination:
      description: The `syslog_ng` destination forwards logs to an external `syslog-ng` server over TCP or UDP using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component.
          example: syslog-ng-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        keepalive:
          description: Optional socket keepalive duration in milliseconds.
          example: 60000
          format: int64
          minimum: 0
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    ObservabilityPipelineEnrichmentTableFileKeyItems:
      description: Defines how to map log fields to enrichment table columns during lookups.
      properties:
        column:
          description: The `items` `column`.
          example: user_id
          type: string
        comparison:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison'
        field:
          description: The `items` `field`.
          example: log.user.id
          type: string
      required:
      - column
      - comparison
      - field
      type: object
    EntityV3APISpecInterface:
      additionalProperties: false
      description: The API definition.
      oneOf:
      - $ref: '#/components/schemas/EntityV3APISpecInterfaceFileRef'
      - $ref: '#/components/schemas/EntityV3APISpecInterfaceDefinition'
    CustomDestinationResponseHttpDestinationAuthBasicType:
      default: basic
      description: Type of the basic access authentication.
      enum:
      - basic
      example: basic
      type: string
      x-enum-varnames:
      - BASIC
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    ObservabilityPipelineDatadogAgentSource:
      description: The `datadog_agent` source collects logs from the Datadog Agent.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: datadog-agent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSourceType'
      required:
      - id
      - type
      type: object
    RelationshipToUsers:
      description: Relationship to users.
      properties:
        data:
          description: Relationships to user objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToUserData'
          type: array
      required:
      - data
      type: object
    ActionConnectionIntegration:
      description: The definition of `ActionConnectionIntegration` object.
      oneOf:
      - $ref: '#/components/schemas/AWSIntegration'
      - $ref: '#/components/schemas/HTTPIntegration'
    ChangeEventTriggerWrapper:
      description: Schema for a Change Event-based trigger.
      properties:
        changeEventTrigger:
          description: Trigger a workflow from a Change Event.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - changeEventTrigger
      type: object
    CloudWorkloadSecurityAgentRuleResponse:
      description: Response object that includes an Agent rule
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData'
      type: object
    AppMeta:
      description: Metadata of an app.
      properties:
        created_at:
          description: Timestamp of when the app was created.
          format: date-time
          type: string
          example: example_value
        deleted_at:
          description: Timestamp of when the app was deleted.
          format: date-time
          type: string
          example: example_value
        org_id:
          description: The Datadog organization ID that owns the app.
          format: int64
          type: integer
          example: 42
        updated_at:
          description: Timestamp of when the app was last updated.
          format: date-time
          type: string
          example: '2026-04-17T12:00:00Z'
        updated_since_deployment:
          description: Whether the app was updated since it was last published. Published apps are pinned to a specific version and do not automatically update when the app is updated.
          type: boolean
          example: true
        user_id:
          description: The ID of the user who created the app.
          format: int64
          type: integer
          example: 42
        user_name:
          description: The name (or email address) of the user who created the app.
          type: string
          example: Example Monitor
        user_uuid:
          description: The UUID of the user who created the app.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        version:
          description: The version number of the app. This starts at 1 and increments with each update.
          format: int64
          type: integer
          example: 42
      type: object
    PermissionsType:
      default: permissions
      description: Permissions resource type.
      enum:
      - permissions
      example: permissions
      type: string
      x-enum-varnames:
      - PERMISSIONS
    RelationshipItem:
      description: Relationship entry.
      properties:
        id:
          description: Associated data ID.
          type: string
          example: abc-123-def
        type:
          description: Relationship type.
          type: string
          example: metric alert
      type: object
    ComponentGridType:
      default: grid
      description: The grid component type.
      enum:
      - grid
      example: grid
      type: string
      x-enum-varnames:
      - GRID
    CustomFrameworkRequirement:
      description: Framework Requirement.
      properties:
        controls:
          description: Requirement Controls.
          items:
            $ref: '#/components/schemas/CustomFrameworkControl'
          type: array
        name:
          description: Requirement Name.
          example: criteria
          type: string
      required:
      - name
      - controls
      type: object
    MetricTagConfigurationResponse:
      description: Response object which includes a single metric's tag configuration.
      properties:
        data:
          $ref: '#/components/schemas/MetricTagConfiguration'
      readOnly: true
      type: object
    IncidentTypePatchRequest:
      description: Patch request for an incident type.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTypePatchData'
      required:
      - data
      type: object
    IncidentServiceResponseData:
      description: Incident Service data from responses.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentServiceResponseAttributes'
        id:
          description: The incident service's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentServiceRelationships'
        type:
          $ref: '#/components/schemas/IncidentServiceType'
      required:
      - id
      - type
      type: object
    DowntimeUpdateRequestAttributes:
      description: Attributes of the downtime to update.
      properties:
        display_timezone:
          $ref: '#/components/schemas/DowntimeDisplayTimezone'
        message:
          $ref: '#/components/schemas/DowntimeMessage'
        monitor_identifier:
          $ref: '#/components/schemas/DowntimeMonitorIdentifier'
        mute_first_recovery_notification:
          $ref: '#/components/schemas/DowntimeMuteFirstRecoveryNotification'
        notify_end_states:
          $ref: '#/components/schemas/DowntimeNotifyEndStates'
        notify_end_types:
          $ref: '#/components/schemas/DowntimeNotifyEndTypes'
        schedule:
          $ref: '#/components/schemas/DowntimeScheduleUpdateRequest'
        scope:
          $ref: '#/components/schemas/DowntimeScope'
      type: object
    StateVariable:
      description: A variable, which can be set and read by other components in the app.
      properties:
        id:
          description: The ID of the state variable.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        name:
          description: A unique identifier for this state variable. This name is also used to access the variable's value throughout the app.
          example: ordersToSubmit
          type: string
        properties:
          $ref: '#/components/schemas/StateVariableProperties'
        type:
          $ref: '#/components/schemas/StateVariableType'
      required:
      - id
      - name
      - type
      - properties
      type: object
    SpansMetricComputeIncludePercentiles:
      description: 'Toggle to include or exclude percentile aggregations for distribution metrics.

        Only present when the `aggregation_type` is `distribution`.'
      example: false
      type: boolean
    AWSLogsConfig:
      description: AWS Logs Collection config.
      properties:
        lambda_forwarder:
          $ref: '#/components/schemas/AWSLambdaForwarderConfig'
      type: object
    CloudWorkloadSecurityAgentPolicyUpdateRequest:
      description: Request object that includes the Agent policy with the attributes to update
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateData'
      required:
      - data
      type: object
    LogsMetricResponseAttributes:
      description: The object describing a Datadog log-based metric.
      properties:
        compute:
          $ref: '#/components/schemas/LogsMetricResponseCompute'
        filter:
          $ref: '#/components/schemas/LogsMetricResponseFilter'
        group_by:
          description: The rules for the group by.
          items:
            $ref: '#/components/schemas/LogsMetricResponseGroupBy'
          type: array
      type: object
    IncidentPostmortemType:
      default: incident_postmortems
      description: Incident postmortem resource type.
      enum:
      - incident_postmortems
      example: incident_postmortems
      type: string
      x-enum-varnames:
      - INCIDENT_POSTMORTEMS
    SensitiveDataScannerIncludedKeywordConfiguration:
      description: 'Object defining a set of keywords and a number of characters that help reduce noise.

        You can provide a list of keywords you would like to check within a defined proximity of the matching pattern.

        If any of the keywords are found within the proximity check, the match is kept.

        If none are found, the match is discarded.'
      properties:
        character_count:
          description: 'The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined.

            `character_count` should be greater than the maximum length of a keyword defined for a rule.'
          example: 30
          format: int64
          maximum: 50
          minimum: 1
          type: integer
        keywords:
          description: 'Keyword list that will be checked during scanning in order to validate a match.

            The number of keywords in the list must be less than or equal to 30.'
          example:
          - credit card
          - cc
          items:
            type: string
          type: array
        use_recommended_keywords:
          description: 'Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied

            to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied.'
          type: boolean
          example: true
      required:
      - keywords
      - character_count
      type: object
    IPAllowlistType:
      default: ip_allowlist
      description: IP allowlist type.
      enum:
      - ip_allowlist
      example: ip_allowlist
      type: string
      x-enum-varnames:
      - IP_ALLOWLIST
    EscalationTarget:
      description: Represents an escalation target, which can be a team, user, or schedule.
      oneOf:
      - $ref: '#/components/schemas/TeamTarget'
      - $ref: '#/components/schemas/UserTarget'
      - $ref: '#/components/schemas/ScheduleTarget'
    ApplicationSecurityWafCustomRuleCondition:
      description: One condition of the WAF Custom Rule.
      properties:
        operator:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator'
        parameters:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters'
      required:
      - operator
      - parameters
      type: object
    ObservabilityPipelineOpenSearchDestinationType:
      default: opensearch
      description: The destination type. The value should always be `opensearch`.
      enum:
      - opensearch
      example: opensearch
      type: string
      x-enum-varnames:
      - OPENSEARCH
    CustomConnection:
      description: A custom connection used by an app.
      properties:
        attributes:
          $ref: '#/components/schemas/CustomConnectionAttributes'
        id:
          description: The ID of the custom connection.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        type:
          $ref: '#/components/schemas/CustomConnectionType'
      type: object
    AppDefinitionType:
      default: appDefinitions
      description: The app definition type.
      enum:
      - appDefinitions
      example: appDefinitions
      type: string
      x-enum-varnames:
      - APPDEFINITIONS
    IncidentTodoAssignee:
      description: A todo assignee.
      example: '@test.user@test.com'
      oneOf:
      - $ref: '#/components/schemas/IncidentTodoAssigneeHandle'
      - $ref: '#/components/schemas/IncidentTodoAnonymousAssignee'
    SensitiveDataScannerMetaVersionOnly:
      description: Meta payload containing information about the API.
      properties:
        version:
          description: Version of the API (optional).
          example: 0
          format: int64
          minimum: 0
          type: integer
      type: object
    ResourceFilterRequestType:
      description: Constant string to identify the request type.
      enum:
      - csm_resource_filter
      example: csm_resource_filter
      type: string
      x-enum-varnames:
      - CSM_RESOURCE_FILTER
    IncidentTodoAssigneeArray:
      description: Array of todo assignees.
      example:
      - '@test.user@test.com'
      items:
        $ref: '#/components/schemas/IncidentTodoAssignee'
      type: array
    MicrosoftTeamsWorkflowsWebhookHandleResponseData:
      description: Workflows Webhook handle data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookResponseAttributes'
        id:
          description: The ID of the Workflows webhook handle.
          example: 596da4af-0563-4097-90ff-07230c3f9db3
          maxLength: 100
          minLength: 1
          type: string
        type:
          $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType'
      type: object
    CustomDestinationResponseHttpDestinationAuthBasic:
      description: Basic access authentication.
      properties:
        type:
          $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasicType'
      required:
      - type
      type: object
    DatabaseMonitoringTriggerWrapper:
      description: Schema for a Database Monitoring-based trigger.
      properties:
        databaseMonitoringTrigger:
          description: Trigger a workflow from Database Monitoring.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - databaseMonitoringTrigger
      type: object
    RUMApplicationResponse:
      description: RUM application response.
      properties:
        data:
          $ref: '#/components/schemas/RUMApplication'
      type: object
    ActionQueryMockedOutputsEnabled:
      description: Whether to enable the mocked outputs for testing.
      oneOf:
      - type: boolean
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean.
        example: ${true}
        type: string
    ObservabilityPipelineSumoLogicDestination:
      description: The `sumo_logic` destination forwards logs to Sumo Logic.
      properties:
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationEncoding'
        header_custom_fields:
          description: A list of custom headers to include in the request to Sumo Logic.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem'
          type: array
        header_host_name:
          description: Optional override for the host name header.
          example: host-123
          type: string
        header_source_category:
          description: Optional override for the source category header.
          example: source-category
          type: string
        header_source_name:
          description: Optional override for the source name header.
          example: source-name
          type: string
        id:
          description: The unique identifier for this component.
          example: sumo-logic-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    EntityResponseIncludedSchemaAttributes:
      description: Included schema.
      properties:
        schema:
          $ref: '#/components/schemas/EntityV3'
      type: object
    MonitorNotificationRuleResponse:
      description: A monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleData'
        included:
          description: Array of objects related to the monitor notification rule that the user requested.
          items:
            $ref: '#/components/schemas/MonitorNotificationRuleResponseIncludedItem'
          type: array
      type: object
    SensitiveDataScannerConfigurationType:
      default: sensitive_data_scanner_configuration
      description: Sensitive Data Scanner configuration type.
      enum:
      - sensitive_data_scanner_configuration
      example: sensitive_data_scanner_configuration
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_CONFIGURATIONS
    CaseRelationships:
      description: Resources related to a case
      properties:
        assignee:
          $ref: '#/components/schemas/NullableUserRelationship'
        created_by:
          $ref: '#/components/schemas/NullableUserRelationship'
        modified_by:
          $ref: '#/components/schemas/NullableUserRelationship'
        project:
          $ref: '#/components/schemas/ProjectRelationship'
      type: object
    Schedule:
      description: Top-level container for a schedule object, including both the `data` payload and any related `included` resources (such as teams, layers, or members).
      example:
        data:
          attributes:
            name: On-Call Schedule
            time_zone: America/New_York
          id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          relationships:
            layers:
              data:
              - id: 00000000-0000-0000-0000-000000000001
                type: layers
            teams:
              data:
              - id: 00000000-da3a-0000-0000-000000000000
                type: teams
          type: schedules
        included:
        - attributes:
            avatar: ''
            description: Team 1 description
            handle: team1
            name: Team 1
          id: 00000000-da3a-0000-0000-000000000000
          type: teams
        - attributes:
            effective_date: '2025-02-03T05:00:00Z'
            end_date: '2025-12-31T00:00:00Z'
            interval:
              days: 1
            name: Layer 1
            restrictions:
            - end_day: friday
              end_time: '17:00:00'
              start_day: monday
              start_time: 09:00:00
            rotation_start: '2025-02-01T00:00:00Z'
          id: 00000000-0000-0000-0000-000000000001
          relationships:
            members:
              data:
              - id: 00000000-0000-0000-0000-000000000002
                type: members
          type: layers
        - id: 00000000-0000-0000-0000-000000000002
          relationships:
            user:
              data:
                id: 00000000-aba1-0000-0000-000000000000
                type: users
          type: members
        - attributes:
            email: foo@bar.com
            name: User 1
          id: 00000000-aba1-0000-0000-000000000000
          type: users
      properties:
        data:
          $ref: '#/components/schemas/ScheduleData'
        included:
          description: Any additional resources related to this schedule, such as teams and layers.
          items:
            $ref: '#/components/schemas/ScheduleDataIncludedItem'
          type: array
      type: object
    EntityToIncidents:
      description: Entity to incidents relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipArray'
      type: object
    LogsArchiveCreateRequestDestination:
      description: An archive's destination.
      oneOf:
      - $ref: '#/components/schemas/LogsArchiveDestinationAzure'
      - $ref: '#/components/schemas/LogsArchiveDestinationGCS'
      - $ref: '#/components/schemas/LogsArchiveDestinationS3'
    IncidentUpdateRequest:
      description: Update request for an incident.
      properties:
        data:
          $ref: '#/components/schemas/IncidentUpdateData'
      required:
      - data
      type: object
    ObservabilityPipelineRemoveFieldsProcessor:
      description: The `remove_fields` processor deletes specified fields from logs.
      properties:
        fields:
          description: A list of field names to be removed from each log event.
          example:
          - field1
          - field2
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: remove-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: The `PipelineRemoveFieldsProcessor` `inputs`.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    DowntimeScheduleRecurrenceDuration:
      description: The length of the downtime. Must begin with an integer and end with one of 'm', 'h', d', or 'w'.
      example: 123d
      type: string
    AnnotationMarkdownTextAnnotation:
      description: The definition of `AnnotationMarkdownTextAnnotation` object.
      properties:
        text:
          description: The `markdownTextAnnotation` `text`.
          type: string
          example: example_value
      type: object
    OutputSchemaParameters:
      description: The definition of `OutputSchemaParameters` object.
      properties:
        defaultValue:
          description: The `OutputSchemaParameters` `defaultValue`.
          example: example_value
        description:
          description: The `OutputSchemaParameters` `description`.
          type: string
          example: example_value
        label:
          description: The `OutputSchemaParameters` `label`.
          type: string
          example: example_value
        name:
          description: The `OutputSchemaParameters` `name`.
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/OutputSchemaParametersType'
        value:
          description: The `OutputSchemaParameters` `value`.
          example: example_value
      required:
      - name
      - type
      type: object
    RumMetricResponseGroupBy:
      description: A group by rule.
      properties:
        path:
          description: The path to the value the rum-based metric will be aggregated over.
          example: '@http.status_code'
          type: string
        tag_name:
          description: Eventual name of the tag that gets created. By default, `path` is used as the tag name.
          example: status_code
          type: string
      type: object
    EntityV3QueueSpec:
      additionalProperties: false
      description: The definition of Entity V3 Queue Spec object.
      properties:
        componentOf:
          description: A list of components the queue is a part of
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the queue.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the queue.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of queue.
          type: string
          example: metric alert
      type: object
    DowntimeUpdateRequestData:
      description: Object to update a downtime.
      properties:
        attributes:
          $ref: '#/components/schemas/DowntimeUpdateRequestAttributes'
        id:
          description: ID of this downtime.
          example: 00000000-0000-1234-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/DowntimeResourceType'
      required:
      - id
      - type
      - attributes
      type: object
    UserTeamAttributes:
      description: Team membership attributes
      properties:
        provisioned_by:
          description: 'The mechanism responsible for provisioning the team relationship.

            Possible values: null for added by a user, "service_account" if added by a service account, and "saml_mapping" if provisioned via SAML mapping.'
          nullable: true
          readOnly: true
          type: string
          example: example_value
        provisioned_by_id:
          description: UUID of the User or Service Account who provisioned this team membership, or null if provisioned via SAML mapping.
          nullable: true
          readOnly: true
          type: string
          example: abc-123-def
        role:
          $ref: '#/components/schemas/UserTeamRole'
      type: object
    ServiceDefinitionV1Pagerduty:
      description: PagerDuty service URL for the service.
      example: https://my-org.pagerduty.com/service-directory/PMyService
      type: string
    UserTeam:
      description: A user's relationship with a team
      properties:
        attributes:
          $ref: '#/components/schemas/UserTeamAttributes'
        id:
          description: The ID of a user's relationship with a team
          example: TeamMembership-aeadc05e-98a8-11ec-ac2c-da7ad0900001-38835
          type: string
        relationships:
          $ref: '#/components/schemas/UserTeamRelationships'
        type:
          $ref: '#/components/schemas/UserTeamType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineAddFieldsProcessor:
      description: The `add_fields` processor adds static key-value fields to logs.
      properties:
        fields:
          description: A list of static fields (key-value pairs) that is added to each log event processed by this component.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineFieldValue'
          type: array
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: add-fields-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessorType'
      required:
      - id
      - type
      - include
      - fields
      - inputs
      type: object
    ObservabilityPipelineLogstashSource:
      description: The `logstash` source ingests logs from a Logstash forwarder.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: logstash-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineLogstashSourceType'
      required:
      - id
      - type
      type: object
    CloudWorkloadSecurityAgentPolicyResponse:
      description: Response object that includes an Agent policy
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyData'
      type: object
    CustomFrameworkControl:
      description: Framework Control.
      properties:
        name:
          description: Control Name.
          example: A1.2
          type: string
        rules_id:
          description: Rule IDs.
          example:
          - '["def-000-abc"]'
          items:
            type: string
          type: array
      required:
      - name
      - rules_id
      type: object
    ScheduleUserType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    UpdateOpenAPIResponseAttributes:
      description: Attributes for `UpdateOpenAPI`.
      properties:
        failed_endpoints:
          description: List of endpoints which couldn't be parsed.
          items:
            $ref: '#/components/schemas/OpenAPIEndpoint'
          type: array
      type: object
    ObservabilityPipelineAddFieldsProcessorType:
      default: add_fields
      description: The processor type. The value should always be `add_fields`.
      enum:
      - add_fields
      example: add_fields
      type: string
      x-enum-varnames:
      - ADD_FIELDS
    AppRelationship:
      description: The app's publication relationship and custom connections.
      properties:
        connections:
          description: Array of custom connections used by the app.
          items:
            $ref: '#/components/schemas/CustomConnection'
          type: array
        deployment:
          $ref: '#/components/schemas/DeploymentRelationship'
      type: object
    ServiceDefinitionV2Doc:
      description: Service documents.
      properties:
        name:
          description: Document name.
          example: Architecture
          type: string
        provider:
          description: Document provider.
          example: google drive
          type: string
        url:
          description: Document URL.
          example: https://gdrive/mydoc
          type: string
      required:
      - name
      - url
      type: object
    MicrosoftTeamsTenantBasedHandleResponseData:
      description: Tenant-based handle data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleAttributes'
        id:
          description: The ID of the tenant-based handle.
          example: 596da4af-0563-4097-90ff-07230c3f9db3
          maxLength: 100
          minLength: 1
          type: string
        type:
          $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleType'
      type: object
      x-merge-override:
        required: false
    FastlyAccountUpdateRequestData:
      description: Data object for updating a Fastly account.
      properties:
        attributes:
          $ref: '#/components/schemas/FastlyAccountUpdateRequestAttributes'
        type:
          $ref: '#/components/schemas/FastlyAccountType'
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineEnrichmentTableProcessor:
      description: The `enrichment_table` processor enriches logs using a static CSV file or GeoIP database.
      properties:
        file:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFile'
        geoip:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableGeoIp'
        id:
          description: The unique identifier for this processor.
          example: enrichment-table-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: source:my-source
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - add-fields-processor
          items:
            type: string
          type: array
        target:
          description: Path where enrichment results should be stored in the log.
          example: enriched.geoip
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - target
      type: object
    SpansMetricID:
      description: The name of the span-based metric.
      example: my.metric
      type: string
    IncidentTeamUpdateData:
      description: Incident Team data for an update request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTeamUpdateAttributes'
        id:
          description: The incident team's ID.
          example: 00000000-7ea3-0000-0001-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTeamRelationships'
        type:
          $ref: '#/components/schemas/IncidentTeamType'
      required:
      - type
      type: object
    ServiceDefinitionV2Repo:
      description: Service code repositories.
      properties:
        name:
          description: Repository name.
          example: Source Code
          type: string
        provider:
          description: Repository provider.
          example: GitHub
          type: string
        url:
          description: Repository URL.
          example: https://github.com/DataDog/schema
          type: string
      required:
      - name
      - url
      type: object
    ServiceDefinitionV1Resource:
      description: Service's external links.
      properties:
        name:
          description: Link name.
          example: Runbook
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV1ResourceType'
        url:
          description: Link URL.
          example: https://my-runbook
          type: string
      required:
      - name
      - type
      - url
      type: object
    IncidentImpactsType:
      description: The incident impacts type.
      enum:
      - incident_impacts
      example: incident_impacts
      type: string
      x-enum-varnames:
      - INCIDENT_IMPACTS
    RelationshipToRoleData:
      description: Relationship to role object.
      properties:
        id:
          description: The unique identifier of the role.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        type:
          $ref: '#/components/schemas/RolesType'
      type: object
      x-merge-override:
        required: false
    UpdateOpenAPIResponseData:
      description: Data envelope for `UpdateOpenAPIResponse`.
      properties:
        attributes:
          $ref: '#/components/schemas/UpdateOpenAPIResponseAttributes'
        id:
          $ref: '#/components/schemas/ApiID'
      type: object
    RumRetentionFilterUpdateData:
      description: The new RUM retention filter properties to update.
      properties:
        attributes:
          $ref: '#/components/schemas/RumRetentionFilterUpdateAttributes'
        id:
          $ref: '#/components/schemas/RumRetentionFilterID'
        type:
          $ref: '#/components/schemas/RumRetentionFilterType'
      required:
      - id
      - type
      - attributes
      type: object
    EntityV3SystemDatadog:
      additionalProperties: false
      description: Datadog product integrations for the service entity.
      properties:
        events:
          $ref: '#/components/schemas/EntityV3DatadogEvents'
        logs:
          $ref: '#/components/schemas/EntityV3DatadogLogs'
        performanceData:
          $ref: '#/components/schemas/EntityV3DatadogPerformance'
        pipelines:
          $ref: '#/components/schemas/EntityV3DatadogPipelines'
      type: object
    ConfluentAccountType:
      default: confluent-cloud-accounts
      description: The JSON:API type for this API. Should always be `confluent-cloud-accounts`.
      enum:
      - confluent-cloud-accounts
      example: confluent-cloud-accounts
      type: string
      x-enum-varnames:
      - CONFLUENT_CLOUD_ACCOUNTS
    ExternalUser:
      description: Definition of a user.
      properties:
        active:
          description: A Boolean value indicating the User's administrative status.
          type: boolean
          example: true
        emails:
          description: Email addresses for the user.
          items:
            $ref: '#/components/schemas/ExternalUserEmailType'
          type: array
        id:
          description: The identifier of the resource. Not required when creating a user.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/ExternalUserMeta'
        name:
          $ref: '#/components/schemas/ExternalUserNameType'
        schemas:
          description: User JSON Schemas.
          example:
          - urn:ietf:params:scim:schemas:core:2.0:User
          items:
            type: string
          type: array
        title:
          description: The user's title.
          type: string
          example: Example Monitor
        userName:
          description: Unique identifier for the User.
          type: string
          example: Example Monitor
      type: object
    FastlyAccountType:
      default: fastly-accounts
      description: The JSON:API type for this API. Should always be `fastly-accounts`.
      enum:
      - fastly-accounts
      example: fastly-accounts
      type: string
      x-enum-varnames:
      - FASTLY_ACCOUNTS
    ObservabilityPipelineAmazonOpenSearchDestinationAuth:
      description: 'Authentication settings for the Amazon OpenSearch destination.

        The `strategy` field determines whether basic or AWS-based authentication is used.

        '
      properties:
        assume_role:
          description: The ARN of the role to assume (used with `aws` strategy).
          type: string
          example: example_value
        aws_region:
          description: AWS region
          type: string
          example: example_value
        external_id:
          description: External ID for the assumed role (used with `aws` strategy).
          type: string
          example: abc-123-def
        session_name:
          description: Session name for the assumed role (used with `aws` strategy).
          type: string
          example: Example Monitor
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy'
      required:
      - strategy
      type: object
    SpansMetricResponseData:
      description: The span-based metric properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SpansMetricResponseAttributes'
        id:
          $ref: '#/components/schemas/SpansMetricID'
        type:
          $ref: '#/components/schemas/SpansMetricType'
      type: object
    AWSTracesConfig:
      description: AWS Traces Collection config.
      properties:
        xray_services:
          $ref: '#/components/schemas/XRayServicesList'
      type: object
    CloudWorkloadSecurityAgentPolicyUpdaterAttributes:
      description: The attributes of the user who last updated the policy
      properties:
        handle:
          description: The handle of the user
          example: datadog.user@example.com
          type: string
        name:
          description: The name of the user
          example: Datadog User
          nullable: true
          type: string
      type: object
    AWSRegionsIncludeOnly:
      description: Include only these regions.
      properties:
        include_only:
          description: Include only these regions.
          example:
          - us-east-1
          items:
            example: us-east-1
            type: string
          type: array
      required:
      - include_only
      type: object
    SensitiveDataScannerRuleData:
      description: Rules included in the group.
      properties:
        data:
          description: Rules included in the group. The order is important.
          items:
            $ref: '#/components/schemas/SensitiveDataScannerRule'
          type: array
      type: object
    UrlParamUpdate:
      description: The definition of `UrlParamUpdate` object.
      properties:
        deleted:
          description: Should the header be deleted.
          type: boolean
          example: true
        name:
          $ref: '#/components/schemas/TokenName'
          example: MyUrlParameter
        value:
          description: The `UrlParamUpdate` `value`.
          example: Some Url Parameter value
          type: string
      required:
      - name
      type: object
    CustomDestinationResponseForwardDestinationSplunk:
      description: The Splunk HTTP Event Collector (HEC) destination.
      properties:
        endpoint:
          description: 'The destination for which logs will be forwarded to.

            Must have HTTPS scheme and forwarding back to Datadog is not allowed.'
          example: https://example.com
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType'
      required:
      - type
      - endpoint
      type: object
    TokenName:
      description: Name for tokens.
      example: MyTokenName
      pattern: ^[A-Za-z][A-Za-z\\d]*$
      type: string
    SensitiveDataScannerGroupType:
      default: sensitive_data_scanner_group
      description: Sensitive Data Scanner group type.
      enum:
      - sensitive_data_scanner_group
      example: sensitive_data_scanner_group
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_GROUP
    PowerpackResponse:
      description: Response object which includes a single powerpack configuration.
      properties:
        data:
          $ref: '#/components/schemas/PowerpackData'
        included:
          description: Array of objects related to the users.
          items:
            $ref: '#/components/schemas/User'
          type: array
      readOnly: true
      type: object
    OktaAccountUpdateRequestAttributes:
      description: Attributes object for updating an Okta account.
      properties:
        api_key:
          description: The API key of the Okta account.
          type: string
          writeOnly: true
          example: example_value
        auth_method:
          description: The authorization method for an Okta account.
          example: oauth
          type: string
        client_id:
          description: The Client ID of an Okta app integration.
          type: string
          example: abc-123-def
        client_secret:
          description: The client secret of an Okta app integration.
          type: string
          writeOnly: true
          example: example_value
        domain:
          description: The domain associated with an Okta account.
          example: https://dev-test.okta.com/
          type: string
      required:
      - auth_method
      - domain
      type: object
    ServiceDefinitionRaw:
      description: Service Definition in raw JSON/YAML representation.
      example: '---

        schema-version: v2

        dd-service: my-service

        '
      type: string
    DowntimeResponse:
      description: 'Downtiming gives you greater control over monitor notifications by

        allowing you to globally exclude scopes from alerting.

        Downtime settings, which can be scheduled with start and end times,

        prevent all alerting related to specified Datadog tags.'
      properties:
        data:
          $ref: '#/components/schemas/DowntimeResponseData'
        included:
          description: Array of objects related to the downtime that the user requested.
          items:
            $ref: '#/components/schemas/DowntimeResponseIncludedItem'
          type: array
      type: object
    RelationshipToUserTeamUserData:
      description: A user's relationship with a team
      properties:
        id:
          description: The ID of the user associated with the team
          example: b8626d7e-cedd-11eb-abf5-da7ad0900001
          type: string
        type:
          $ref: '#/components/schemas/UserTeamUserType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ServiceDefinitionV2Dot1Opsgenie:
      description: Opsgenie integration for the service.
      properties:
        region:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1OpsgenieRegion'
        service-url:
          description: Opsgenie service url.
          example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000
          type: string
      required:
      - service-url
      type: object
    ActionQueryProperties:
      description: The properties of the action query.
      properties:
        condition:
          $ref: '#/components/schemas/ActionQueryCondition'
        debounceInMs:
          $ref: '#/components/schemas/ActionQueryDebounceInMs'
        mockedOutputs:
          $ref: '#/components/schemas/ActionQueryMockedOutputs'
        onlyTriggerManually:
          $ref: '#/components/schemas/ActionQueryOnlyTriggerManually'
        outputs:
          description: The post-query transformation function, which is a JavaScript function that changes the query's `.outputs` property after the query's execution.
          example: ${((outputs) => {return outputs.body.data})(self.rawOutputs)}
          type: string
        pollingIntervalInMs:
          $ref: '#/components/schemas/ActionQueryPollingIntervalInMs'
        requiresConfirmation:
          $ref: '#/components/schemas/ActionQueryRequiresConfirmation'
        showToastOnError:
          $ref: '#/components/schemas/ActionQueryShowToastOnError'
        spec:
          $ref: '#/components/schemas/ActionQuerySpec'
      required:
      - spec
      type: object
    AppDeploymentType:
      default: deployment
      description: The deployment type.
      enum:
      - deployment
      example: deployment
      type: string
      x-enum-varnames:
      - DEPLOYMENT
    SecurityMonitoringStandardRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        defaultTags:
          description: Default Tags for default rules (included in tags)
          example:
          - security:attacks
          items:
            description: Default Tag.
            type: string
          type: array
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        updatedAt:
          description: The date the rule was last updated, in milliseconds.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    EscalationPolicyUpdateRequestData:
      description: Represents the data for updating an existing escalation policy, including its ID, attributes, relationships, and resource type.
      properties:
        attributes:
          $ref: '#/components/schemas/EscalationPolicyUpdateRequestDataAttributes'
        id:
          description: Specifies the unique identifier of the escalation policy being updated.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/EscalationPolicyUpdateRequestDataRelationships'
        type:
          $ref: '#/components/schemas/EscalationPolicyUpdateRequestDataType'
      required:
      - type
      - id
      - attributes
      type: object
    PowerpackInnerWidgets:
      description: Powerpack group widget definition of individual widgets.
      properties:
        definition:
          additionalProperties: {}
          description: Information about widget.
          example:
            definition:
              content: example
              type: note
          type: object
        layout:
          $ref: '#/components/schemas/PowerpackInnerWidgetLayout'
      required:
      - definition
      type: object
    SecurityMonitoringRuleDetectionMethod:
      description: The detection method.
      enum:
      - threshold
      - new_value
      - anomaly_detection
      - impossible_travel
      - hardcoded
      - third_party
      - anomaly_threshold
      type: string
      x-enum-varnames:
      - THRESHOLD
      - NEW_VALUE
      - ANOMALY_DETECTION
      - IMPOSSIBLE_TRAVEL
      - HARDCODED
      - THIRD_PARTY
      - ANOMALY_THRESHOLD
    SecurityMonitoringSuppressionUpdateData:
      description: The new suppression properties; partial updates are supported.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateAttributes'
        type:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionType'
      required:
      - type
      - attributes
      type: object
    ObservabilityPipelineQuotaProcessor:
      description: The Quota Processor measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert.
      properties:
        drop_events:
          description: If set to `true`, logs that matched the quota filter and sent after the quota has been met are dropped; only logs that did not match the filter query continue through the pipeline.
          example: false
          type: boolean
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: quota-processor
          type: string
        ignore_when_missing_partitions:
          description: If `true`, the processor skips quota checks when partition fields are missing from the logs.
          type: boolean
          example: true
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        limit:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit'
        name:
          description: Name of the quota.
          example: MyQuota
          type: string
        overflow_action:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction'
        overrides:
          description: A list of alternate quota rules that apply to specific sets of events, identified by matching field values. Each override can define a custom limit.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverride'
          type: array
        partition_fields:
          description: A list of fields used to segment log traffic for quota enforcement. Quotas are tracked independently by unique combinations of these field values.
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorType'
      required:
      - id
      - type
      - include
      - name
      - drop_events
      - limit
      - inputs
      type: object
    UserTargetType:
      default: users
      description: Indicates that the resource is of type `users`.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    Annotation:
      description: A list of annotations used in the workflow. These are like sticky notes for your workflow!
      properties:
        display:
          $ref: '#/components/schemas/AnnotationDisplay'
        id:
          description: The `Annotation` `id`.
          example: ''
          type: string
        markdownTextAnnotation:
          $ref: '#/components/schemas/AnnotationMarkdownTextAnnotation'
      required:
      - id
      - display
      - markdownTextAnnotation
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    RUMApplicationUpdateType:
      default: rum_application_update
      description: RUM application update type.
      enum:
      - rum_application_update
      example: rum_application_update
      type: string
      x-enum-varnames:
      - RUM_APPLICATION_UPDATE
    RelationshipToIncidentPostmortemData:
      description: The postmortem relationship data.
      example:
        id: 00000000-0000-abcd-2000-000000000000
        type: incident_postmortems
      properties:
        id:
          description: A unique identifier that represents the postmortem.
          example: 00000000-0000-abcd-1000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentPostmortemType'
      required:
      - id
      - type
      type: object
    EntityV3:
      description: Entity schema v3.
      oneOf:
      - $ref: '#/components/schemas/EntityV3Service'
      - $ref: '#/components/schemas/EntityV3Datastore'
      - $ref: '#/components/schemas/EntityV3Queue'
      - $ref: '#/components/schemas/EntityV3System'
      - $ref: '#/components/schemas/EntityV3API'
    ComponentType:
      description: The UI component type.
      enum:
      - table
      - textInput
      - textArea
      - button
      - text
      - select
      - modal
      - schemaForm
      - checkbox
      - tabs
      - vegaChart
      - radioButtons
      - numberInput
      - fileInput
      - jsonInput
      - gridCell
      - dateRangePicker
      - search
      - container
      - calloutValue
      example: text
      type: string
      x-enum-varnames:
      - TABLE
      - TEXTINPUT
      - TEXTAREA
      - BUTTON
      - TEXT
      - SELECT
      - MODAL
      - SCHEMAFORM
      - CHECKBOX
      - TABS
      - VEGACHART
      - RADIOBUTTONS
      - NUMBERINPUT
      - FILEINPUT
      - JSONINPUT
      - GRIDCELL
      - DATERANGEPICKER
      - SEARCH
      - CONTAINER
      - CALLOUTVALUE
    GithubWebhookTrigger:
      description: Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a `webhookSecret`. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentIntegrationMetadataType:
      default: incident_integrations
      description: Integration metadata resource type.
      enum:
      - incident_integrations
      example: incident_integrations
      type: string
      x-enum-varnames:
      - INCIDENT_INTEGRATIONS
    TeamLink:
      description: Team link
      properties:
        attributes:
          $ref: '#/components/schemas/TeamLinkAttributes'
        id:
          description: The team link's identifier
          example: b8626d7e-cedd-11eb-abf5-da7ad0900001
          type: string
        type:
          $ref: '#/components/schemas/TeamLinkType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    DeploymentAttributes:
      description: The attributes object containing the version ID of the published app.
      properties:
        app_version_id:
          description: The version ID of the app that was published. For an unpublished app, this is always the nil UUID (`00000000-0000-0000-0000-000000000000`).
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorRule:
      description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take.
      properties:
        keyword_options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions'
        name:
          description: A name identifying the rule.
          example: Redact Credit Card Numbers
          type: string
        on_match:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction'
        pattern:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern'
        scope:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope'
        tags:
          description: Tags assigned to this rule for filtering and classification.
          example:
          - pii
          - ccn
          items:
            type: string
          type: array
      required:
      - name
      - tags
      - pattern
      - scope
      - on_match
      type: object
    DeploymentRelationship:
      description: Information pointing to the app's publication status.
      properties:
        data:
          $ref: '#/components/schemas/DeploymentRelationshipData'
        meta:
          $ref: '#/components/schemas/DeploymentMetadata'
      type: object
    DowntimeScheduleRecurrenceRrule:
      description: 'The `RRULE` standard for defining recurring events.

        For example, to have a recurring event on the first day of each month, set the type to `rrule` and set the `FREQ` to `MONTHLY` and `BYMONTHDAY` to `1`.

        Most common `rrule` options from the [iCalendar Spec](https://tools.ietf.org/html/rfc5545) are supported.


        **Note**: Attributes specifying the duration in `RRULE` are not supported (for example, `DTSTART`, `DTEND`, `DURATION`).

        More examples available in this [downtime guide](https://docs.datadoghq.com/monitors/guide/suppress-alert-with-downtimes/?tab=api).'
      example: FREQ=MONTHLY;BYSETPOS=3;BYDAY=WE;INTERVAL=1
      type: string
    UserAttributesStatus:
      description: The user's status.
      enum:
      - active
      - deactivated
      - pending
      type: string
      x-enum-varnames:
      - ACTIVE
      - DEACTIVATED
      - PENDING
    WidgetLiveSpan:
      description: The available timeframes depend on the widget you are using.
      enum:
      - 1m
      - 5m
      - 10m
      - 15m
      - 30m
      - 1h
      - 4h
      - 1d
      - 2d
      - 1w
      - 1mo
      - 3mo
      - 6mo
      - 1y
      - alert
      example: 5m
      type: string
      x-enum-varnames:
      - PAST_ONE_MINUTE
      - PAST_FIVE_MINUTES
      - PAST_TEN_MINUTES
      - PAST_FIFTEEN_MINUTES
      - PAST_THIRTY_MINUTES
      - PAST_ONE_HOUR
      - PAST_FOUR_HOURS
      - PAST_ONE_DAY
      - PAST_TWO_DAYS
      - PAST_ONE_WEEK
      - PAST_ONE_MONTH
      - PAST_THREE_MONTHS
      - PAST_SIX_MONTHS
      - PAST_ONE_YEAR
      - ALERT
    MonitorNotificationRuleUpdateRequestData:
      description: Object to update a monitor notification rule.
      properties:
        attributes:
          $ref: '#/components/schemas/MonitorNotificationRuleAttributes'
        id:
          $ref: '#/components/schemas/MonitorNotificationRuleId'
        type:
          $ref: '#/components/schemas/MonitorNotificationRuleResourceType'
      required:
      - id
      - attributes
      type: object
    EscalationPolicyStepAttributesAssignment:
      description: Specifies how this escalation step will assign targets (example `default` or `round-robin`).
      enum:
      - default
      - round-robin
      type: string
      x-enum-varnames:
      - DEFAULT
      - ROUND_ROBIN
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    JiraIntegrationMetadataIssuesItem:
      description: Item in the Jira integration metadata issue array.
      properties:
        account:
          description: URL of issue's Jira account.
          example: https://example.atlassian.net
          type: string
        issue_key:
          description: Jira issue's issue key.
          example: PROJ-123
          type: string
        issuetype_id:
          description: Jira issue's issue type.
          example: '1000'
          type: string
        project_key:
          description: Jira issue's project keys.
          example: PROJ
          type: string
        redirect_url:
          description: URL redirecting to the Jira issue.
          example: https://example.atlassian.net/browse/PROJ-123
          type: string
      required:
      - project_key
      - account
      type: object
    ApplicationSecurityWafCustomRuleConditionInputAddress:
      description: Input from the request on which the condition should apply.
      enum:
      - server.db.statement
      - server.io.fs.file
      - server.io.net.url
      - server.sys.shell.cmd
      - server.request.method
      - server.request.uri.raw
      - server.request.path_params
      - server.request.query
      - server.request.headers.no_cookies
      - server.request.cookies
      - server.request.trailers
      - server.request.body
      - server.response.status
      - server.response.headers.no_cookies
      - server.response.trailers
      - grpc.server.request.metadata
      - grpc.server.request.message
      - grpc.server.method
      - graphql.server.all_resolvers
      - usr.id
      - http.client_ip
      example: server.db.statement
      type: string
      x-enum-varnames:
      - SERVER_DB_STATEMENT
      - SERVER_IO_FS_FILE
      - SERVER_IO_NET_URL
      - SERVER_SYS_SHELL_CMD
      - SERVER_REQUEST_METHOD
      - SERVER_REQUEST_URI_RAW
      - SERVER_REQUEST_PATH_PARAMS
      - SERVER_REQUEST_QUERY
      - SERVER_REQUEST_HEADERS_NO_COOKIES
      - SERVER_REQUEST_COOKIES
      - SERVER_REQUEST_TRAILERS
      - SERVER_REQUEST_BODY
      - SERVER_RESPONSE_STATUS
      - SERVER_RESPONSE_HEADERS_NO_COOKIES
      - SERVER_RESPONSE_TRAILERS
      - GRPC_SERVER_REQUEST_METADATA
      - GRPC_SERVER_REQUEST_MESSAGE
      - GRPC_SERVER_METHOD
      - GRAPHQL_SERVER_ALL_RESOLVERS
      - USR_ID
      - HTTP_CLIENT_IP
    EscalationPolicyUserType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    RelationshipToUser:
      description: Relationship to user.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToUserData'
      required:
      - data
      type: object
    AWSAccountID:
      description: AWS Account ID.
      example: '123456789012'
      type: string
    ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy:
      description: Uses a numeric field in the log event as the metric increment.
      enum:
      - increment_by_field
      example: increment_by_field
      type: string
      x-enum-varnames:
      - INCREMENT_BY_FIELD
    IncidentFieldAttributesSingleValueType:
      default: dropdown
      description: Type of the single value field definitions.
      enum:
      - dropdown
      - textbox
      example: dropdown
      type: string
      x-enum-varnames:
      - DROPDOWN
      - TEXTBOX
    SensitiveDataScannerStandardPatternData:
      description: A standard pattern.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPattern'
      type: object
    ComponentGridProperties:
      description: Properties of a grid component.
      properties:
        backgroundColor:
          default: default
          description: The background color of the grid.
          type: string
          example: example_value
        children:
          description: The child components of the grid.
          items:
            $ref: '#/components/schemas/Component'
          type: array
        isVisible:
          $ref: '#/components/schemas/ComponentGridPropertiesIsVisible'
      type: object
    CloudWorkloadSecurityAgentPolicyUpdateAttributes:
      description: Update an existing Cloud Workload Security Agent policy
      properties:
        description:
          description: The description of the policy
          example: My agent policy
          type: string
        enabled:
          description: Whether the policy is enabled
          example: true
          type: boolean
        hostTags:
          description: The host tags defining where this policy is deployed
          items:
            type: string
          type: array
        hostTagsLists:
          description: The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
          items:
            items:
              type: string
            type: array
          type: array
        name:
          description: The name of the policy
          example: my_agent_policy
          type: string
      type: object
    TriggerRateLimit:
      description: Defines a rate limit for a trigger.
      properties:
        count:
          description: The `TriggerRateLimit` `count`.
          format: int64
          type: integer
          example: 42
        interval:
          description: The `TriggerRateLimit` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
          type: string
          example: example_value
      type: object
    ObservabilityPipelineAmazonDataFirehoseSource:
      description: The `amazon_data_firehose` source ingests logs from AWS Data Firehose.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineAwsAuth'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: amazon-firehose-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSourceType'
      required:
      - id
      - type
      type: object
    SpansMetricResponseCompute:
      description: The compute rule to compute the span-based metric.
      properties:
        aggregation_type:
          $ref: '#/components/schemas/SpansMetricComputeAggregationType'
        include_percentiles:
          $ref: '#/components/schemas/SpansMetricComputeIncludePercentiles'
        path:
          description: The path to the value the span-based metric will aggregate on (only used if the aggregation type is a "distribution").
          example: '@duration'
          type: string
      type: object
    ObservabilityPipelineRsyslogDestination:
      description: The `rsyslog` destination forwards logs to an external `rsyslog` server over TCP or UDP using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component.
          example: rsyslog-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        keepalive:
          description: Optional socket keepalive duration in milliseconds.
          example: 60000
          format: int64
          minimum: 0
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionHash:
      description: Configuration for hashing matched sensitive values.
      properties:
        action:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction'
        options:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionHash` `options`.
          type: object
      required:
      - action
      type: object
    ServiceDefinitionV2Dot2Version:
      default: v2.2
      description: Schema version being used.
      enum:
      - v2.2
      example: v2.2
      type: string
      x-enum-varnames:
      - V2_2
    EscalationPolicy:
      description: Represents a complete escalation policy response, including policy data and optionally included related resources.
      example:
        data:
          attributes:
            name: Escalation Policy 1
            resolve_page_on_policy_end: true
            retries: 2
          id: 00000000-aba1-0000-0000-000000000000
          relationships:
            steps:
              data:
              - id: 00000000-aba1-0000-0000-000000000000
                type: steps
            teams:
              data:
              - id: 00000000-da3a-0000-0000-000000000000
                type: teams
          type: policies
        included:
        - attributes:
            avatar: ''
            description: Team 1 description
            handle: team1
            name: Team 1
          id: 00000000-da3a-0000-0000-000000000000
          type: teams
        - attributes:
            assignment: default
            escalate_after_seconds: 3600
          id: 00000000-aba1-0000-0000-000000000000
          relationships:
            targets:
              data:
              - id: 00000000-aba1-0000-0000-000000000000
                type: users
              - id: 00000000-aba2-0000-0000-000000000000
                type: schedules
              - id: 00000000-aba3-0000-0000-000000000000
                type: teams
          type: steps
        - id: 00000000-aba1-0000-0000-000000000000
          type: users
        - id: 00000000-aba2-0000-0000-000000000000
          type: schedules
        - id: 00000000-aba3-0000-0000-000000000000
          type: teams
      properties:
        data:
          $ref: '#/components/schemas/EscalationPolicyData'
        included:
          description: Provides any included related resources, such as steps or targets, returned with the policy.
          items:
            $ref: '#/components/schemas/EscalationPolicyIncluded'
          type: array
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions:
      description: Configuration for keywords used to reinforce sensitive data pattern detection.
      properties:
        keywords:
          description: A list of keywords to match near the sensitive pattern.
          example:
          - ssn
          - card
          - account
          items:
            type: string
          type: array
        proximity:
          description: Maximum number of tokens between a keyword and a sensitive value match.
          example: 5
          format: int64
          type: integer
      required:
      - keywords
      - proximity
      type: object
    ObservabilityPipelineSumoLogicSourceType:
      default: sumo_logic
      description: The source type. The value should always be `sumo_logic`.
      enum:
      - sumo_logic
      example: sumo_logic
      type: string
      x-enum-varnames:
      - SUMO_LOGIC
    SpansMetricResponseFilter:
      description: The span-based metric filter. Spans matching this filter will be aggregated in this metric.
      properties:
        query:
          description: The search query - following the span search syntax.
          example: '@http.status_code:200 service:my-service'
          type: string
      type: object
    ApplicationSecurityWafCustomRuleConditionInput:
      description: Input from the request on which the condition should apply.
      properties:
        address:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress'
        key_path:
          description: Specific path for the input.
          items:
            type: string
          type: array
      required:
      - address
      type: object
    FastlyAccounResponseAttributes:
      description: Attributes object of a Fastly account.
      properties:
        name:
          description: The name of the Fastly account.
          example: test-name
          type: string
        services:
          description: A list of services belonging to the parent account.
          items:
            $ref: '#/components/schemas/FastlyService'
          type: array
      required:
      - name
      type: object
    ObservabilityPipelineSentinelOneDestinationType:
      default: sentinel_one
      description: The destination type. The value should always be `sentinel_one`.
      enum:
      - sentinel_one
      example: sentinel_one
      type: string
      x-enum-varnames:
      - SENTINEL_ONE
    ApplicationSecurityWafCustomRuleScope:
      description: The scope of the WAF custom rule.
      properties:
        env:
          description: The environment scope for the WAF custom rule.
          example: prod
          type: string
        service:
          description: The service scope for the WAF custom rule.
          example: billing-service
          type: string
      required:
      - service
      - env
      type: object
    ActionQuerySpecConnectionGroup:
      description: The connection group to use for an action query.
      properties:
        id:
          description: The ID of the connection group.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        tags:
          description: The tags of the connection group.
          items:
            type: string
          type: array
      type: object
    SecurityMonitoringThirdPartyRuleCase:
      description: Case when signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    MonitorNotificationRuleResponseIncludedItem:
      description: An object related to a monitor notification rule.
      oneOf:
      - $ref: '#/components/schemas/User'
    AWSAuthConfigKeys:
      description: AWS Authentication config to integrate your account using an access key pair.
      properties:
        access_key_id:
          description: AWS Access Key ID.
          example: AKIAIOSFODNN7EXAMPLE
          type: string
        secret_access_key:
          description: AWS Secret Access Key.
          example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
          minLength: 1
          type: string
          writeOnly: true
      required:
      - access_key_id
      type: object
    XRayServicesList:
      description: AWS X-Ray services to collect traces from. Defaults to `include_only`.
      oneOf:
      - $ref: '#/components/schemas/XRayServicesIncludeAll'
      - $ref: '#/components/schemas/XRayServicesIncludeOnly'
    HTTPCredentialsUpdate:
      description: The definition of `HTTPCredentialsUpdate` object.
      oneOf:
      - $ref: '#/components/schemas/HTTPTokenAuthUpdate'
    OpsgenieServiceType:
      default: opsgenie-service
      description: Opsgenie service resource type.
      enum:
      - opsgenie-service
      example: opsgenie-service
      type: string
      x-enum-varnames:
      - OPSGENIE_SERVICE
    IncidentFieldAttributes:
      description: Dynamic fields for which selections can be made, with field names as keys.
      oneOf:
      - $ref: '#/components/schemas/IncidentFieldAttributesSingleValue'
      - $ref: '#/components/schemas/IncidentFieldAttributesMultipleValue'
    RestrictionPolicyBinding:
      description: Specifies which principals are associated with a relation.
      properties:
        principals:
          description: 'An array of principals. A principal is a subject or group of subjects.

            Each principal is formatted as `type:id`. Supported types: `role`, `team`, `user`, and `org`.

            The org ID can be obtained through the api/v2/current_user API.

            The user principal type accepts service account IDs.'
          example:
          - role:00000000-0000-1111-0000-000000000000
          items:
            description: 'Subject or group of subjects. Each principal is formatted as `type:id`.

              Supported types: `role`, `team`, `user`, and `org`.

              The org ID can be obtained through the api/v2/current_user API.

              The user principal type accepts service account IDs.'
            type: string
          type: array
        relation:
          description: The role/level of access.
          example: editor
          type: string
      required:
      - relation
      - principals
      type: object
    APITriggerWrapper:
      description: Schema for an API-based trigger.
      properties:
        apiTrigger:
          $ref: '#/components/schemas/APITrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - apiTrigger
      type: object
    ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem:
      description: Single key-value pair used as a custom log header for Sumo Logic.
      properties:
        name:
          description: The header field name.
          example: X-Sumo-Category
          type: string
        value:
          description: The header field value.
          example: my-app-logs
          type: string
      required:
      - name
      - value
      type: object
    RuleId:
      description: The unique ID for a scorecard rule.
      example: q8MQxk8TCqrHnWkx
      type: string
    HTTPTokenAuthType:
      description: The definition of `HTTPTokenAuthType` object.
      enum:
      - HTTPTokenAuth
      example: HTTPTokenAuth
      type: string
      x-enum-varnames:
      - HTTPTOKENAUTH
    TeamRelationshipsLinks:
      description: Links attributes.
      properties:
        related:
          description: Related link.
          example: /api/v2/team/c75a4a8e-20c7-11ee-a3a5-da7ad0900002/links
          type: string
      type: object
    TeamPermissionSettingUpdateRequest:
      description: Team permission setting update request
      properties:
        data:
          $ref: '#/components/schemas/TeamPermissionSettingUpdate'
      required:
      - data
      type: object
    AWSResourcesConfig:
      description: AWS Resources Collection config.
      properties:
        cloud_security_posture_management_collection:
          description: Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations, identity risks, and compliance violations. Defaults to `false`. Requires `extended_collection` to be set to `true`.
          example: false
          type: boolean
        extended_collection:
          description: Whether Datadog collects additional attributes and configuration information about the resources in your AWS account. Defaults to `true`. Required for `cloud_security_posture_management_collection`.
          example: true
          type: boolean
      type: object
    AWSAccountResponseAttributes:
      description: AWS Account response attributes.
      properties:
        account_tags:
          $ref: '#/components/schemas/AWSAccountTags'
        auth_config:
          $ref: '#/components/schemas/AWSAuthConfig'
        aws_account_id:
          $ref: '#/components/schemas/AWSAccountID'
        aws_partition:
          $ref: '#/components/schemas/AWSAccountPartition'
        aws_regions:
          $ref: '#/components/schemas/AWSRegions'
        created_at:
          description: Timestamp of when the account integration was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        logs_config:
          $ref: '#/components/schemas/AWSLogsConfig'
        metrics_config:
          $ref: '#/components/schemas/AWSMetricsConfig'
        modified_at:
          description: Timestamp of when the account integration was updated.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        resources_config:
          $ref: '#/components/schemas/AWSResourcesConfig'
        traces_config:
          $ref: '#/components/schemas/AWSTracesConfig'
      required:
      - aws_account_id
      type: object
    CompletionGate:
      description: Used to create conditions before running subsequent actions.
      properties:
        completionCondition:
          $ref: '#/components/schemas/CompletionCondition'
        retryStrategy:
          $ref: '#/components/schemas/RetryStrategy'
      required:
      - completionCondition
      - retryStrategy
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget:
      description: Applies the rule to all fields.
      enum:
      - all
      example: all
      type: string
      x-enum-varnames:
      - ALL
    ApplicationSecurityWafCustomRuleType:
      default: custom_rule
      description: The type of the resource. The value should always be `custom_rule`.
      enum:
      - custom_rule
      example: custom_rule
      type: string
      x-enum-varnames:
      - CUSTOM_RULE
    RUMApplicationUpdateRequest:
      description: RUM application update request.
      properties:
        data:
          $ref: '#/components/schemas/RUMApplicationUpdate'
      required:
      - data
      type: object
    LogsMetricResponseFilter:
      description: The log-based metric filter. Logs matching this filter will be aggregated in this metric.
      properties:
        query:
          description: The search query - following the log search syntax.
          example: service:web* AND @http.status_code:[200 TO 299]
          type: string
      type: object
    PowerpackTemplateVariable:
      description: Powerpack template variables.
      properties:
        available_values:
          description: The list of values that the template variable drop-down is limited to.
          example:
          - my-host
          - host1
          - host2
          items:
            description: Template variable value.
            type: string
          nullable: true
          type: array
        defaults:
          description: One or many template variable default values within the saved view, which are unioned together using `OR` if more than one is specified.
          items:
            description: One or many default values of the template variable.
            minLength: 1
            type: string
          type: array
        name:
          description: The name of the variable.
          example: datacenter
          type: string
        prefix:
          description: The tag prefix associated with the variable. Only tags with this prefix appear in the variable drop-down.
          example: host
          nullable: true
          type: string
      required:
      - name
      type: object
    RestrictionQueryWithoutRelationships:
      description: Restriction query object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/RestrictionQueryAttributes'
        id:
          description: ID of the restriction query.
          example: 79a0e60a-644a-11ea-ad29-43329f7f58b5
          type: string
        type:
          default: logs_restriction_queries
          description: Restriction queries type.
          example: logs_restriction_queries
          readOnly: true
          type: string
      type: object
    ObservabilityPipelineRsyslogSource:
      description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rsyslog-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType'
      required:
      - id
      - type
      - mode
      type: object
    APITrigger:
      description: Trigger a workflow from an API request. The workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentAttachmentAttributes:
      description: The attributes object for an attachment.
      oneOf:
      - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes'
      - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes'
    DowntimeRelationshipsCreatedByData:
      description: Data for the user who created the downtime.
      nullable: true
      properties:
        id:
          description: User ID of the downtime creator.
          example: 00000000-0000-1234-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    CaseUpdatePriorityAttributes:
      description: Case update priority attributes
      properties:
        priority:
          $ref: '#/components/schemas/CasePriority'
      required:
      - priority
      type: object
    ServiceDefinitionSchema:
      description: Service definition schema.
      oneOf:
      - $ref: '#/components/schemas/ServiceDefinitionV1'
      - $ref: '#/components/schemas/ServiceDefinitionV2'
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot1'
      - $ref: '#/components/schemas/ServiceDefinitionV2Dot2'
    SensitiveDataScannerRuleAttributes:
      description: Attributes of the Sensitive Data Scanner rule.
      properties:
        description:
          description: Description of the rule.
          type: string
          example: example_value
        excluded_namespaces:
          description: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array.
          example:
          - admin.name
          items:
            type: string
          type: array
        included_keyword_configuration:
          $ref: '#/components/schemas/SensitiveDataScannerIncludedKeywordConfiguration'
        is_enabled:
          description: Whether or not the rule is enabled.
          type: boolean
          example: true
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        namespaces:
          description: 'Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned.

            If both are missing the whole event is scanned.'
          example:
          - admin
          items:
            type: string
          type: array
        pattern:
          description: Not included if there is a relationship to a standard pattern.
          type: string
          example: example_value
        priority:
          description: Integer from 1 (high) to 5 (low) indicating rule issue severity.
          format: int64
          maximum: 5
          minimum: 1
          type: integer
          example: 42
        tags:
          description: List of tags.
          items:
            type: string
          type: array
        text_replacement:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacement'
      type: object
    ActionQuerySpecInputs:
      description: The inputs to the action query. These are the values that are passed to the action when it is triggered.
      oneOf:
      - type: string
      - $ref: '#/components/schemas/ActionQuerySpecInput'
    MonitorNotificationRuleId:
      description: The ID of the monitor notification rule.
      example: 00000000-0000-1234-0000-000000000000
      type: string
    IncidentTodoAnonymousAssigneeSource:
      default: slack
      description: The source of the anonymous assignee.
      enum:
      - slack
      - microsoft_teams
      example: slack
      type: string
      x-enum-varnames:
      - SLACK
      - MICROSOFT_TEAMS
    MetricTagConfigurationType:
      default: manage_tags
      description: The metric tag configuration resource type.
      enum:
      - manage_tags
      example: manage_tags
      type: string
      x-enum-varnames:
      - MANAGE_TAGS
    StepDisplayBounds:
      description: The definition of `StepDisplayBounds` object.
      properties:
        x:
          description: The `bounds` `x`.
          format: double
          type: number
          example: 95.5
        y:
          description: The `bounds` `y`.
          format: double
          type: number
          example: 95.5
      type: object
    ApiID:
      description: API identifier.
      example: 90646597-5fdb-4a17-a240-647003f8c028
      format: uuid
      type: string
    ObservabilityPipelineEnrichmentTableFileKeyItemsComparison:
      description: Defines how to compare key fields for enrichment table lookups.
      enum:
      - equals
      example: equals
      type: string
      x-enum-varnames:
      - EQUALS
    SecurityMonitoringSignalRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    EntityV3APISpecInterfaceDefinition:
      additionalProperties: false
      description: The definition of `EntityV3APISpecInterfaceDefinition` object.
      properties:
        definition:
          description: The API definition.
          type: object
      type: object
    ObservabilityPipelineParseGrokProcessorRuleMatchRule:
      description: 'Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns.

        Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field.

        '
      properties:
        name:
          description: The name of the rule.
          example: MyParsingRule
          type: string
        rule:
          description: The definition of the Grok rule.
          example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
          type: string
      required:
      - name
      - rule
      type: object
    CaseUpdateStatusRequest:
      description: Case update status request
      properties:
        data:
          $ref: '#/components/schemas/CaseUpdateStatus'
      required:
      - data
      type: object
    RoleUpdateAttributes:
      description: Attributes of the role.
      properties:
        created_at:
          description: Creation time of the role.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified_at:
          description: Time of last role modification.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the role.
          type: string
          example: Example Monitor
        user_count:
          description: The user count.
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
      type: object
    AWSLambdaForwarderConfig:
      description: 'Log Autosubscription configuration for Datadog Forwarder Lambda functions. Automatically set up triggers for existing

        and new logs for some services, ensuring no logs from new resources are missed and saving time spent on manual configuration.'
      properties:
        lambdas:
          description: List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to `[]`.
          items:
            example: arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder
            type: string
          type: array
        sources:
          description: 'List of service IDs set to enable automatic log collection. Discover the list of available services with the

            [Get list of AWS log ready services](https://docs.datadoghq.com/api/latest/aws-logs-integration/#get-list-of-aws-log-ready-services) endpoint.'
          items:
            example: s3
            type: string
          type: array
      type: object
    ObservabilityPipelineParseJSONProcessor:
      description: The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string.
      properties:
        field:
          description: The name of the log field that contains a JSON string.
          example: message
          type: string
        id:
          description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: parse-json-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessorType'
      required:
      - id
      - type
      - include
      - field
      - inputs
      type: object
    IPAllowlistEntryType:
      default: ip_allowlist_entry
      description: IP allowlist Entry type.
      enum:
      - ip_allowlist_entry
      example: ip_allowlist_entry
      type: string
      x-enum-varnames:
      - IP_ALLOWLIST_ENTRY
    UpdateOpenAPIResponse:
      description: Response for `UpdateOpenAPI`.
      properties:
        data:
          $ref: '#/components/schemas/UpdateOpenAPIResponseData'
      type: object
    RelationshipToOrganization:
      description: Relationship to an organization.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToOrganizationData'
      required:
      - data
      type: object
    IncidentAttachmentLinkAttachmentType:
      default: link
      description: The type of link attachment attributes.
      enum:
      - link
      example: link
      type: string
      x-enum-varnames:
      - LINK
    ComponentGridPropertiesIsVisible:
      description: Whether the grid component and its children are visible. If a string, it must be a valid JavaScript expression that evaluates to a boolean.
      oneOf:
      - type: string
      - default: true
        type: boolean
    IncidentTodoRelationships:
      description: The incident's relationships from a response.
      properties:
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    ObservabilityPipelineReduceProcessorMergeStrategy:
      description: Defines how a specific field should be merged across grouped events.
      properties:
        path:
          description: The field path in the log event.
          example: log.user.roles
          type: string
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategyStrategy'
      required:
      - path
      - strategy
      type: object
    ServiceDefinitionV2Integrations:
      description: Third party integrations that Datadog supports.
      properties:
        opsgenie:
          $ref: '#/components/schemas/ServiceDefinitionV2Opsgenie'
        pagerduty:
          $ref: '#/components/schemas/ServiceDefinitionV2Pagerduty'
      type: object
    FastlyAccountUpdateRequest:
      description: Payload schema when updating a Fastly account.
      properties:
        data:
          $ref: '#/components/schemas/FastlyAccountUpdateRequestData'
      required:
      - data
      type: object
    AwsCURConfigsResponse:
      description: List of AWS CUR configs.
      properties:
        data:
          description: An AWS CUR config.
          items:
            $ref: '#/components/schemas/AwsCURConfig'
          type: array
      type: object
    ObservabilityPipelineAmazonDataFirehoseSourceType:
      default: amazon_data_firehose
      description: The source type. The value should always be `amazon_data_firehose`.
      enum:
      - amazon_data_firehose
      example: amazon_data_firehose
      type: string
      x-enum-varnames:
      - AMAZON_DATA_FIREHOSE
    AWSAssumeRoleUpdate:
      description: The definition of `AWSAssumeRoleUpdate` object.
      properties:
        account_id:
          description: AWS account the connection is created for
          example: '111222333444'
          pattern: ^\d{12}$
          type: string
        generate_new_external_id:
          description: The `AWSAssumeRoleUpdate` `generate_new_external_id`.
          type: boolean
          example: true
        role:
          description: Role to assume
          example: my-role
          type: string
        type:
          $ref: '#/components/schemas/AWSAssumeRoleType'
      required:
      - type
      type: object
    EntityResponseData:
      description: List of entity data.
      items:
        $ref: '#/components/schemas/EntityData'
      type: array
    DashboardListItemResponse:
      description: A dashboard within a list.
      properties:
        id:
          description: ID of the dashboard.
          example: q5j-nti-fv6
          readOnly: true
          type: string
        type:
          $ref: '#/components/schemas/DashboardType'
      required:
      - type
      - id
      type: object
    SecurityMonitoringRuleKeepAlive:
      description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within

        this keep alive window. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    ReadinessGateThresholdType:
      description: The definition of `ReadinessGateThresholdType` object.
      enum:
      - ANY
      - ALL
      example: ANY
      type: string
      x-enum-varnames:
      - ANY
      - ALL
    CaseResourceType:
      default: case
      description: Case resource type
      enum:
      - case
      example: case
      type: string
      x-enum-varnames:
      - CASE
    ObservabilityPipelineDedupeProcessorType:
      default: dedupe
      description: The processor type. The value should always be `dedupe`.
      enum:
      - dedupe
      example: dedupe
      type: string
      x-enum-varnames:
      - DEDUPE
    ServiceDefinitionV2Dot2Pagerduty:
      description: PagerDuty integration for the service.
      properties:
        service-url:
          description: PagerDuty service url.
          example: https://my-org.pagerduty.com/service-directory/PMyService
          type: string
      type: object
      x-ignore-duplicate-object: true
    ObservabilityPipelineSentinelOneDestinationRegion:
      description: The SentinelOne region to send logs to.
      enum:
      - us
      - eu
      - ca
      - data_set_us
      example: us
      type: string
      x-enum-varnames:
      - US
      - EU
      - CA
      - DATA_SET_US
    AzureUCConfigPatchData:
      description: Azure config Patch data.
      properties:
        attributes:
          $ref: '#/components/schemas/AzureUCConfigPatchRequestAttributes'
        type:
          $ref: '#/components/schemas/AzureUCConfigPatchRequestType'
      required:
      - attributes
      - type
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions:
      description: Controls how partial redaction is applied, including character count and direction.
      properties:
        characters:
          description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions` `characters`.
          example: 4
          format: int64
          type: integer
        direction:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection'
      required:
      - characters
      - direction
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByField:
      description: Strategy that increments a generated metric based on the value of a log field.
      properties:
        field:
          description: Name of the log field containing the numeric value to increment the metric by.
          example: errors
          type: string
        strategy:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy'
      required:
      - strategy
      - field
      type: object
    Weekday:
      description: A day of the week.
      enum:
      - monday
      - tuesday
      - wednesday
      - thursday
      - friday
      - saturday
      - sunday
      type: string
      x-enum-varnames:
      - MONDAY
      - TUESDAY
      - WEDNESDAY
      - THURSDAY
      - FRIDAY
      - SATURDAY
      - SUNDAY
    RestrictionQueryUpdatePayload:
      description: Update a restriction query.
      properties:
        data:
          $ref: '#/components/schemas/RestrictionQueryUpdateData'
      type: object
    DashboardType:
      description: The type of the dashboard.
      enum:
      - custom_timeboard
      - custom_screenboard
      - integration_screenboard
      - integration_timeboard
      - host_timeboard
      example: host_timeboard
      type: string
      x-enum-varnames:
      - CUSTOM_TIMEBOARD
      - CUSTOM_SCREENBOARD
      - INTEGRATION_SCREENBOARD
      - INTEGRATION_TIMEBOARD
      - HOST_TIMEBOARD
    DataTransformProperties:
      description: The properties of the data transformer.
      properties:
        outputs:
          description: A JavaScript function that returns the transformed data.
          example: "${(() => {return {\n    allItems: [...fetchOrder1.outputs.items, ...fetchOrder2.outputs.items],\n}})()}"
          type: string
      type: object
    EscalationPolicyStepRelationships:
      description: Represents the relationship of an escalation policy step to its targets.
      properties:
        targets:
          $ref: '#/components/schemas/EscalationTargets'
      type: object
    IncidentFieldAttributesMultipleValue:
      description: A field with potentially multiple values selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesValueType'
        value:
          description: The multiple values selected for this field.
          example:
          - '1.0'
          - '1.1'
          items:
            description: A value which has been selected for the parent field.
            example: '1.1'
            type: string
          nullable: true
          type: array
      type: object
    LogsMetricGroupBy:
      description: A group by rule.
      properties:
        path:
          description: The path to the value the log-based metric will be aggregated over.
          example: '@http.status_code'
          type: string
        tag_name:
          description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name.
          example: status_code
          type: string
      required:
      - path
      type: object
    ObservabilityPipelineGeneratedMetricMetricType:
      description: Type of metric to create.
      enum:
      - count
      - gauge
      - distribution
      example: count
      type: string
      x-enum-varnames:
      - COUNT
      - GAUGE
      - DISTRIBUTION
    OrgConfigWriteAttributes:
      description: Writable attributes of an Org Config.
      properties:
        value:
          description: The value of an Org Config.
          example: example_value
      required:
      - value
      type: object
    DowntimeScheduleRecurrencesUpdateRequest:
      additionalProperties: false
      description: A recurring downtime schedule definition.
      properties:
        recurrences:
          description: A list of downtime recurrences.
          items:
            $ref: '#/components/schemas/DowntimeScheduleRecurrenceCreateUpdateRequest'
          type: array
        timezone:
          default: UTC
          description: The timezone in which to schedule the downtime.
          example: America/New_York
          type: string
      type: object
    CustomDestinationResponseForwardDestination:
      description: A custom destination's location to forward logs.
      oneOf:
      - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttp'
      - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunk'
      - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearch'
    RelationshipToRule:
      description: Scorecard create rule response relationship.
      properties:
        scorecard:
          $ref: '#/components/schemas/RelationshipToRuleData'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    OktaAccountAttributes:
      description: Attributes object for an Okta account.
      properties:
        api_key:
          description: The API key of the Okta account.
          type: string
          writeOnly: true
          example: example_value
        auth_method:
          description: The authorization method for an Okta account.
          example: oauth
          type: string
        client_id:
          description: The Client ID of an Okta app integration.
          type: string
          example: abc-123-def
        client_secret:
          description: The client secret of an Okta app integration.
          type: string
          writeOnly: true
          example: example_value
        domain:
          description: The domain of the Okta account.
          example: https://example.okta.com/
          type: string
        name:
          description: The name of the Okta account.
          example: Okta-Prod
          type: string
      required:
      - auth_method
      - domain
      - name
      type: object
    AzureUCConfigPairType:
      default: azure_uc_configs
      description: Type of Azure config pair.
      enum:
      - azure_uc_configs
      example: azure_uc_configs
      type: string
      x-enum-varnames:
      - AZURE_UC_CONFIGS
    CustomDestinationForwardDestination:
      description: A custom destination's location to forward logs.
      oneOf:
      - $ref: '#/components/schemas/CustomDestinationForwardDestinationHttp'
      - $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunk'
      - $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearch'
    Case3rdPartyTicketStatus:
      default: IN_PROGRESS
      description: Case status
      enum:
      - IN_PROGRESS
      - COMPLETED
      - FAILED
      example: COMPLETED
      readOnly: true
      type: string
      x-enum-varnames:
      - IN_PROGRESS
      - COMPLETED
      - FAILED
    UserTeamTeamType:
      default: team
      description: User team team type
      enum:
      - team
      example: team
      type: string
      x-enum-varnames:
      - TEAM
    TeamAttributes:
      description: Team attributes
      properties:
        avatar:
          description: Unicode representation of the avatar for the team, limited to a single grapheme
          example: 🥑
          nullable: true
          type: string
        banner:
          description: Banner selection for the team
          format: int64
          nullable: true
          type: integer
          example: 42
        created_at:
          description: Creation date of the team
          format: date-time
          type: string
          example: example_value
        description:
          description: Free-form markdown description/content for the team's homepage
          nullable: true
          type: string
          example: example_value
        handle:
          description: The team's identifier
          example: example-team
          maxLength: 195
          type: string
        hidden_modules:
          description: Collection of hidden modules for the team
          items:
            description: String identifier of the module
            type: string
          type: array
        link_count:
          description: The number of links belonging to the team
          format: int32
          maximum: 2147483647
          readOnly: true
          type: integer
          example: 42
        modified_at:
          description: Modification date of the team
          format: date-time
          type: string
          example: example_value
        name:
          description: The name of the team
          example: Example Team
          maxLength: 200
          type: string
        summary:
          description: A brief summary of the team, derived from the `description`
          maxLength: 120
          nullable: true
          type: string
          example: example_value
        user_count:
          description: The number of users belonging to the team
          format: int32
          maximum: 2147483647
          readOnly: true
          type: integer
          example: 42
        visible_modules:
          description: Collection of visible modules for the team
          items:
            description: String identifier of the module
            type: string
          type: array
      required:
      - handle
      - name
      type: object
    Role:
      description: Role object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/RoleAttributes'
        id:
          description: The unique identifier of the role.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RoleResponseRelationships'
        type:
          $ref: '#/components/schemas/RolesType'
      required:
      - type
      type: object
      x-merge-override:
        required: false
    CloudConfigurationComplianceRuleOptions:
      additionalProperties: {}
      description: 'Options for cloud_configuration rules.

        Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules.

        '
      properties:
        complexRule:
          description: 'Whether the rule is a complex one.

            Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false.

            '
          type: boolean
          example: true
        regoRule:
          $ref: '#/components/schemas/CloudConfigurationRegoRule'
        resourceType:
          description: 'Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`.

            '
          example: aws_acm
          type: string
      type: object
    CustomDestinationResponseElasticsearchDestinationAuth:
      additionalProperties:
        description: Basic access authentication.
      description: Basic access authentication.
      type: object
    ServiceDefinitionV2Dot1Pagerduty:
      description: PagerDuty integration for the service.
      properties:
        service-url:
          description: PagerDuty service url.
          example: https://my-org.pagerduty.com/service-directory/PMyService
          type: string
      type: object
      x-ignore-duplicate-object: true
    OutboundEdge:
      description: The definition of `OutboundEdge` object.
      properties:
        branchName:
          description: The `OutboundEdge` `branchName`.
          example: ''
          type: string
        nextStepName:
          description: The `OutboundEdge` `nextStepName`.
          example: ''
          type: string
      required:
      - nextStepName
      - branchName
      type: object
    ScheduleRequestDataAttributesLayersItemsMembersItems:
      description: Defines a single member within a schedule layer, including the reference to the underlying user.
      properties:
        user:
          $ref: '#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItemsUser'
      type: object
    IncidentServiceIncludedItems:
      description: An object related to an incident service which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    UserUpdateAttributes:
      description: Attributes of the edited user.
      properties:
        disabled:
          description: If the user is enabled or disabled.
          type: boolean
          example: true
        email:
          description: The email of the user.
          type: string
          example: user@example.com
        name:
          description: The name of the user.
          type: string
          example: Example Monitor
      type: object
    MonitorNotificationRuleRecipients:
      description: A list of recipients to notify. Uses the same format as the monitor `message` field. Must not start with an '@'.
      example:
      - slack-test-channel
      - jira-test
      items:
        description: individual recipient.
        maxLength: 255
        type: string
      maxItems: 20
      minItems: 1
      type: array
      uniqueItems: true
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions:
      description: Options for defining a custom regex pattern.
      properties:
        rule:
          description: A regular expression used to detect sensitive values. Must be a valid regex.
          example: \b\d{16}\b
          type: string
      required:
      - rule
      type: object
    CloudflareAccountType:
      default: cloudflare-accounts
      description: The JSON:API type for this API. Should always be `cloudflare-accounts`.
      enum:
      - cloudflare-accounts
      example: cloudflare-accounts
      type: string
      x-enum-varnames:
      - CLOUDFLARE_ACCOUNTS
    ObservabilityPipelineAwsAuth:
      description: 'AWS authentication credentials used for accessing AWS services such as S3.

        If omitted, the system’s default credentials are used (for example, the IAM role and environment variables).

        '
      properties:
        assume_role:
          description: The Amazon Resource Name (ARN) of the role to assume.
          type: string
          example: example_value
        external_id:
          description: A unique identifier for cross-account role assumption.
          type: string
          example: abc-123-def
        session_name:
          description: A session identifier used for logging and tracing the assumed role session.
          type: string
          example: Example Monitor
      type: object
    ObservabilityPipelineConfigProcessorItem:
      description: A processor for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineFilterProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineSampleProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor'
      - $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor'
    ConfluentAccountUpdateRequestData:
      description: Data object for updating a Confluent account.
      properties:
        attributes:
          $ref: '#/components/schemas/ConfluentAccountUpdateRequestAttributes'
        type:
          $ref: '#/components/schemas/ConfluentAccountType'
      required:
      - attributes
      - type
      type: object
    IncidentAttachmentUpdateAttributes:
      description: Incident attachment attributes.
      oneOf:
      - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes'
      - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes'
    CustomDestinationResponseDefinition:
      description: The definition of a custom destination.
      properties:
        attributes:
          $ref: '#/components/schemas/CustomDestinationResponseAttributes'
        id:
          description: The custom destination ID.
          example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139
          readOnly: true
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationType'
      type: object
    ServiceDefinitionV2LinkType:
      description: Link type.
      enum:
      - doc
      - wiki
      - runbook
      - url
      - repo
      - dashboard
      - oncall
      - code
      - link
      example: runbook
      type: string
      x-enum-varnames:
      - DOC
      - WIKI
      - RUNBOOK
      - URL
      - REPO
      - DASHBOARD
      - ONCALL
      - CODE
      - LINK
    ObservabilityPipelineReduceProcessor:
      description: The `reduce` processor aggregates and merges logs based on matching keys and merge strategies.
      properties:
        group_by:
          description: A list of fields used to group log events for merging.
          example:
          - log.user.id
          - log.device.id
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: reduce-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: env:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        merge_strategies:
          description: List of merge strategies defining how values from grouped events should be combined.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategy'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - group_by
      - merge_strategies
      type: object
    RumMetricResponseFilter:
      description: The rum-based metric filter. RUM events matching this filter will be aggregated in this metric.
      properties:
        query:
          description: The search query - following the RUM search syntax.
          example: service:web* AND @http.status_code:[200 TO 299]
          type: string
      type: object
    IncidentAttachmentsResponseIncludedItem:
      description: An object related to an attachment that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    CustomConnectionType:
      default: custom_connections
      description: The custom connection type.
      enum:
      - custom_connections
      example: custom_connections
      type: string
      x-enum-varnames:
      - CUSTOM_CONNECTIONS
    ConfluentAccountResponse:
      description: The expected response schema when getting a Confluent account.
      properties:
        data:
          $ref: '#/components/schemas/ConfluentAccountResponseData'
      type: object
    SecurityMonitoringFilter:
      description: The rule's suppression filter.
      properties:
        action:
          $ref: '#/components/schemas/SecurityMonitoringFilterAction'
        query:
          description: Query for selecting logs to apply the filtering action.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    UpdateAppRequest:
      description: A request object for updating an existing app.
      example:
        data:
          attributes:
            components:
            - events: []
              name: grid0
              properties:
                children:
                - events: []
                  name: gridCell0
                  properties:
                    children:
                    - events: []
                      name: calloutValue0
                      properties:
                        isDisabled: false
                        isLoading: false
                        isVisible: true
                        label: CPU Usage
                        size: sm
                        style: vivid_yellow
                        unit: kB
                        value: '42'
                      type: calloutValue
                    isVisible: 'true'
                    layout:
                      default:
                        height: 8
                        width: 2
                        x: 0
                        y: 0
                  type: gridCell
              type: grid
            description: This is a simple example app
            name: Example App
            queries: []
            rootInstanceName: grid0
          id: 9e20cbaf-68da-45a6-9ccf-54193ac29fa5
          type: appDefinitions
      properties:
        data:
          $ref: '#/components/schemas/UpdateAppRequestData'
      type: object
    RumMetricUpdateCompute:
      description: The compute rule to compute the rum-based metric.
      properties:
        include_percentiles:
          $ref: '#/components/schemas/RumMetricComputeIncludePercentiles'
      type: object
    EscalationPolicyUpdateRequestDataRelationships:
      description: Represents relationships in an escalation policy update request, including references to teams.
      properties:
        teams:
          $ref: '#/components/schemas/DataRelationshipsTeams'
      type: object
    JiraIssueResult:
      description: Jira issue information
      properties:
        issue_id:
          description: Jira issue ID
          type: string
          example: abc-123-def
        issue_key:
          description: Jira issue key
          type: string
          example: example_value
        issue_url:
          description: Jira issue URL
          type: string
          example: https://app.datadoghq.com
        project_key:
          description: Jira project key
          type: string
          example: example_value
      type: object
    LogsArchiveDestinationGCSType:
      default: gcs
      description: Type of the GCS archive destination.
      enum:
      - gcs
      example: gcs
      type: string
      x-enum-varnames:
      - GCS
    UpdateCustomFrameworkResponse:
      description: Response object to update a custom framework.
      properties:
        data:
          $ref: '#/components/schemas/FrameworkHandleAndVersionResponseData'
      required:
      - data
      type: object
    ScheduleRequestDataAttributesLayersItemsMembersItemsUser:
      description: Identifies the user participating in this layer as a single object with an `id`.
      properties:
        id:
          description: The user's ID.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
      type: object
    TeamLinkAttributes:
      description: Team link attributes
      properties:
        label:
          description: The link's label
          example: Link label
          maxLength: 256
          type: string
        position:
          description: The link's position, used to sort links for the team
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
        team_id:
          description: ID of the team the link is associated with
          readOnly: true
          type: string
          example: abc-123-def
        url:
          description: The URL for the link
          example: https://example.com
          type: string
      required:
      - label
      - url
      type: object
    ActionQuery:
      description: An action query. This query type is used to trigger an action, such as sending a HTTP request.
      properties:
        events:
          description: Events to listen for downstream of the action query.
          items:
            $ref: '#/components/schemas/AppBuilderEvent'
          type: array
        id:
          description: The ID of the action query.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        name:
          description: A unique identifier for this action query. This name is also used to access the query's result throughout the app.
          example: fetchPendingOrders
          type: string
        properties:
          $ref: '#/components/schemas/ActionQueryProperties'
        type:
          $ref: '#/components/schemas/ActionQueryType'
      required:
      - id
      - name
      - type
      - properties
      type: object
    PermissionAttributes:
      description: Attributes of a permission.
      properties:
        created:
          description: Creation time of the permission.
          format: date-time
          type: string
          example: example_value
        description:
          description: Description of the permission.
          type: string
          example: example_value
        display_name:
          description: Displayed name for the permission.
          type: string
          example: Example Monitor
        display_type:
          description: Display type.
          type: string
          example: metric alert
        group_name:
          description: Name of the permission group.
          type: string
          example: Example Monitor
        name:
          description: Name of the permission.
          type: string
          example: Example Monitor
        restricted:
          description: Whether or not the permission is restricted.
          type: boolean
          example: true
      type: object
    ActionQueryPollingIntervalInMs:
      description: If specified, the app will poll the query at the specified interval in milliseconds. The minimum polling interval is 15 seconds. The query will only poll when the app's browser tab is active.
      oneOf:
      - example: 30000
        format: double
        minimum: 15000
        type: number
      - description: If this is a string, it must be a valid JavaScript expression that evaluates to a number.
        example: ${15000}
        type: string
    LogsMetricResponse:
      description: The log-based metric object.
      properties:
        data:
          $ref: '#/components/schemas/LogsMetricResponseData'
      type: object
    ApplicationSecurityWafExclusionFilterResponse:
      description: Response object for a single WAF exclusion filter.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResource'
      type: object
    SlackIntegrationMetadata:
      description: Incident integration metadata for the Slack integration.
      properties:
        channels:
          description: Array of Slack channels in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/SlackIntegrationMetadataChannelItem'
          type: array
      required:
      - channels
      type: object
    IncidentServiceUpdateData:
      description: Incident Service payload for update requests.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentServiceUpdateAttributes'
        id:
          description: The incident service's ID.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentServiceRelationships'
        type:
          $ref: '#/components/schemas/IncidentServiceType'
      required:
      - type
      type: object
    SecurityFilterUpdateRequest:
      description: The new security filter body.
      properties:
        data:
          $ref: '#/components/schemas/SecurityFilterUpdateData'
      required:
      - data
      type: object
    IncidentTodoResponseData:
      description: Incident todo response data.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentTodoAttributes'
        id:
          description: The incident todo's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentTodoRelationships'
        type:
          $ref: '#/components/schemas/IncidentTodoType'
      required:
      - id
      - type
      type: object
    SensitiveDataScannerTextReplacement:
      description: Object describing how the scanned event will be replaced.
      properties:
        number_of_chars:
          description: 'Required if type == ''partial_replacement_from_beginning''

            or ''partial_replacement_from_end''. It must be > 0.'
          format: int64
          minimum: 0
          type: integer
          example: 42
        replacement_string:
          description: Required if type == 'replacement_string'.
          type: string
          example: example_value
        type:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacementType'
      type: object
    ApplicationSecurityWafCustomRuleUpdateData:
      description: Object for a single WAF Custom Rule.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateAttributes'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType'
      required:
      - attributes
      - type
      type: object
    RelationshipToIncidentIntegrationMetadataData:
      description: A relationship reference for an integration metadata object.
      example:
        id: 00000000-abcd-0002-0000-000000000000
        type: incident_integrations
      properties:
        id:
          description: A unique identifier that represents the integration metadata.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    CloudWorkloadSecurityAgentRuleData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAttributes'
        id:
          description: The ID of the Agent rule
          example: 3dd-0uc-h1s
          type: string
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      type: object
    AWSAccountResponseData:
      description: AWS Account response data.
      properties:
        attributes:
          $ref: '#/components/schemas/AWSAccountResponseAttributes'
        id:
          $ref: '#/components/schemas/AWSAccountConfigID'
        type:
          $ref: '#/components/schemas/AWSAccountType'
      required:
      - id
      - type
      type: object
    MonitorNotificationRuleRelationshipsCreatedBy:
      description: The user who created the monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedByData'
      type: object
    LayerRelationshipsMembers:
      description: Holds an array of references to the members of a Layer, each containing member IDs.
      properties:
        data:
          description: The list of members who belong to this layer.
          items:
            $ref: '#/components/schemas/LayerRelationshipsMembersDataItems'
          type: array
      type: object
    LogsMetricUpdateAttributes:
      description: The log-based metric properties that will be updated.
      properties:
        compute:
          $ref: '#/components/schemas/LogsMetricUpdateCompute'
        filter:
          $ref: '#/components/schemas/LogsMetricFilter'
        group_by:
          description: The rules for the group by.
          items:
            $ref: '#/components/schemas/LogsMetricGroupBy'
          type: array
      type: object
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude:
      description: Includes only specific fields for sensitive data scanning.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions'
        target:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget'
      required:
      - target
      - options
      type: object
    EntityV3Datastore:
      additionalProperties: false
      description: Schema for datastore entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3DatastoreDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3DatastoreKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3DatastoreSpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    IncidentServiceType:
      default: services
      description: Incident service resource type.
      enum:
      - services
      example: services
      type: string
      x-enum-varnames:
      - SERVICES
    GCPSTSServiceAccountUpdateRequestData:
      description: Data on your service account.
      properties:
        attributes:
          $ref: '#/components/schemas/GCPSTSServiceAccountAttributes'
        id:
          description: Your service account's unique ID.
          example: d291291f-12c2-22g4-j290-123456678897
          type: string
        type:
          $ref: '#/components/schemas/GCPServiceAccountType'
      type: object
    EntityResponseMeta:
      description: Entity metadata.
      properties:
        count:
          description: Total entities count.
          format: int64
          type: integer
          example: 42
        includeCount:
          description: Total included data count.
          format: int64
          type: integer
          example: 42
      type: object
    LogsArchiveCreateRequestDefinition:
      description: The definition of an archive.
      properties:
        attributes:
          $ref: '#/components/schemas/LogsArchiveCreateRequestAttributes'
        type:
          default: archives
          description: The type of the resource. The value should always be archives.
          example: archives
          type: string
      required:
      - type
      type: object
    SecurityTrigger:
      description: Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    AwsCURConfigAttributes:
      description: Attributes for An AWS CUR config.
      properties:
        account_filters:
          $ref: '#/components/schemas/AccountFilteringConfig'
        account_id:
          description: The AWS account ID.
          example: '123456789123'
          type: string
        bucket_name:
          description: The AWS bucket name used to store the Cost and Usage Report.
          example: dd-cost-bucket
          type: string
        bucket_region:
          description: The region the bucket is located in.
          example: us-east-1
          type: string
        created_at:
          description: The timestamp when the AWS CUR config was created.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: example_value
        error_messages:
          description: The error messages for the AWS CUR config.
          items:
            type: string
          type: array
        months:
          deprecated: true
          description: The number of months the report has been backfilled.
          format: int32
          maximum: 36
          type: integer
          example: 42
        report_name:
          description: The name of the Cost and Usage Report.
          example: dd-report-name
          type: string
        report_prefix:
          description: The report prefix used for the Cost and Usage Report.
          example: dd-report-prefix
          type: string
        status:
          description: The status of the AWS CUR.
          example: active
          type: string
        status_updated_at:
          description: The timestamp when the AWS CUR config status was updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: OK
        updated_at:
          description: The timestamp when the AWS CUR config status was updated.
          pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$
          type: string
          x-merge-override:
            format: false
          example: '2026-04-17T12:00:00Z'
      required:
      - account_id
      - bucket_name
      - bucket_region
      - report_name
      - report_prefix
      - status
      type: object
      x-merge-override:
        required: false
    IncidentServiceUpdateAttributes:
      description: The incident service's attributes for an update request.
      properties:
        name:
          description: Name of the incident service.
          example: an example service name
          type: string
      required:
      - name
      type: object
    CloudflareAccountUpdateRequestAttributes:
      description: Attributes object for updating a Cloudflare account.
      properties:
        api_key:
          description: The API key of the Cloudflare account.
          example: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
          type: string
        email:
          description: The email associated with the Cloudflare account. If an API key is provided (and not a token), this field is also required.
          example: test-email@example.com
          type: string
        name:
          description: The name of the Cloudflare account.
          type: string
          example: Example Monitor
        resources:
          description: An allowlist of resources to restrict pulling metrics for including `'web', 'dns', 'lb' (load balancer), 'worker'`.
          example:
          - web
          - dns
          - lb
          - worker
          items:
            type: string
          type: array
        zones:
          description: An allowlist of zones to restrict pulling metrics for.
          example:
          - zone_id_1
          - zone_id_2
          items:
            type: string
          type: array
      required:
      - api_key
      type: object
      x-merge-override:
        required: false
    ServiceDefinitionV2Dot1EmailType:
      description: Contact type.
      enum:
      - email
      example: email
      type: string
      x-enum-varnames:
      - EMAIL
    TeamPermissionSettingType:
      default: team_permission_settings
      description: Team permission setting type
      enum:
      - team_permission_settings
      example: team_permission_settings
      type: string
      x-enum-varnames:
      - TEAM_PERMISSION_SETTINGS
    IncidentTodoResponse:
      description: Response with an incident todo.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTodoResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentTodoResponseIncludedItem'
          readOnly: true
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineEnrichmentTableFileSchemaItems:
      description: Describes a single column and its type in an enrichment table schema.
      properties:
        column:
          description: The `items` `column`.
          example: region
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItemsType'
      required:
      - column
      - type
      type: object
    ObservabilityPipelineNewRelicDestinationType:
      default: new_relic
      description: The destination type. The value should always be `new_relic`.
      enum:
      - new_relic
      example: new_relic
      type: string
      x-enum-varnames:
      - NEW_RELIC
    CloudWorkloadSecurityAgentRuleID:
      description: The ID of the Agent rule
      example: 3dd-0uc-h1s
      type: string
    HTTPCredentials:
      description: The definition of `HTTPCredentials` object.
      oneOf:
      - $ref: '#/components/schemas/HTTPTokenAuth'
    ConnectionEnv:
      description: A list of connections or connection groups used in the workflow.
      properties:
        connectionGroups:
          description: The `ConnectionEnv` `connectionGroups`.
          items:
            $ref: '#/components/schemas/ConnectionGroup'
          type: array
        connections:
          description: The `ConnectionEnv` `connections`.
          items:
            $ref: '#/components/schemas/Connection'
          type: array
        env:
          $ref: '#/components/schemas/ConnectionEnvEnv'
      required:
      - env
      type: object
    AzureUCConfigPatchRequest:
      description: Azure config Patch Request.
      properties:
        data:
          $ref: '#/components/schemas/AzureUCConfigPatchData'
      required:
      - data
      type: object
    RumMetricResponseCompute:
      description: The compute rule to compute the rum-based metric.
      properties:
        aggregation_type:
          $ref: '#/components/schemas/RumMetricComputeAggregationType'
        include_percentiles:
          $ref: '#/components/schemas/RumMetricComputeIncludePercentiles'
        path:
          description: 'The path to the value the rum-based metric will aggregate on.

            Only present when `aggregation_type` is `distribution`.'
          example: '@duration'
          type: string
      type: object
    RestrictionPolicy:
      description: Restriction policy object.
      properties:
        attributes:
          $ref: '#/components/schemas/RestrictionPolicyAttributes'
        id:
          description: The identifier, always equivalent to the value specified in the `resource_id` path parameter.
          example: dashboard:abc-def-ghi
          type: string
        type:
          $ref: '#/components/schemas/RestrictionPolicyType'
      required:
      - type
      - id
      - attributes
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction:
      description: Action type that redacts part of the sensitive data while preserving a configurable number of characters, typically used for masking purposes (e.g., show last 4 digits of a credit card).
      enum:
      - partial_redact
      example: partial_redact
      type: string
      x-enum-varnames:
      - PARTIAL_REDACT
    ExternalUserMeta:
      description: Metadata associated with a user.
      properties:
        created:
          description: The date and time the user was created.
          example: '2024-10-17T12:53:35.793Z'
          format: date-time
          type: string
        lastModified:
          description: The date and time the user was last changed.
          example: '2024-10-19T12:53:35.793Z'
          format: date-time
          type: string
        location:
          description: URL identifying the resource.
          example: https://app.datadoghq.com/api/scim/v2/Users/13a95654-b76d-478d-8636-157a7e461d7c
          type: string
        resourceType:
          description: Type of resource.
          example: User
          type: string
      type: object
    CustomFrameworkDataAttributes:
      description: Framework Data Attributes.
      properties:
        description:
          description: Framework Description
          type: string
          example: example_value
        handle:
          description: Framework Handle
          example: sec2
          type: string
        icon_url:
          description: Framework Icon URL
          type: string
          example: https://app.datadoghq.com
        name:
          description: Framework Name
          example: security-framework
          type: string
        requirements:
          description: Framework Requirements
          items:
            $ref: '#/components/schemas/CustomFrameworkRequirement'
          type: array
        version:
          description: Framework Version
          example: '2'
          type: string
      required:
      - handle
      - version
      - name
      - requirements
      type: object
    ExternalUserGroup:
      description: Definition of a group.
      properties:
        displayName:
          description: A human-readable name for the group.
          type: string
          example: Example Monitor
        externalId:
          description: An identifier for the resource as defined by the provisioning client.
          type: string
          example: abc-123-def
        id:
          description: The identifier of the resource. Not required when creating a group.
          type: string
          example: abc-123-def
        members:
          description: Members of the group.
          items:
            $ref: '#/components/schemas/ExternalUserGroupMembersItems'
          type: array
        meta:
          $ref: '#/components/schemas/ExternalUserGroupMeta'
        schemas:
          description: Input JSON Schemas.
          example:
          - urn:ietf:params:scim:schemas:core:2.0:Group
          items:
            type: string
          type: array
      type: object
    CustomDestinationResponseForwardDestinationHttpType:
      default: http
      description: Type of the HTTP destination.
      enum:
      - http
      example: http
      type: string
      x-enum-varnames:
      - HTTP
    ConfluentResourceResponseData:
      description: Confluent Cloud resource data.
      properties:
        attributes:
          $ref: '#/components/schemas/ConfluentResourceResponseAttributes'
        id:
          description: The ID associated with the Confluent resource.
          example: resource_id_abc123
          type: string
        type:
          $ref: '#/components/schemas/ConfluentResourceType'
      required:
      - attributes
      - type
      - id
      type: object
      x-merge-override:
        required: false
    OktaAccountResponse:
      description: Response object for an Okta account.
      properties:
        data:
          $ref: '#/components/schemas/OktaAccount'
      type: object
    LogsMetricResponseComputeAggregationType:
      description: The type of aggregation to use.
      enum:
      - count
      - distribution
      example: distribution
      type: string
      x-enum-varnames:
      - COUNT
      - DISTRIBUTION
    EntityToSchema:
      description: Entity to detail schema relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipItem'
      type: object
    SecurityMonitoringSignalRuleType:
      description: The rule type.
      enum:
      - signal_correlation
      type: string
      x-enum-varnames:
      - SIGNAL_CORRELATION
    CloudWorkloadSecurityAgentRuleUpdateRequest:
      description: Request object that includes the Agent rule with the attributes to update
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateData'
      required:
      - data
      type: object
    RumRetentionFilterUpdateAttributes:
      description: The object describing attributes of a RUM retention filter to update.
      properties:
        enabled:
          $ref: '#/components/schemas/RumRetentionFilterEnabled'
        event_type:
          $ref: '#/components/schemas/RumRetentionFilterEventType'
        name:
          $ref: '#/components/schemas/RunRetentionFilterName'
        query:
          $ref: '#/components/schemas/RumRetentionFilterQuery'
        sample_rate:
          $ref: '#/components/schemas/RumRetentionFilterSampleRate'
      type: object
    IncidentTodoAnonymousAssignee:
      description: Anonymous assignee entity.
      properties:
        icon:
          description: URL for assignee's icon.
          example: https://a.slack-edge.com/80588/img/slackbot_48.png
          type: string
        id:
          description: Anonymous assignee's ID.
          example: USLACKBOT
          type: string
        name:
          description: Assignee's name.
          example: Slackbot
          type: string
        source:
          $ref: '#/components/schemas/IncidentTodoAnonymousAssigneeSource'
      required:
      - id
      - icon
      - name
      - source
      type: object
    UserResourceType:
      default: user
      description: User resource type.
      enum:
      - user
      example: user
      type: string
      x-enum-varnames:
      - USER
    CustomDestinationType:
      default: custom_destination
      description: The type of the resource. The value should always be `custom_destination`.
      enum:
      - custom_destination
      example: custom_destination
      type: string
      x-enum-varnames:
      - CUSTOM_DESTINATION
    PowerpackInnerWidgetLayout:
      description: Powerpack inner widget layout.
      properties:
        height:
          description: The height of the widget. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
        width:
          description: The width of the widget. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
        x:
          description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
        y:
          description: The position of the widget on the y (vertical) axis. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
      required:
      - x
      - y
      - width
      - height
      type: object
    EntityV3APISpec:
      additionalProperties: false
      description: The definition of Entity V3 API Spec object.
      properties:
        implementedBy:
          description: Services which implemented the API.
          items:
            type: string
          type: array
        interface:
          $ref: '#/components/schemas/EntityV3APISpecInterface'
        lifecycle:
          description: The lifecycle state of the component.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the component.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of API.
          type: string
          example: metric alert
      type: object
    IncidentAttachmentData:
      description: A single incident attachment.
      example:
        attributes:
          attachment:
            documentUrl: ''
            title: Postmortem IR-123
          attachment_type: postmortem
        id: 00000000-abcd-0002-0000-000000000000
        relationships:
          last_modified_by_user:
            data:
              id: 00000000-0000-0000-cccc-000000000000
              type: users
        type: incident_attachments
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentAttachmentAttributes'
        id:
          description: A unique identifier that represents the incident attachment.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentAttachmentRelationships'
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - type
      - attributes
      - id
      - relationships
      type: object
    CaseType:
      description: Case type
      enum:
      - STANDARD
      example: STANDARD
      type: string
      x-enum-varnames:
      - STANDARD
    RetryStrategy:
      description: The definition of `RetryStrategy` object.
      properties:
        kind:
          $ref: '#/components/schemas/RetryStrategyKind'
        linear:
          $ref: '#/components/schemas/RetryStrategyLinear'
      required:
      - kind
      type: object
    RetryStrategyKind:
      description: The definition of `RetryStrategyKind` object.
      enum:
      - RETRY_STRATEGY_LINEAR
      example: RETRY_STRATEGY_LINEAR
      type: string
      x-enum-varnames:
      - RETRY_STRATEGY_LINEAR
    MonitorNotificationRuleRelationshipsCreatedByData:
      description: Data for the user who created the monitor notification rule.
      nullable: true
      properties:
        id:
          description: User ID of the monitor notification rule creator.
          example: 00000000-0000-1234-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    SecurityFilterResponse:
      description: Response object which includes a single security filter.
      properties:
        data:
          $ref: '#/components/schemas/SecurityFilter'
        meta:
          $ref: '#/components/schemas/SecurityFilterMeta'
      type: object
    AWSAccountTags:
      description: Tags to apply to all hosts and metrics reporting for this account. Defaults to `[]`.
      items:
        description: Tag in the form `key:value`.
        example: env:prod
        type: string
      nullable: true
      type: array
    ObservabilityPipelineGoogleCloudStorageDestination:
      description: 'The `google_cloud_storage` destination stores logs in a Google Cloud Storage (GCS) bucket.

        It requires a bucket name, GCP authentication, and metadata fields.

        '
      properties:
        acl:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationAcl'
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        bucket:
          description: Name of the GCS bucket.
          example: error-logs
          type: string
        id:
          description: Unique identifier for the destination component.
          example: gcs-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        key_prefix:
          description: Optional prefix for object keys within the GCS bucket.
          type: string
          example: example_value
        metadata:
          description: Custom metadata to attach to each object uploaded to the GCS bucket.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineMetadataEntry'
          type: array
        storage_class:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationStorageClass'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - bucket
      - auth
      - storage_class
      - acl
      type: object
    IncidentTypeUpdateAttributes:
      description: Incident type's attributes for updates.
      properties:
        createdAt:
          description: Timestamp when the incident type was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        createdBy:
          description: A unique identifier that represents the user that created the incident type.
          example: 00000000-0000-0000-0000-000000000000
          readOnly: true
          type: string
        description:
          description: Text that describes the incident type.
          example: 'Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data. Note: This will notify the security team.'
          type: string
        is_default:
          description: When true, this incident type will be used as the default type when an incident type is not specified.
          example: false
          type: boolean
        lastModifiedBy:
          description: A unique identifier that represents the user that last modified the incident type.
          example: 00000000-0000-0000-0000-000000000000
          readOnly: true
          type: string
        modifiedAt:
          description: Timestamp when the incident type was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: The name of the incident type.
          example: Security Incident
          type: string
        prefix:
          description: The string that will be prepended to the incident title across the Datadog app.
          example: IR
          readOnly: true
          type: string
      type: object
    ServiceDefinitionV1Integrations:
      description: Third party integrations that Datadog supports.
      properties:
        pagerduty:
          $ref: '#/components/schemas/ServiceDefinitionV1Pagerduty'
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern:
      description: Defines a custom regex-based pattern for identifying sensitive data in logs.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType'
      required:
      - type
      - options
      type: object
    CloudWorkloadSecurityAgentRuleKill:
      description: Kill system call applied on the container matching the rule
      properties:
        signal:
          description: Supported signals for the kill system call
          type: string
          example: example_value
      type: object
    ConfluentAccountUpdateRequest:
      description: The JSON:API request for updating a Confluent account.
      properties:
        data:
          $ref: '#/components/schemas/ConfluentAccountUpdateRequestData'
      required:
      - data
      type: object
    UpdateActionConnectionRequest:
      description: Request used to update an action connection.
      properties:
        data:
          $ref: '#/components/schemas/ActionConnectionDataUpdate'
      required:
      - data
      type: object
    UserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        created_at:
          description: Creation time of the user.
          format: date-time
          type: string
          example: example_value
        disabled:
          description: Whether the user is disabled.
          type: boolean
          example: true
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        mfa_enabled:
          description: If user has MFA enabled.
          readOnly: true
          type: boolean
          example: true
        modified_at:
          description: Time that the user was last modified.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        service_account:
          description: Whether the user is a service account.
          type: boolean
          example: true
        status:
          description: Status of the user.
          type: string
          example: OK
        title:
          description: Title of the user.
          nullable: true
          type: string
          example: Example Monitor
        verified:
          description: Whether the user is verified.
          type: boolean
          example: true
      type: object
    ApplicationSecurityWafCustomRuleConditionParameters:
      description: The scope of the WAF custom rule.
      properties:
        data:
          description: Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.
          example: blocked_users
          type: string
        inputs:
          description: List of inputs on which at least one should match with the given operator.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput'
          type: array
        list:
          description: 'List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and

            !exact_match operator.'
          items:
            type: string
          type: array
        options:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions'
        regex:
          description: Regex to use with the condition. Only used with match_regex and !match_regex operator.
          example: path.*
          type: string
        value:
          description: Store the captured value in the specified tag name. Only used with the capture_data operator.
          example: custom_tag
          type: string
      required:
      - inputs
      type: object
    SensitiveDataScannerTextReplacementType:
      default: none
      description: 'Type of the replacement text. None means no replacement.

        hash means the data will be stubbed. replacement_string means that

        one can chose a text to replace the data. partial_replacement_from_beginning

        allows a user to partially replace the data from the beginning, and

        partial_replacement_from_end on the other hand, allows to replace data from

        the end.'
      enum:
      - none
      - hash
      - replacement_string
      - partial_replacement_from_beginning
      - partial_replacement_from_end
      type: string
      x-enum-varnames:
      - NONE
      - HASH
      - REPLACEMENT_STRING
      - PARTIAL_REPLACEMENT_FROM_BEGINNING
      - PARTIAL_REPLACEMENT_FROM_END
    IncidentType:
      default: incidents
      description: Incident resource type.
      enum:
      - incidents
      example: incidents
      type: string
      x-enum-varnames:
      - INCIDENTS
    Component:
      description: '[Definition of a UI component in the app](https://docs.datadoghq.com/service_management/app_builder/components/)'
      properties:
        events:
          description: Events to listen for on the UI component.
          items:
            $ref: '#/components/schemas/AppBuilderEvent'
          type: array
        id:
          description: The ID of the UI component. This property is deprecated; use `name` to identify individual components instead.
          nullable: true
          type: string
          example: abc-123-def
        name:
          description: A unique identifier for this UI component. This name is also visible in the app editor.
          example: ''
          type: string
        properties:
          $ref: '#/components/schemas/ComponentProperties'
        type:
          $ref: '#/components/schemas/ComponentType'
      required:
      - name
      - type
      - properties
      type: object
    SpansMetricFilter:
      description: The span-based metric filter. Spans matching this filter will be aggregated in this metric.
      properties:
        query:
          default: '*'
          description: The search query - following the span search syntax.
          example: '@http.status_code:200 service:my-service'
          type: string
      type: object
    EntityV3DatadogIntegrationOpsgenie:
      additionalProperties: false
      description: An Opsgenie integration schema.
      properties:
        region:
          description: The region for the Opsgenie integration.
          minLength: 1
          type: string
          example: example_value
        serviceURL:
          description: The service URL for the Opsgenie integration.
          example: https://www.opsgenie.com/service/shopping-cart
          minLength: 1
          type: string
      required:
      - serviceURL
      type: object
    IncidentIntegrationMetadataResponseData:
      description: Incident integration metadata from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes'
        id:
          description: The incident integration metadata's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentIntegrationRelationships'
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
    InputSchema:
      description: A list of input parameters for the workflow. These can be used as dynamic runtime values in your workflow.
      properties:
        parameters:
          description: The `InputSchema` `parameters`.
          items:
            $ref: '#/components/schemas/InputSchemaParameters'
          type: array
      type: object
    UserTarget:
      description: Represents a user target for an escalation policy step, including the user's ID and resource type.
      properties:
        id:
          description: Specifies the unique identifier of the user resource.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UserTargetType'
      required:
      - type
      - id
      type: object
    SecurityMonitoringSuppressionResponse:
      description: Response object containing a single suppression rule.
      properties:
        data:
          $ref: '#/components/schemas/SecurityMonitoringSuppression'
      type: object
    SecurityFilterMeta:
      description: Optional metadata associated to the response.
      properties:
        warning:
          description: A warning message.
          example: All the security filters are disabled. As a result, no logs are being analyzed.
          type: string
      type: object
    AwsCURConfigPatchRequestAttributes:
      description: Attributes for AWS CUR config Patch Request.
      properties:
        account_filters:
          $ref: '#/components/schemas/AccountFilteringConfig'
        is_enabled:
          description: Whether or not the Cloud Cost Management account is enabled.
          example: true
          type: boolean
      type: object
    RoleAttributes:
      description: Attributes of the role.
      properties:
        created_at:
          description: Creation time of the role.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified_at:
          description: Time of last role modification.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: The name of the role. The name is neither unique nor a stable identifier of the role.
          type: string
          example: Example Monitor
        user_count:
          description: Number of users with that role.
          format: int64
          readOnly: true
          type: integer
          example: 42
      type: object
    LogsArchiveIntegrationAzure:
      description: The Azure archive's integration destination.
      properties:
        client_id:
          description: A client ID.
          example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa
          type: string
        tenant_id:
          description: A tenant ID.
          example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa
          type: string
      required:
      - tenant_id
      - client_id
      type: object
    IncidentUpdateData:
      description: Incident data for an update request.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentUpdateAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-4567-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentUpdateRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
    User:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/UserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/UserResponseRelationships'
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
      x-merge-override:
        required: false
    EntityV3DatastoreKind:
      description: The definition of Entity V3 Datastore Kind object.
      enum:
      - datastore
      example: datastore
      type: string
      x-enum-varnames:
      - DATASTORE
    ObservabilityPipelineSensitiveDataScannerProcessor:
      description: The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log events.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sensitive-scanner
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: source:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        rules:
          description: A list of rules for identifying and acting on sensitive data patterns.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    CaseUpdateStatus:
      description: Case update status
      properties:
        attributes:
          $ref: '#/components/schemas/CaseUpdateStatusAttributes'
        type:
          $ref: '#/components/schemas/CaseResourceType'
      required:
      - attributes
      - type
      type: object
    ObservabilityPipelineDatadogLogsDestinationType:
      default: datadog_logs
      description: The destination type. The value should always be `datadog_logs`.
      enum:
      - datadog_logs
      example: datadog_logs
      type: string
      x-enum-varnames:
      - DATADOG_LOGS
    RelationshipToIncidentAttachment:
      description: A relationship reference for attachments.
      properties:
        data:
          description: An array of incident attachments.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentAttachmentData'
          type: array
      required:
      - data
      type: object
    UserTeamRole:
      description: The user's role within the team
      enum:
      - admin
      nullable: true
      type: string
      x-enum-varnames:
      - ADMIN
    ActionQueryMockedOutputs:
      description: The mocked outputs of the action query. This is useful for testing the app without actually running the action.
      oneOf:
      - type: string
      - $ref: '#/components/schemas/ActionQueryMockedOutputsObject'
    EntityV3Integrations:
      additionalProperties: false
      description: A base schema for defining third-party integrations.
      properties:
        opsgenie:
          $ref: '#/components/schemas/EntityV3DatadogIntegrationOpsgenie'
        pagerduty:
          $ref: '#/components/schemas/EntityV3DatadogIntegrationPagerduty'
      type: object
    Powerpack:
      description: Powerpacks are templated groups of dashboard widgets you can save from an existing dashboard and turn into reusable packs in the widget tray.
      properties:
        data:
          $ref: '#/components/schemas/PowerpackData'
      type: object
    TeamUpdateRequest:
      description: Team update request
      properties:
        data:
          $ref: '#/components/schemas/TeamUpdate'
      required:
      - data
      type: object
    HTTPIntegrationType:
      description: The definition of `HTTPIntegrationType` object.
      enum:
      - HTTP
      example: HTTP
      type: string
      x-enum-varnames:
      - HTTP
    ConfluentAccountResponseData:
      description: An API key and API secret pair that represents a Confluent account.
      properties:
        attributes:
          $ref: '#/components/schemas/ConfluentAccountResponseAttributes'
        id:
          description: A randomly generated ID associated with a Confluent account.
          example: account_id_abc123
          type: string
        type:
          $ref: '#/components/schemas/ConfluentAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    EmailTypeType:
      description: The type of email.
      enum:
      - work
      type: string
      x-enum-varnames:
      - WORK
    ObservabilityPipelineGenerateMetricsProcessor:
      description: 'The `generate_datadog_metrics` processor creates custom metrics from logs and sends them to Datadog.

        Metrics can be counters, gauges, or distributions and optionally grouped by log fields.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline.
          example: generate-metrics-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this processor.
          example:
          - source-id
          items:
            type: string
          type: array
        metrics:
          description: Configuration for generating individual metrics.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetric'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessorType'
      required:
      - id
      - type
      - inputs
      - include
      - metrics
      type: object
    EntityMeta:
      description: Entity metadata.
      properties:
        createdAt:
          description: The creation time.
          type: string
          example: example_value
        ingestionSource:
          description: The ingestion source.
          type: string
          example: example_value
        modifiedAt:
          description: The modification time.
          type: string
          example: example_value
        origin:
          description: The origin.
          type: string
          example: example_value
      type: object
    ScheduleTriggerWrapper:
      description: Schema for a Schedule-based trigger.
      properties:
        scheduleTrigger:
          $ref: '#/components/schemas/ScheduleTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - scheduleTrigger
      type: object
    IncidentResponseData:
      description: Incident data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentResponseAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentResponseRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    PowerpackData:
      description: Powerpack data object.
      properties:
        attributes:
          $ref: '#/components/schemas/PowerpackAttributes'
        id:
          description: ID of the powerpack.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/PowerpackRelationships'
        type:
          description: Type of widget, must be powerpack.
          example: powerpack
          type: string
      type: object
      x-merge-override:
        required: false
    DeploymentRelationshipData:
      description: Data object containing the deployment ID.
      properties:
        id:
          description: The deployment ID.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        type:
          $ref: '#/components/schemas/AppDeploymentType'
      type: object
    IncidentUserDefinedFieldType:
      description: The incident user defined fields type.
      enum:
      - user_defined_field
      example: user_defined_field
      type: string
      x-enum-varnames:
      - USER_DEFINED_FIELD
    MonitorNotificationRuleResourceType:
      default: monitor-notification-rule
      description: Monitor notification rule resource type.
      enum:
      - monitor-notification-rule
      example: monitor-notification-rule
      type: string
      x-enum-varnames:
      - MONITOR_NOTIFICATION_RULE
    OrganizationsType:
      default: orgs
      description: Organizations resource type.
      enum:
      - orgs
      example: orgs
      type: string
      x-enum-varnames:
      - ORGS
    ServiceDefinitionV2OpsgenieRegion:
      description: Opsgenie instance region.
      enum:
      - US
      - EU
      example: US
      type: string
      x-enum-varnames:
      - US
      - EU
    ApplicationSecurityWafCustomRuleConditionOptions:
      description: Options for the operator of this condition.
      properties:
        case_sensitive:
          default: false
          description: Evaluate the value as case sensitive.
          type: boolean
          example: true
        min_length:
          default: 0
          description: Only evaluate this condition if the value has a minimum amount of characters.
          format: int64
          type: integer
          example: 42
      type: object
    CaseTriggerWrapper:
      description: Schema for a Case-based trigger.
      properties:
        caseTrigger:
          $ref: '#/components/schemas/CaseTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - caseTrigger
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection:
      description: Indicates whether to redact characters from the first or last part of the matched value.
      enum:
      - first
      - last
      example: last
      type: string
      x-enum-varnames:
      - FIRST
      - LAST
    EntityResponseIncludedSchema:
      description: Included detail entity schema.
      properties:
        attributes:
          $ref: '#/components/schemas/EntityResponseIncludedSchemaAttributes'
        id:
          description: Entity ID.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/EntityResponseIncludedSchemaType'
      type: object
    UserUpdateData:
      description: Object to update a user.
      properties:
        attributes:
          $ref: '#/components/schemas/UserUpdateAttributes'
        id:
          description: ID of the user.
          example: 00000000-0000-feed-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - attributes
      - type
      - id
      type: object
      x-merge-override:
        required: false
    RumMetricResponseUniqueness:
      description: The rule to count updatable events. Is only set if `event_type` is `session` or `view`.
      properties:
        when:
          $ref: '#/components/schemas/RumMetricUniquenessWhen'
      type: object
    ObservabilityPipelineElasticsearchDestinationApiVersion:
      description: The Elasticsearch API version to use. Set to `auto` to auto-detect.
      enum:
      - auto
      - v6
      - v7
      - v8
      example: auto
      type: string
      x-enum-varnames:
      - AUTO
      - V6
      - V7
      - V8
    ServiceDefinitionV2Contact:
      description: Service owner's contacts information.
      oneOf:
      - $ref: '#/components/schemas/ServiceDefinitionV2Email'
      - $ref: '#/components/schemas/ServiceDefinitionV2Slack'
      - $ref: '#/components/schemas/ServiceDefinitionV2MSTeams'
    WorkflowUserRelationshipType:
      description: The definition of `WorkflowUserRelationshipType` object.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    IncidentTodoPatchRequest:
      description: Patch request for an incident todo.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTodoPatchData'
      required:
      - data
      type: object
    ObservabilityPipelinePipelineKafkaSourceSaslMechanism:
      description: SASL mechanism used for Kafka authentication.
      enum:
      - PLAIN
      - SCRAM-SHA-256
      - SCRAM-SHA-512
      type: string
      x-enum-varnames:
      - PLAIN
      - SCRAMNOT_SHANOT_256
      - SCRAMNOT_SHANOT_512
    DowntimeUpdateRequest:
      description: Request for editing a downtime.
      properties:
        data:
          $ref: '#/components/schemas/DowntimeUpdateRequestData'
      required:
      - data
      type: object
    RelationshipToOrganizationData:
      description: Relationship to organization object.
      properties:
        id:
          description: ID of the organization.
          example: 00000000-0000-beef-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/OrganizationsType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern:
      description: Specifies a pattern from Datadog’s sensitive data detection library to match known sensitive data types.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType'
      required:
      - type
      - options
      type: object
    DashboardTriggerWrapper:
      description: Schema for a Dashboard-based trigger.
      properties:
        dashboardTrigger:
          description: Trigger a workflow from a Dashboard.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - dashboardTrigger
      type: object
    XRayServicesIncludeOnly:
      description: Include only these services. Defaults to `[]`.
      nullable: true
      properties:
        include_only:
          description: Include only these services.
          example:
          - AWS/AppSync
          items:
            example: AWS/AppSync
            type: string
          type: array
      required:
      - include_only
      type: object
    OrgConfigGetResponse:
      description: A response with a single Org Config.
      properties:
        data:
          $ref: '#/components/schemas/OrgConfigRead'
      required:
      - data
      type: object
    PowerpackGroupWidget:
      description: Powerpack group widget definition object.
      properties:
        definition:
          $ref: '#/components/schemas/PowerpackGroupWidgetDefinition'
        layout:
          $ref: '#/components/schemas/PowerpackGroupWidgetLayout'
        live_span:
          $ref: '#/components/schemas/WidgetLiveSpan'
      required:
      - definition
      type: object
    CustomDestinationResponseAttributes:
      description: The attributes associated with the custom destination.
      properties:
        enabled:
          default: true
          description: Whether logs matching this custom destination should be forwarded or not.
          example: true
          type: boolean
        forward_tags:
          default: true
          description: Whether tags from the forwarded logs should be forwarded or not.
          example: true
          type: boolean
        forward_tags_restriction_list:
          default: []
          description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered.


            An empty list represents no restriction is in place and either all or no tags will be

            forwarded depending on `forward_tags_restriction_list_type` parameter.'
          example:
          - datacenter
          - host
          items:
            description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags).
            type: string
          maxItems: 10
          minItems: 0
          type: array
        forward_tags_restriction_list_type:
          $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType'
        forwarder_destination:
          $ref: '#/components/schemas/CustomDestinationResponseForwardDestination'
        name:
          description: The custom destination name.
          example: Nginx logs
          type: string
        query:
          default: ''
          description: The custom destination query filter. Logs matching this query are forwarded to the destination.
          example: source:nginx
          type: string
      type: object
    SecurityFilterFilteredDataType:
      description: The filtered data type.
      enum:
      - logs
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
    OpsgenieServiceRegionType:
      description: The region for the Opsgenie service.
      enum:
      - us
      - eu
      - custom
      example: us
      type: string
      x-enum-varnames:
      - US
      - EU
      - CUSTOM
    CustomDestinationResponseForwardDestinationSplunkType:
      default: splunk_hec
      description: Type of the Splunk HTTP Event Collector (HEC) destination.
      enum:
      - splunk_hec
      example: splunk_hec
      type: string
      x-enum-varnames:
      - SPLUNK_HEC
    ProjectResourceType:
      default: project
      description: Project resource type
      enum:
      - project
      example: project
      type: string
      x-enum-varnames:
      - PROJECT
    RUMApplicationAttributes:
      description: RUM application attributes.
      properties:
        application_id:
          description: ID of the RUM application.
          example: abcd1234-0000-0000-abcd-1234abcd5678
          type: string
          x-merge-override:
            format: false
        client_token:
          description: Client token of the RUM application.
          example: abcd1234efgh5678ijkl90abcd1234efgh0
          type: string
        created_at:
          description: Timestamp in ms of the creation date.
          example: 1659479836169
          format: int64
          type: integer
        created_by_handle:
          description: Handle of the creator user.
          example: john.doe
          type: string
        hash:
          description: Hash of the RUM application. Optional.
          type: string
          example: example_value
        is_active:
          description: Indicates if the RUM application is active.
          example: true
          type: boolean
        name:
          description: Name of the RUM application.
          example: my_rum_application
          type: string
        org_id:
          description: Org ID of the RUM application.
          example: 999
          format: int32
          maximum: 2147483647
          type: integer
        type:
          description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`.
          example: browser
          type: string
        updated_at:
          description: Timestamp in ms of the last update date.
          example: 1659479836169
          format: int64
          type: integer
        updated_by_handle:
          description: Handle of the updater user.
          example: jane.doe
          type: string
      required:
      - application_id
      - client_token
      - created_at
      - created_by_handle
      - name
      - org_id
      - type
      - updated_at
      - updated_by_handle
      type: object
    ObservabilityPipelineGooglePubSubSource:
      description: The `google_pubsub` source ingests logs from a Google Cloud Pub/Sub subscription.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: google-pubsub-source
          type: string
        project:
          description: The GCP project ID that owns the Pub/Sub subscription.
          example: my-gcp-project
          type: string
        subscription:
          description: The Pub/Sub subscription name from which messages are consumed.
          example: logs-subscription
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSourceType'
      required:
      - id
      - type
      - auth
      - decoding
      - project
      - subscription
      type: object
    OpsgenieServiceUpdateRequest:
      description: Update request for an Opsgenie service.
      properties:
        data:
          $ref: '#/components/schemas/OpsgenieServiceUpdateData'
      required:
      - data
      type: object
    RoleUpdateResponse:
      description: Response containing information about an updated role.
      properties:
        data:
          $ref: '#/components/schemas/RoleUpdateResponseData'
      type: object
    PowerpackGroupWidgetLayout:
      description: Powerpack group widget layout.
      properties:
        height:
          description: The height of the widget. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
        width:
          description: The width of the widget. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
        x:
          description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
        y:
          description: The position of the widget on the y (vertical) axis. Should be a non-negative integer.
          example: 0
          format: int64
          minimum: 0
          type: integer
      required:
      - x
      - y
      - width
      - height
      type: object
    OpsgenieServiceUpdateData:
      description: Opsgenie service for an update request.
      properties:
        attributes:
          $ref: '#/components/schemas/OpsgenieServiceUpdateAttributes'
        id:
          description: The ID of the Opsgenie service.
          example: 596da4af-0563-4097-90ff-07230c3f9db3
          maxLength: 100
          minLength: 1
          type: string
        type:
          $ref: '#/components/schemas/OpsgenieServiceType'
      required:
      - id
      - type
      - attributes
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineOcsfMapperProcessorType:
      default: ocsf_mapper
      description: The processor type. The value should always be `ocsf_mapper`.
      enum:
      - ocsf_mapper
      example: ocsf_mapper
      type: string
      x-enum-varnames:
      - OCSF_MAPPER
    IncidentAttachmentsPostmortemAttributesAttachmentObject:
      description: The postmortem attachment.
      properties:
        documentUrl:
          description: The URL of this notebook attachment.
          example: https://app.datadoghq.com/notebook/123
          type: string
        title:
          description: The title of this postmortem attachment.
          example: Postmortem IR-123
          type: string
      required:
      - documentUrl
      - title
      type: object
    ObservabilityPipelineKafkaSourceLibrdkafkaOption:
      description: Represents a key-value pair used to configure low-level `librdkafka` client options for Kafka sources, such as timeouts, buffer sizes, and security settings.
      properties:
        name:
          description: The name of the `librdkafka` configuration option to set.
          example: fetch.message.max.bytes
          type: string
        value:
          description: The value assigned to the specified `librdkafka` configuration option.
          example: '1048576'
          type: string
      required:
      - name
      - value
      type: object
    LayerRelationships:
      description: Holds references to objects related to the Layer entity, such as its members.
      properties:
        members:
          $ref: '#/components/schemas/LayerRelationshipsMembers'
      type: object
    DowntimeNotifyEndStateTypes:
      description: State that will trigger a monitor notification when the `notify_end_types` action occurs.
      enum:
      - alert
      - no data
      - warn
      example: alert
      type: string
      x-enum-varnames:
      - ALERT
      - NO_DATA
      - WARN
    DowntimeScheduleRecurrencesResponse:
      description: A recurring downtime schedule definition.
      properties:
        current_downtime:
          $ref: '#/components/schemas/DowntimeScheduleCurrentDowntimeResponse'
        recurrences:
          description: A list of downtime recurrences.
          items:
            $ref: '#/components/schemas/DowntimeScheduleRecurrenceResponse'
          maxItems: 5
          minItems: 1
          type: array
        timezone:
          default: UTC
          description: 'The timezone in which to schedule the downtime. This affects recurring start and end dates.

            Must match `display_timezone`.'
          example: America/New_York
          type: string
      required:
      - recurrences
      type: object
    SpansMetricResponse:
      description: The span-based metric object.
      properties:
        data:
          $ref: '#/components/schemas/SpansMetricResponseData'
      type: object
    UserTeamUpdateRequest:
      description: Team membership request
      properties:
        data:
          $ref: '#/components/schemas/UserTeamUpdate'
      required:
      - data
      type: object
    UpdateAppRequestData:
      description: The data object containing the new app definition. Any fields not included in the request remain unchanged.
      properties:
        attributes:
          $ref: '#/components/schemas/UpdateAppRequestDataAttributes'
        id:
          description: The ID of the app to update. The app ID must match the ID in the URL path.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
        type:
          $ref: '#/components/schemas/AppDefinitionType'
      required:
      - type
      type: object
    ExternalUserEmailType:
      description: Email address for the user.
      properties:
        primary:
          description: Boolean indicating if this email is the primary email address.
          type: boolean
          example: true
        type:
          $ref: '#/components/schemas/EmailTypeType'
        value:
          description: Email addresses for the user.
          type: string
          example: example_value
      type: object
    TagFilter:
      description: Tag filter for the budget's entries.
      properties:
        tag_key:
          description: The key of the tag.
          example: service
          type: string
        tag_value:
          description: The value of the tag.
          example: ec2
          type: string
      type: object
    UpsertCatalogEntityResponse:
      description: Upsert entity response.
      properties:
        data:
          $ref: '#/components/schemas/EntityResponseData'
        included:
          $ref: '#/components/schemas/UpsertCatalogEntityResponseIncluded'
        meta:
          $ref: '#/components/schemas/EntityResponseMeta'
      type: object
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    RUMApplicationUpdate:
      description: RUM application update.
      properties:
        attributes:
          $ref: '#/components/schemas/RUMApplicationUpdateAttributes'
        id:
          description: RUM application ID.
          example: abcd1234-0000-0000-abcd-1234abcd5678
          type: string
          x-merge-override:
            format: false
        type:
          $ref: '#/components/schemas/RUMApplicationUpdateType'
      required:
      - id
      - type
      type: object
    UserTeamRelationships:
      description: Relationship between membership and a user
      properties:
        team:
          $ref: '#/components/schemas/RelationshipToUserTeamTeam'
        user:
          $ref: '#/components/schemas/RelationshipToUserTeamUser'
      type: object
    ObservabilityPipelineRenameFieldsProcessorType:
      default: rename_fields
      description: The processor type. The value should always be `rename_fields`.
      enum:
      - rename_fields
      example: rename_fields
      type: string
      x-enum-varnames:
      - RENAME_FIELDS
    ObservabilityPipelineHttpClientSourceType:
      default: http_client
      description: The source type. The value should always be `http_client`.
      enum:
      - http_client
      example: http_client
      type: string
      x-enum-varnames:
      - HTTP_CLIENT
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    CaseTrigger:
      description: Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentNotificationHandle:
      description: A notification handle that will be notified at incident creation.
      properties:
        display_name:
          description: The name of the notified handle.
          example: Jane Doe
          type: string
        handle:
          description: The handle used for the notification. This includes an email address, Slack channel, or workflow.
          example: '@test.user@test.com'
          type: string
      type: object
    CustomDestinationForwardDestinationHttpType:
      default: http
      description: Type of the HTTP destination.
      enum:
      - http
      example: http
      type: string
      x-enum-varnames:
      - HTTP
    ActionQueryType:
      default: action
      description: The action query type.
      enum:
      - action
      example: action
      type: string
      x-enum-varnames:
      - ACTION
    ScheduleDataRelationshipsLayersDataItems:
      description: Relates a layer to this schedule, identified by `id` and `type` (must be `layers`).
      properties:
        id:
          description: The unique identifier of the layer in this relationship.
          example: 00000000-0000-0000-0000-000000000001
          type: string
        type:
          $ref: '#/components/schemas/ScheduleDataRelationshipsLayersDataItemsType'
      required:
      - type
      - id
      type: object
    MicrosoftTeamsUpdateTenantBasedHandleRequestData:
      description: Tenant-based handle data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleAttributes'
        type:
          $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleType'
      required:
      - type
      - attributes
      type: object
      x-merge-override:
        required: false
    ApplicationSecurityWafExclusionFilterOnMatch:
      description: The action taken when the exclusion filter matches. When set to `monitor`, security traces are emitted but the requests are not blocked. By default, security traces are not emitted and the requests are not blocked.
      enum:
      - monitor
      type: string
      x-enum-varnames:
      - MONITOR
    ServiceDefinitionV2Link:
      description: Service's external links.
      properties:
        name:
          description: Link name.
          example: Runbook
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2LinkType'
        url:
          description: Link URL.
          example: https://my-runbook
          type: string
      required:
      - name
      - type
      - url
      type: object
    ScheduleDataRelationshipsLayersDataItemsType:
      default: layers
      description: Layers resource type.
      enum:
      - layers
      example: layers
      type: string
      x-enum-varnames:
      - LAYERS
    RelationshipToPermissionData:
      description: Relationship to permission object.
      properties:
        id:
          description: ID of the permission.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/PermissionsType'
      type: object
      x-merge-override:
        required: false
    AwsCURConfig:
      description: AWS CUR config.
      properties:
        attributes:
          $ref: '#/components/schemas/AwsCURConfigAttributes'
        id:
          description: The ID of the AWS CUR config.
          format: int64
          type: integer
          example: 42
        type:
          $ref: '#/components/schemas/AwsCURConfigType'
      required:
      - attributes
      - type
      type: object
      x-merge-override:
        required: false
    SpansFilterCreate:
      description: The spans filter. Spans matching this filter will be indexed and stored.
      properties:
        query:
          description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/).
          example: '@http.status_code:200 service:my-service'
          type: string
      required:
      - query
      type: object
    IPAllowlistEntry:
      description: IP allowlist entry object.
      properties:
        data:
          $ref: '#/components/schemas/IPAllowlistEntryData'
      required:
      - data
      type: object
    CloudWorkloadSecurityAgentRuleAction:
      description: The action the rule can perform if triggered
      properties:
        filter:
          description: SECL expression used to target the container to apply the action on
          type: string
          example: example_value
        kill:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
        metadata:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
        set:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
      type: object
    HTTPTokenAuthUpdate:
      description: The definition of `HTTPTokenAuthUpdate` object.
      properties:
        body:
          $ref: '#/components/schemas/HTTPBody'
        headers:
          description: The `HTTPTokenAuthUpdate` `headers`.
          items:
            $ref: '#/components/schemas/HTTPHeaderUpdate'
          type: array
        tokens:
          description: The `HTTPTokenAuthUpdate` `tokens`.
          items:
            $ref: '#/components/schemas/HTTPTokenUpdate'
          type: array
        type:
          $ref: '#/components/schemas/HTTPTokenAuthType'
        url_parameters:
          description: The `HTTPTokenAuthUpdate` `url_parameters`.
          items:
            $ref: '#/components/schemas/UrlParamUpdate'
          type: array
      required:
      - type
      type: object
    AppBuilderEventType:
      description: The response to the event.
      enum:
      - custom
      - setComponentState
      - triggerQuery
      - openModal
      - closeModal
      - openUrl
      - downloadFile
      - setStateVariableValue
      example: triggerQuery
      type: string
      x-enum-varnames:
      - CUSTOM
      - SETCOMPONENTSTATE
      - TRIGGERQUERY
      - OPENMODAL
      - CLOSEMODAL
      - OPENURL
      - DOWNLOADFILE
      - SETSTATEVARIABLEVALUE
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    TeamLinkCreate:
      description: Team link create
      properties:
        attributes:
          $ref: '#/components/schemas/TeamLinkAttributes'
        type:
          $ref: '#/components/schemas/TeamLinkType'
      required:
      - attributes
      - type
      type: object
    TeamUpdateAttributes:
      description: Team update attributes
      properties:
        avatar:
          description: Unicode representation of the avatar for the team, limited to a single grapheme
          example: 🥑
          nullable: true
          type: string
        banner:
          description: Banner selection for the team
          format: int64
          nullable: true
          type: integer
          example: 42
        description:
          description: Free-form markdown description/content for the team's homepage
          type: string
          example: example_value
        handle:
          description: The team's identifier
          example: example-team
          maxLength: 195
          type: string
        hidden_modules:
          description: Collection of hidden modules for the team
          items:
            description: String identifier of the module
            type: string
          type: array
        name:
          description: The name of the team
          example: Example Team
          maxLength: 200
          type: string
        visible_modules:
          description: Collection of visible modules for the team
          items:
            description: String identifier of the module
            type: string
          type: array
      required:
      - handle
      - name
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget:
      description: Applies the rule only to included fields.
      enum:
      - include
      example: include
      type: string
      x-enum-varnames:
      - INCLUDE
    RoleRelationships:
      description: Relationships of the role object.
      properties:
        permissions:
          $ref: '#/components/schemas/RelationshipToPermissions'
      type: object
    ConfluentResourceRequestData:
      description: JSON:API request for updating a Confluent resource.
      properties:
        attributes:
          $ref: '#/components/schemas/ConfluentResourceRequestAttributes'
        id:
          description: The ID associated with a Confluent resource.
          example: resource-id-123
          type: string
        type:
          $ref: '#/components/schemas/ConfluentResourceType'
      required:
      - attributes
      - type
      - id
      type: object
      x-merge-override:
        required: false
    JiraIntegrationMetadata:
      description: Incident integration metadata for the Jira integration.
      properties:
        issues:
          description: Array of Jira issues in this integration metadata.
          example: []
          items:
            $ref: '#/components/schemas/JiraIntegrationMetadataIssuesItem'
          type: array
      required:
      - issues
      type: object
    ObservabilityPipelineFilterProcessor:
      description: The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: filter-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFilterProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      type: object
    DeploymentMetadata:
      description: Metadata object containing the publication creation information.
      properties:
        created_at:
          description: Timestamp of when the app was published.
          format: date-time
          type: string
          example: example_value
        user_id:
          description: The ID of the user who published the app.
          format: int64
          type: integer
          example: 42
        user_name:
          description: The name (or email address) of the user who published the app.
          type: string
          example: Example Monitor
        user_uuid:
          description: The UUID of the user who published the app.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          format: uuid
          type: string
      type: object
    TeamPermissionSetting:
      description: Team permission setting
      properties:
        attributes:
          $ref: '#/components/schemas/TeamPermissionSettingAttributes'
        id:
          description: The team permission setting's identifier
          example: TeamPermission-aeadc05e-98a8-11ec-ac2c-da7ad0900001-edit
          type: string
        type:
          $ref: '#/components/schemas/TeamPermissionSettingType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    EscalationPolicyStepTarget:
      description: Defines a single escalation target within a step for an escalation policy creation request. Contains `id` and `type`.
      properties:
        id:
          description: Specifies the unique identifier for this target.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/EscalationPolicyStepTargetType'
      type: object
    IncidentTypeAttributes:
      description: Incident type's attributes.
      properties:
        createdAt:
          description: Timestamp when the incident type was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        createdBy:
          description: A unique identifier that represents the user that created the incident type.
          example: 00000000-0000-0000-0000-000000000000
          readOnly: true
          type: string
        description:
          description: Text that describes the incident type.
          example: Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data.
          type: string
        is_default:
          default: false
          description: If true, this incident type will be used as the default incident type if a type is not specified during the creation of incident resources.
          example: false
          type: boolean
        lastModifiedBy:
          description: A unique identifier that represents the user that last modified the incident type.
          example: 00000000-0000-0000-0000-000000000000
          readOnly: true
          type: string
        modifiedAt:
          description: Timestamp when the incident type was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: The name of the incident type.
          example: Security Incident
          type: string
        prefix:
          description: The string that will be prepended to the incident title across the Datadog app.
          example: IR
          readOnly: true
          type: string
      required:
      - name
      type: object
    ObservabilityPipelineParseGrokProcessor:
      description: The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns.
      properties:
        disable_library_rules:
          default: false
          description: If set to `true`, disables the default Grok rules provided by Datadog.
          example: true
          type: boolean
        id:
          description: A unique identifier for this processor.
          example: parse-grok-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        rules:
          description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    ObservabilityPipelineSumoLogicDestinationType:
      default: sumo_logic
      description: The destination type. The value should always be `sumo_logic`.
      enum:
      - sumo_logic
      example: sumo_logic
      type: string
      x-enum-varnames:
      - SUMO_LOGIC
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    ServiceDefinitionDataAttributes:
      description: Service definition attributes.
      properties:
        meta:
          $ref: '#/components/schemas/ServiceDefinitionMeta'
        schema:
          $ref: '#/components/schemas/ServiceDefinitionSchema'
      type: object
    DowntimeScheduleRecurrenceResponse:
      description: An RRULE-based recurring downtime.
      properties:
        duration:
          $ref: '#/components/schemas/DowntimeScheduleRecurrenceDuration'
        rrule:
          $ref: '#/components/schemas/DowntimeScheduleRecurrenceRrule'
        start:
          description: 'ISO-8601 Datetime to start the downtime. Must not include a UTC offset. If not provided, the

            downtime starts the moment it is created.'
          example: 2020-01-02T03:04
          type: string
      type: object
    ProjectRelationshipData:
      description: Relationship to project object
      properties:
        id:
          description: A unique identifier that represents the project
          example: e555e290-ed65-49bd-ae18-8acbfcf18db7
          type: string
        type:
          $ref: '#/components/schemas/ProjectResourceType'
      required:
      - id
      - type
      type: object
    IncidentResponse:
      description: Response with an incident.
      properties:
        data:
          $ref: '#/components/schemas/IncidentResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentResponseIncludedItem'
          readOnly: true
          type: array
      required:
      - data
      type: object
    RUMApplicationType:
      default: rum_application
      description: RUM application response type.
      enum:
      - rum_application
      example: rum_application
      type: string
      x-enum-varnames:
      - RUM_APPLICATION
    ObservabilityPipelineElasticsearchDestinationType:
      default: elasticsearch
      description: The destination type. The value should always be `elasticsearch`.
      enum:
      - elasticsearch
      example: elasticsearch
      type: string
      x-enum-varnames:
      - ELASTICSEARCH
    RumRetentionFilterType:
      default: retention_filters
      description: The type of the resource. The value should always be retention_filters.
      enum:
      - retention_filters
      example: retention_filters
      type: string
      x-enum-varnames:
      - RETENTION_FILTERS
    ObservabilityPipelineSplunkHecSource:
      description: 'The `splunk_hec` source implements the Splunk HTTP Event Collector (HEC) API.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-hec-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineAmazonS3SourceType:
      default: amazon_s3
      description: The source type. Always `amazon_s3`.
      enum:
      - amazon_s3
      example: amazon_s3
      type: string
      x-enum-varnames:
      - AMAZON_S3
    IncidentTodoAttributes:
      description: Incident todo's attributes.
      properties:
        assignees:
          $ref: '#/components/schemas/IncidentTodoAssigneeArray'
        completed:
          description: Timestamp when the todo was completed.
          example: '2023-03-06T22:00:00.000000+00:00'
          nullable: true
          type: string
        content:
          description: The follow-up task's content.
          example: Restore lost data.
          type: string
        created:
          description: Timestamp when the incident todo was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        due_date:
          description: Timestamp when the todo should be completed by.
          example: '2023-07-10T05:00:00.000000+00:00'
          nullable: true
          type: string
        incident_id:
          description: UUID of the incident this todo is connected to.
          example: 00000000-aaaa-0000-0000-000000000000
          type: string
        modified:
          description: Timestamp when the incident todo was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - content
      - assignees
      type: object
    RumMetricEventType:
      description: The type of RUM events to filter on.
      enum:
      - session
      - view
      - action
      - error
      - resource
      - long_task
      - vital
      example: session
      type: string
      x-enum-varnames:
      - SESSION
      - VIEW
      - ACTION
      - ERROR
      - RESOURCE
      - LONG_TASK
      - VITAL
    TeamResponse:
      description: Response with a team
      properties:
        data:
          $ref: '#/components/schemas/Team'
      type: object
    CloudConfigurationRuleComplianceSignalOptions:
      description: How to generate compliance signals. Useful for cloud_configuration rules only.
      properties:
        defaultActivationStatus:
          description: The default activation status.
          nullable: true
          type: boolean
          example: true
        defaultGroupByFields:
          description: The default group by fields.
          items:
            type: string
          nullable: true
          type: array
        userActivationStatus:
          description: Whether signals will be sent.
          nullable: true
          type: boolean
          example: true
        userGroupByFields:
          description: Fields to use to group findings by when sending signals.
          items:
            type: string
          nullable: true
          type: array
      type: object
    DowntimeRelationships:
      description: All relationships associated with downtime.
      properties:
        created_by:
          $ref: '#/components/schemas/DowntimeRelationshipsCreatedBy'
        monitor:
          $ref: '#/components/schemas/DowntimeRelationshipsMonitor'
      type: object
    CustomDestinationForwardDestinationSplunkType:
      default: splunk_hec
      description: Type of the Splunk HTTP Event Collector (HEC) destination.
      enum:
      - splunk_hec
      example: splunk_hec
      type: string
      x-enum-varnames:
      - SPLUNK_HEC
    StateVariableProperties:
      description: The properties of the state variable.
      properties:
        defaultValue:
          description: The default value of the state variable.
          example: ${['order_3145', 'order_4920']}
      type: object
    LogsArchiveDestinationGCS:
      description: The GCS archive destination.
      properties:
        bucket:
          description: The bucket where the archive will be stored.
          example: bucket-name
          type: string
        integration:
          $ref: '#/components/schemas/LogsArchiveIntegrationGCS'
        path:
          description: The archive path.
          type: string
          example: example_value
        type:
          $ref: '#/components/schemas/LogsArchiveDestinationGCSType'
      required:
      - bucket
      - integration
      - type
      type: object
    ObservabilityPipelineThrottleProcessor:
      description: The `throttle` processor limits the number of events that pass through over a given time window.
      properties:
        group_by:
          description: Optional list of fields used to group events before the threshold has been reached.
          example:
          - log.user.id
          items:
            type: string
          type: array
        id:
          description: The unique identifier for this processor.
          example: throttle-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: env:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the input for this processor.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        threshold:
          description: the number of events allowed in a given time window. Events sent after the threshold has been reached, are dropped.
          example: 1000
          format: int64
          type: integer
        type:
          $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessorType'
        window:
          description: The time window in seconds over which the threshold applies.
          example: 60
          format: double
          type: number
      required:
      - id
      - type
      - include
      - inputs
      - threshold
      - window
      type: object
    RumRetentionFilterEnabled:
      description: Whether the retention filter is enabled.
      example: true
      type: boolean
    IncidentTodoType:
      default: incident_todos
      description: Todo resource type.
      enum:
      - incident_todos
      example: incident_todos
      type: string
      x-enum-varnames:
      - INCIDENT_TODOS
    NullableUserRelationship:
      description: Relationship to user.
      nullable: true
      properties:
        data:
          $ref: '#/components/schemas/NullableUserRelationshipData'
      required:
      - data
      type: object
    LogsMetricResponseData:
      description: The log-based metric properties.
      properties:
        attributes:
          $ref: '#/components/schemas/LogsMetricResponseAttributes'
        id:
          $ref: '#/components/schemas/LogsMetricID'
        type:
          $ref: '#/components/schemas/LogsMetricType'
      type: object
    UpsertCatalogEntityResponseIncludedItem:
      description: Upsert entity response included item.
      oneOf:
      - $ref: '#/components/schemas/EntityResponseIncludedSchema'
    ObservabilityPipelineQuotaProcessorOverflowAction:
      description: 'The action to take when the quota is exceeded. Options:

        - `drop`: Drop the event.

        - `no_action`: Let the event pass through.

        - `overflow_routing`: Route to an overflow destination.

        '
      enum:
      - drop
      - no_action
      - overflow_routing
      example: drop
      type: string
      x-enum-varnames:
      - DROP
      - NO_ACTION
      - OVERFLOW_ROUTING
    CloudWorkloadSecurityAgentPolicyAttributes:
      description: A Cloud Workload Security Agent policy returned by the API
      properties:
        blockingRulesCount:
          description: The number of rules with the blocking feature in this policy
          example: 100
          format: int32
          maximum: 2147483647
          type: integer
        datadogManaged:
          description: Whether the policy is managed by Datadog
          example: false
          type: boolean
        description:
          description: The description of the policy
          example: My agent policy
          type: string
        disabledRulesCount:
          description: The number of rules that are disabled in this policy
          example: 100
          format: int32
          maximum: 2147483647
          type: integer
        enabled:
          description: Whether the Agent policy is enabled
          example: true
          type: boolean
        hostTags:
          description: The host tags defining where this policy is deployed
          items:
            type: string
          type: array
        hostTagsLists:
          description: The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
          items:
            items:
              type: string
            type: array
          type: array
        monitoringRulesCount:
          description: The number of rules in the monitoring state in this policy
          example: 100
          format: int32
          maximum: 2147483647
          type: integer
        name:
          description: The name of the policy
          example: my_agent_policy
          type: string
        policyVersion:
          description: The version of the policy
          example: '1'
          type: string
        priority:
          description: The priority of the policy
          example: 10
          format: int64
          type: integer
        ruleCount:
          description: The number of rules in this policy
          example: 100
          format: int32
          maximum: 2147483647
          type: integer
        updateDate:
          description: Timestamp in milliseconds when the policy was last updated
          example: 1624366480320
          format: int64
          type: integer
        updatedAt:
          description: When the policy was last updated, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        updater:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdaterAttributes'
      type: object
    ObservabilityPipelineSplunkHecSourceType:
      default: splunk_hec
      description: The source type. Always `splunk_hec`.
      enum:
      - splunk_hec
      example: splunk_hec
      type: string
      x-enum-varnames:
      - SPLUNK_HEC
    LogsMetricType:
      default: logs_metrics
      description: The type of the resource. The value should always be logs_metrics.
      enum:
      - logs_metrics
      example: logs_metrics
      type: string
      x-enum-varnames:
      - LOGS_METRICS
    EntityV3Metadata:
      additionalProperties: false
      description: The definition of Entity V3 Metadata object.
      properties:
        additionalOwners:
          additionalProperties: false
          description: The additional owners of the entity, usually a team.
          items:
            $ref: '#/components/schemas/EntityV3MetadataAdditionalOwnersItems'
          type: array
        contacts:
          additionalProperties: false
          description: A list of contacts for the entity.
          items:
            $ref: '#/components/schemas/EntityV3MetadataContactsItems'
          type: array
        description:
          description: Short description of the entity. The UI can leverage the description for display.
          type: string
          example: example_value
        displayName:
          description: User friendly name of the entity. The UI can leverage the display name for display.
          type: string
          example: Example Monitor
        id:
          description: A read-only globally unique identifier for the entity generated by Datadog.  User supplied values are ignored.
          example: 4b163705-23c0-4573-b2fb-f6cea2163fcb
          minLength: 1
          type: string
        inheritFrom:
          description: The entity reference from which to inherit metadata
          example: application:default/myapp
          type: string
        links:
          additionalProperties: false
          description: A list of links for the entity.
          items:
            $ref: '#/components/schemas/EntityV3MetadataLinksItems'
          type: array
        managed:
          additionalProperties: {}
          description: A read-only set of Datadog managed attributes generated by Datadog.  User supplied values are ignored.
          type: object
        name:
          description: Unique name given to an entity under the kind/namespace.
          example: myService
          minLength: 1
          type: string
        namespace:
          description: Namespace is a part of unique identifier. It has a default value of 'default'.
          example: default
          minLength: 1
          type: string
        owner:
          description: The owner of the entity, usually a team.
          type: string
          example: example_value
        tags:
          description: A set of custom tags.
          example:
          - this:tag
          - that:tag
          items:
            type: string
          type: array
      required:
      - name
      type: object
    Step:
      description: A Step is a sub-component of a workflow. Each Step performs an action.
      properties:
        actionId:
          description: The unique identifier of an action.
          example: ''
          type: string
        completionGate:
          $ref: '#/components/schemas/CompletionGate'
        connectionLabel:
          description: The unique identifier of a connection defined in the spec.
          type: string
          example: example_value
        display:
          $ref: '#/components/schemas/StepDisplay'
        errorHandlers:
          description: The `Step` `errorHandlers`.
          items:
            $ref: '#/components/schemas/ErrorHandler'
          type: array
        name:
          description: Name of the step.
          example: ''
          type: string
        outboundEdges:
          description: A list of subsequent actions to run.
          items:
            $ref: '#/components/schemas/OutboundEdge'
          type: array
        parameters:
          description: A list of inputs for an action.
          items:
            $ref: '#/components/schemas/Parameter'
          type: array
        readinessGate:
          $ref: '#/components/schemas/ReadinessGate'
      required:
      - name
      - actionId
      type: object
    ScheduleTrigger:
      description: Trigger a workflow from a Schedule. The workflow must be published.
      properties:
        rruleExpression:
          description: Recurrence rule expression for scheduling.
          example: ''
          type: string
      required:
      - rruleExpression
      type: object
    MicrosoftTeamsUpdateWorkflowsWebhookHandleRequest:
      description: Update Workflows webhook handle request.
      properties:
        data:
          $ref: '#/components/schemas/MicrosoftTeamsUpdateWorkflowsWebhookHandleRequestData'
      required:
      - data
      type: object
    SensitiveDataScannerGroupUpdateResponse:
      description: Update group response.
      properties:
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      type: object
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    ObservabilityPipelineLogstashSourceType:
      default: logstash
      description: The source type. The value should always be `logstash`.
      enum:
      - logstash
      example: logstash
      type: string
      x-enum-varnames:
      - LOGSTASH
    SecurityFilterUpdateData:
      description: The new security filter properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityFilterUpdateAttributes'
        type:
          $ref: '#/components/schemas/SecurityFilterType'
      required:
      - type
      - attributes
      type: object
    RelationshipToUserTeamPermission:
      description: Relationship between a user team permission and a team
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToUserTeamPermissionData'
        links:
          $ref: '#/components/schemas/TeamRelationshipsLinks'
      type: object
      x-merge-override:
        required: false
    FastlyAccountResponse:
      description: The expected response schema when getting a Fastly account.
      properties:
        data:
          $ref: '#/components/schemas/FastlyAccountResponseData'
      type: object
    IncidentResponseRelationships:
      description: The incident's relationships from a response.
      properties:
        attachments:
          $ref: '#/components/schemas/RelationshipToIncidentAttachment'
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        impacts:
          $ref: '#/components/schemas/RelationshipToIncidentImpacts'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        responders:
          $ref: '#/components/schemas/RelationshipToIncidentResponders'
        user_defined_fields:
          $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields'
      type: object
    RestrictionPolicyUpdateRequest:
      description: Update request for a restriction policy.
      properties:
        data:
          $ref: '#/components/schemas/RestrictionPolicy'
      required:
      - data
      type: object
    CustomDestinationAttributeTagsRestrictionListType:
      default: ALLOW_LIST
      description: 'How `forward_tags_restriction_list` parameter should be interpreted.

        If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list

        are forwarded.


        `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list.'
      enum:
      - ALLOW_LIST
      - BLOCK_LIST
      example: ALLOW_LIST
      type: string
      x-enum-varnames:
      - ALLOW_LIST
      - BLOCK_LIST
    ServiceDefinitionV2EmailType:
      description: Contact type.
      enum:
      - email
      example: email
      type: string
      x-enum-varnames:
      - EMAIL
    RetentionFilterAllAttributes:
      description: The attributes of the retention filter.
      properties:
        created_at:
          description: The creation timestamp of the retention filter.
          format: int64
          type: integer
          example: 42
        created_by:
          description: The creator of the retention filter.
          type: string
          example: example_value
        editable:
          description: Shows whether the filter can be edited.
          example: true
          type: boolean
        enabled:
          description: The status of the retention filter (Enabled/Disabled).
          example: true
          type: boolean
        execution_order:
          description: The execution order of the retention filter.
          format: int64
          type: integer
          example: 42
        filter:
          $ref: '#/components/schemas/SpansFilter'
        filter_type:
          $ref: '#/components/schemas/RetentionFilterAllType'
        modified_at:
          description: The modification timestamp of the retention filter.
          format: int64
          type: integer
          example: 42
        modified_by:
          description: The modifier of the retention filter.
          type: string
          example: example_value
        name:
          description: The name of the retention filter.
          example: my retention filter
          type: string
        rate:
          description: 'Sample rate to apply to spans going through this retention filter.

            A value of 1.0 keeps all spans matching the query.'
          example: 1
          format: double
          type: number
        trace_rate:
          description: 'Sample rate to apply to traces containing spans going through this retention filter.

            A value of 1.0 keeps all traces with spans matching the query.'
          example: 1
          format: double
          type: number
      type: object
    EscalationPolicyStepType:
      default: steps
      description: Indicates that the resource is of type `steps`.
      enum:
      - steps
      example: steps
      type: string
      x-enum-varnames:
      - STEPS
    AWSAccountResponse:
      description: AWS Account response body.
      properties:
        data:
          $ref: '#/components/schemas/AWSAccountResponseData'
      required:
      - data
      type: object
    EntityV3APISpecInterfaceFileRef:
      additionalProperties: false
      description: The definition of `EntityV3APISpecInterfaceFileRef` object.
      properties:
        fileRef:
          description: The reference to the API definition file.
          type: string
          example: example_value
      type: object
    AwsCURConfigPatchData:
      description: AWS CUR config Patch data.
      properties:
        attributes:
          $ref: '#/components/schemas/AwsCURConfigPatchRequestAttributes'
        type:
          $ref: '#/components/schemas/AwsCURConfigPatchRequestType'
      required:
      - attributes
      - type
      type: object
      x-merge-override:
        required: false
    LogsArchiveOrderAttributes:
      description: The attributes associated with the archive order.
      properties:
        archive_ids:
          description: 'An ordered array of `<ARCHIVE_ID>` strings, the order of archive IDs in the array

            define the overall archives order for Datadog.'
          example:
          - a2zcMylnM4OCHpYusxIi1g
          - a2zcMylnM4OCHpYusxIi2g
          - a2zcMylnM4OCHpYusxIi3g
          items:
            description: A given archive ID.
            type: string
          type: array
      required:
      - archive_ids
      type: object
    LogsArchiveCreateRequest:
      description: The logs archive.
      properties:
        data:
          $ref: '#/components/schemas/LogsArchiveCreateRequestDefinition'
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType:
      description: Indicates that a predefined library pattern is used.
      enum:
      - library
      example: library
      type: string
      x-enum-varnames:
      - LIBRARY
    CloudWorkloadSecurityAgentRuleUpdateAttributes:
      description: Update an existing Cloud Workload Security Agent rule
      properties:
        actions:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
        blocking:
          description: The blocking policies that the rule belongs to
          items:
            type: string
          type: array
        description:
          description: The description of the Agent rule
          example: My Agent rule
          type: string
        disabled:
          description: The disabled policies that the rule belongs to
          items:
            type: string
          type: array
        enabled:
          description: Whether the Agent rule is enabled
          example: true
          type: boolean
        expression:
          description: The SECL expression of the Agent rule
          example: exec.file.name == "sh"
          type: string
        monitoring:
          description: The monitoring policies that the rule belongs to
          items:
            type: string
          type: array
        policy_id:
          description: The ID of the policy where the Agent rule is saved
          example: a8c8e364-6556-434d-b798-a4c23de29c0b
          type: string
        product_tags:
          description: The list of product tags associated with the rule
          items:
            type: string
          type: array
      type: object
    Trigger:
      description: One of the triggers that can start the execution of a workflow.
      oneOf:
      - $ref: '#/components/schemas/APITriggerWrapper'
      - $ref: '#/components/schemas/AppTriggerWrapper'
      - $ref: '#/components/schemas/CaseTriggerWrapper'
      - $ref: '#/components/schemas/ChangeEventTriggerWrapper'
      - $ref: '#/components/schemas/DatabaseMonitoringTriggerWrapper'
      - $ref: '#/components/schemas/DashboardTriggerWrapper'
      - $ref: '#/components/schemas/GithubWebhookTriggerWrapper'
      - $ref: '#/components/schemas/IncidentTriggerWrapper'
      - $ref: '#/components/schemas/MonitorTriggerWrapper'
      - $ref: '#/components/schemas/NotebookTriggerWrapper'
      - $ref: '#/components/schemas/ScheduleTriggerWrapper'
      - $ref: '#/components/schemas/SecurityTriggerWrapper'
      - $ref: '#/components/schemas/SelfServiceTriggerWrapper'
      - $ref: '#/components/schemas/SlackTriggerWrapper'
      - $ref: '#/components/schemas/SoftwareCatalogTriggerWrapper'
      - $ref: '#/components/schemas/WorkflowTriggerWrapper'
    DowntimeResponseAttributes:
      description: Downtime details.
      properties:
        canceled:
          description: Time that the downtime was canceled.
          example: 2020-01-02T03:04:05.282979+0000
          format: date-time
          nullable: true
          type: string
        created:
          description: Creation time of the downtime.
          example: 2020-01-02T03:04:05.282979+0000
          format: date-time
          type: string
        display_timezone:
          $ref: '#/components/schemas/DowntimeDisplayTimezone'
        message:
          $ref: '#/components/schemas/DowntimeMessage'
        modified:
          description: Time that the downtime was last modified.
          example: 2020-01-02T03:04:05.282979+0000
          format: date-time
          type: string
        monitor_identifier:
          $ref: '#/components/schemas/DowntimeMonitorIdentifier'
        mute_first_recovery_notification:
          $ref: '#/components/schemas/DowntimeMuteFirstRecoveryNotification'
        notify_end_states:
          $ref: '#/components/schemas/DowntimeNotifyEndStates'
        notify_end_types:
          $ref: '#/components/schemas/DowntimeNotifyEndTypes'
        schedule:
          $ref: '#/components/schemas/DowntimeScheduleResponse'
        scope:
          $ref: '#/components/schemas/DowntimeScope'
        status:
          $ref: '#/components/schemas/DowntimeStatus'
      type: object
    ServiceDefinitionV2SlackType:
      description: Contact type.
      enum:
      - slack
      example: slack
      type: string
      x-enum-varnames:
      - SLACK
    ScheduleDataRelationshipsLayers:
      description: Associates layers with this schedule in a data structure.
      properties:
        data:
          description: An array of layer references for this schedule.
          items:
            $ref: '#/components/schemas/ScheduleDataRelationshipsLayersDataItems'
          type: array
      type: object
    ObservabilityPipelineHttpClientSource:
      description: The `http_client` source scrapes logs from HTTP endpoints at regular intervals.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: http-client-source
          type: string
        scrape_interval_secs:
          description: The interval (in seconds) between HTTP scrape requests.
          example: 60
          format: int64
          type: integer
        scrape_timeout_secs:
          description: The timeout (in seconds) for each scrape request.
          example: 10
          format: int64
          type: integer
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceType'
      required:
      - id
      - type
      - decoding
      type: object
    EscalationPolicyDataType:
      default: policies
      description: Indicates that the resource is of type `policies`.
      enum:
      - policies
      example: policies
      type: string
      x-enum-varnames:
      - POLICIES
    ServiceDefinitionV2Dot2Integrations:
      description: Third party integrations that Datadog supports.
      properties:
        opsgenie:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot2Opsgenie'
        pagerduty:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot2Pagerduty'
      type: object
    ScheduleUpdateRequestDataType:
      default: schedules
      description: Schedules resource type.
      enum:
      - schedules
      example: schedules
      type: string
      x-enum-varnames:
      - SCHEDULES
    ServiceDefinitionMetaWarnings:
      description: Schema validation warnings.
      properties:
        instance-location:
          description: The warning instance location.
          type: string
          example: example_value
        keyword-location:
          description: The warning keyword location.
          type: string
          example: example_value
        message:
          description: The warning message.
          type: string
          example: CPU usage is high on {{host.name}}
      type: object
    AWSIntegration:
      description: The definition of `AWSIntegration` object.
      properties:
        credentials:
          $ref: '#/components/schemas/AWSCredentials'
        type:
          $ref: '#/components/schemas/AWSIntegrationType'
      required:
      - type
      - credentials
      type: object
    SecurityMonitoringRuleOptions:
      description: Options.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
        decreaseCriticalityBasedOnEnv:
          $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv'
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        hardcodedEvaluatorType:
          $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    LogsArchiveDestinationS3Type:
      default: s3
      description: Type of the S3 archive destination.
      enum:
      - s3
      example: s3
      type: string
      x-enum-varnames:
      - S3
    OrgConfigRead:
      description: A single Org Config.
      properties:
        attributes:
          $ref: '#/components/schemas/OrgConfigReadAttributes'
        id:
          description: A unique identifier for an Org Config.
          example: abcd1234
          type: string
        type:
          $ref: '#/components/schemas/OrgConfigType'
      required:
      - id
      - type
      - attributes
      type: object
    IncidentAttachmentLinkAttributesAttachmentObject:
      description: The link attachment.
      properties:
        documentUrl:
          description: The URL of this link attachment.
          example: https://www.example.com/webstore-failure-runbook
          type: string
        title:
          description: The title of this link attachment.
          example: Runbook for webstore service failures
          type: string
      required:
      - documentUrl
      - title
      type: object
    ConnectionGroup:
      description: The definition of `ConnectionGroup` object.
      properties:
        connectionGroupId:
          description: The `ConnectionGroup` `connectionGroupId`.
          example: ''
          type: string
        label:
          description: The `ConnectionGroup` `label`.
          example: ''
          type: string
        tags:
          description: The `ConnectionGroup` `tags`.
          example:
          - ''
          items:
            type: string
          type: array
      required:
      - connectionGroupId
      - label
      - tags
      type: object
    ComponentGrid:
      description: A grid component. The grid component is the root canvas for an app and contains all other components.
      properties:
        events:
          description: Events to listen for on the grid component.
          items:
            $ref: '#/components/schemas/AppBuilderEvent'
          type: array
        id:
          description: The ID of the grid component. This property is deprecated; use `name` to identify individual components instead.
          type: string
          example: abc-123-def
        name:
          description: A unique identifier for this grid component. This name is also visible in the app editor.
          example: ''
          type: string
        properties:
          $ref: '#/components/schemas/ComponentGridProperties'
        type:
          $ref: '#/components/schemas/ComponentGridType'
      required:
      - name
      - type
      - properties
      type: object
    ScheduleMember:
      description: Represents a single member entry in a schedule, referencing a specific user.
      properties:
        id:
          description: The unique identifier for this schedule member.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/ScheduleMemberRelationships'
        type:
          $ref: '#/components/schemas/ScheduleMemberType'
      required:
      - type
      type: object
    IPAllowlistData:
      description: IP allowlist data.
      properties:
        attributes:
          $ref: '#/components/schemas/IPAllowlistAttributes'
        id:
          description: The unique identifier of the org.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/IPAllowlistType'
      required:
      - type
      type: object
    OktaAccountUpdateRequest:
      description: Payload schema when updating an Okta account.
      properties:
        data:
          $ref: '#/components/schemas/OktaAccountUpdateRequestData'
      required:
      - data
      type: object
    ObservabilityPipelineAddEnvVarsProcessorType:
      default: add_env_vars
      description: The processor type. The value should always be `add_env_vars`.
      enum:
      - add_env_vars
      example: add_env_vars
      type: string
      x-enum-varnames:
      - ADD_ENV_VARS
    ApplicationSecurityWafExclusionFilterResource:
      description: A JSON:API resource for an WAF exclusion filter.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterAttributes'
        id:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterID'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType'
      type: object
    SensitiveDataScannerRuleUpdate:
      description: Data related to the update of a rule.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes'
        id:
          description: ID of the rule.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      type: object
    DowntimeRelationshipsCreatedBy:
      description: The user who created the downtime.
      properties:
        data:
          $ref: '#/components/schemas/DowntimeRelationshipsCreatedByData'
      type: object
    ObservabilityPipelineGeneratedMetricIncrementByOneStrategy:
      description: Increments the metric by 1 for each matching event.
      enum:
      - increment_by_one
      example: increment_by_one
      type: string
      x-enum-varnames:
      - INCREMENT_BY_ONE
    AzureUCConfigPairAttributes:
      description: Attributes for Azure config pair.
      properties:
        configs:
          description: An Azure config.
          items:
            $ref: '#/components/schemas/AzureUCConfig'
          type: array
        id:
          description: The ID of the Azure config pair.
          format: int64
          type: integer
          example: 42
      required:
      - configs
      type: object
      x-merge-override:
        properties: false
    SecurityMonitoringSuppressionType:
      default: suppressions
      description: The type of the resource. The value should always be `suppressions`.
      enum:
      - suppressions
      example: suppressions
      type: string
      x-enum-varnames:
      - SUPPRESSIONS
    ObservabilityPipelineSyslogNgSource:
      description: The `syslog_ng` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: syslog-ng-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSourceType'
      required:
      - id
      - type
      - mode
      type: object
    SecurityMonitoringSuppressionAttributes:
      description: The attributes of the suppression rule.
      properties:
        creation_date:
          description: A Unix millisecond timestamp given the creation date of the suppression rule.
          format: int64
          type: integer
          example: 42
        creator:
          $ref: '#/components/schemas/SecurityMonitoringUser'
        data_exclusion_query:
          description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
          example: source:cloudtrail account_id:12345
          type: string
        description:
          description: A description for the suppression rule.
          example: This rule suppresses low-severity signals in staging environments.
          type: string
        editable:
          description: Whether the suppression rule is editable.
          example: true
          type: boolean
        enabled:
          description: Whether the suppression rule is enabled.
          example: true
          type: boolean
        expiration_date:
          description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
          example: 1703187336000
          format: int64
          type: integer
        name:
          description: The name of the suppression rule.
          example: Custom suppression
          type: string
        rule_query:
          description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
          example: type:log_detection source:cloudtrail
          type: string
        start_date:
          description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
          example: 1703187336000
          format: int64
          type: integer
        suppression_query:
          description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
          example: env:staging status:low
          type: string
        update_date:
          description: A Unix millisecond timestamp given the update date of the suppression rule.
          format: int64
          type: integer
          example: 42
        updater:
          $ref: '#/components/schemas/SecurityMonitoringUser'
        version:
          description: The version of the suppression rule; it starts at 1, and is incremented at each update.
          example: 42
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    HTTPHeaderUpdate:
      description: The definition of `HTTPHeaderUpdate` object.
      properties:
        deleted:
          description: Should the header be deleted.
          type: boolean
          example: true
        name:
          description: The `HTTPHeaderUpdate` `name`.
          example: MyHttpHeader
          pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$
          type: string
        value:
          description: The `HTTPHeaderUpdate` `value`.
          example: Updated Header Value
          type: string
      required:
      - name
      type: object
    RelationshipToUserTeamTeam:
      description: Relationship between team membership and team
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToUserTeamTeamData'
      required:
      - data
      type: object
    CloudWorkloadSecurityAgentPolicyData:
      description: Object for a single Agent policy
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyAttributes'
        id:
          description: The ID of the Agent policy
          example: 6517fcc1-cec7-4394-a655-8d6e9d085255
          type: string
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyType'
      type: object
    RetryStrategyLinear:
      description: The definition of `RetryStrategyLinear` object.
      properties:
        interval:
          description: The `RetryStrategyLinear` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
          example: ''
          type: string
        maxRetries:
          description: The `RetryStrategyLinear` `maxRetries`.
          example: 0
          format: double
          type: number
      required:
      - interval
      - maxRetries
      type: object
    RumMetricResponseAttributes:
      description: The object describing a Datadog rum-based metric.
      properties:
        compute:
          $ref: '#/components/schemas/RumMetricResponseCompute'
        event_type:
          $ref: '#/components/schemas/RumMetricEventType'
        filter:
          $ref: '#/components/schemas/RumMetricResponseFilter'
        group_by:
          description: The rules for the group by.
          items:
            $ref: '#/components/schemas/RumMetricResponseGroupBy'
          type: array
        uniqueness:
          $ref: '#/components/schemas/RumMetricResponseUniqueness'
      type: object
    RumRetentionFilterSampleRate:
      description: The sample rate for a RUM retention filter, between 0 and 100.
      example: 25
      format: int64
      maximum: 100
      minimum: 0
      type: integer
    CompletionCondition:
      description: The definition of `CompletionCondition` object.
      properties:
        operand1:
          description: The `CompletionCondition` `operand1`.
          example: example_value
        operand2:
          description: The `CompletionCondition` `operand2`.
          example: example_value
        operator:
          $ref: '#/components/schemas/CompletionConditionOperator'
      required:
      - operand1
      - operator
      type: object
    ApplicationSecurityWafExclusionFilterUpdateRequest:
      description: Request object for updating a single WAF exclusion filter.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateData'
      required:
      - data
      type: object
    ServiceDefinitionV2Dot1OpsgenieRegion:
      description: Opsgenie instance region.
      enum:
      - US
      - EU
      example: US
      type: string
      x-enum-varnames:
      - US
      - EU
    ProjectRelationship:
      description: Relationship to project
      properties:
        data:
          $ref: '#/components/schemas/ProjectRelationshipData'
      required:
      - data
      type: object
    RumRetentionFilterID:
      description: ID of retention filter in UUID.
      example: 051601eb-54a0-abc0-03f9-cc02efa18892
      type: string
    IncidentTeamResponse:
      description: Response with an incident team payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentTeamResponseData'
        included:
          description: Included objects from relationships.
          items:
            $ref: '#/components/schemas/IncidentTeamIncludedItems'
          readOnly: true
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorScope:
      description: Determines which parts of the log the pattern-matching rule should be applied to.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAll'
    UrlParam:
      description: The definition of `UrlParam` object.
      properties:
        name:
          $ref: '#/components/schemas/TokenName'
          example: MyUrlParameter
        value:
          description: The `UrlParam` `value`.
          example: Some Url Parameter value
          type: string
      required:
      - name
      - value
      type: object
    CloudWorkloadSecurityAgentPolicyID:
      description: The ID of the Agent policy
      example: 6517fcc1-cec7-4394-a655-8d6e9d085255
      type: string
    OpsgenieServiceResponseData:
      description: Opsgenie service data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/OpsgenieServiceResponseAttributes'
        id:
          description: The ID of the Opsgenie service.
          example: 596da4af-0563-4097-90ff-07230c3f9db3
          maxLength: 100
          minLength: 1
          type: string
        type:
          $ref: '#/components/schemas/OpsgenieServiceType'
      required:
      - id
      - type
      - attributes
      type: object
      x-merge-override:
        required: false
    ApplicationSecurityWafCustomRuleAttributes:
      description: A WAF custom rule.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction'
        blocking:
          description: Indicates whether the WAF custom rule will block the request.
          example: false
          type: boolean
        conditions:
          description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF

            rule to trigger.'
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition'
          type: array
        enabled:
          description: Indicates whether the WAF custom rule is enabled.
          example: false
          type: boolean
        metadata:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleMetadata'
        name:
          description: The Name of the WAF custom rule.
          example: Block request from bad useragent
          type: string
        path_glob:
          description: The path glob for the WAF custom rule.
          example: /api/search/*
          type: string
        scope:
          description: The scope of the WAF custom rule.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope'
          type: array
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags'
      required:
      - enabled
      - blocking
      - name
      - tags
      - conditions
      type: object
    ObservabilityPipelineParseJSONProcessorType:
      default: parse_json
      description: The processor type. The value should always be `parse_json`.
      enum:
      - parse_json
      example: parse_json
      type: string
      x-enum-varnames:
      - PARSE_JSON
    MetricName:
      description: The metric name for this resource.
      example: test.metric.latency
      type: string
    ServiceDefinitionV2Dot2Opsgenie:
      description: Opsgenie integration for the service.
      properties:
        region:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot2OpsgenieRegion'
        service-url:
          description: Opsgenie service url.
          example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000
          type: string
      required:
      - service-url
      type: object
    RelationshipToRoles:
      description: Relationship to roles.
      properties:
        data:
          description: An array containing type and the unique identifier of a role.
          items:
            $ref: '#/components/schemas/RelationshipToRoleData'
          type: array
      type: object
      x-merge-override:
        required: false
    NotebookTriggerWrapper:
      description: Schema for a Notebook-based trigger.
      properties:
        notebookTrigger:
          description: Trigger a workflow from a Notebook.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - notebookTrigger
      type: object
    TeamPermissionSettingAttributes:
      description: Team permission setting attributes
      properties:
        action:
          $ref: '#/components/schemas/TeamPermissionSettingSerializerAction'
        editable:
          description: Whether or not the permission setting is editable by the current user
          readOnly: true
          type: boolean
          example: true
        options:
          $ref: '#/components/schemas/TeamPermissionSettingValues'
        title:
          description: The team permission name
          readOnly: true
          type: string
          example: Example Monitor
        value:
          $ref: '#/components/schemas/TeamPermissionSettingValue'
      type: object
    EntityV3SystemKind:
      description: The definition of Entity V3 System Kind object.
      enum:
      - system
      example: system
      type: string
      x-enum-varnames:
      - SYSTEM
    ObservabilityPipelineSyslogNgSourceType:
      default: syslog_ng
      description: The source type. The value should always be `syslog_ng`.
      enum:
      - syslog_ng
      example: syslog_ng
      type: string
      x-enum-varnames:
      - SYSLOG_NG
    SecurityMonitoringRuleCaseAction:
      description: Action to perform when a signal is triggered. Only available for Application Security rule type.
      properties:
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
      type: object
    ObservabilityPipelineGenerateMetricsProcessorType:
      default: generate_datadog_metrics
      description: The processor type. Always `generate_datadog_metrics`.
      enum:
      - generate_datadog_metrics
      example: generate_datadog_metrics
      type: string
      x-enum-varnames:
      - GENERATE_DATADOG_METRICS
    ScheduleMemberType:
      default: members
      description: Schedule Members resource type.
      enum:
      - members
      example: members
      type: string
      x-enum-varnames:
      - MEMBERS
    GCPSTSServiceAccount:
      description: Info on your service account.
      properties:
        attributes:
          $ref: '#/components/schemas/GCPSTSServiceAccountAttributes'
        id:
          description: Your service account's unique ID.
          example: d291291f-12c2-22g4-j290-123456678897
          type: string
        meta:
          $ref: '#/components/schemas/GCPServiceAccountMeta'
        type:
          $ref: '#/components/schemas/GCPServiceAccountType'
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineParseGrokProcessorRuleSupportRule:
      description: The Grok helper rule referenced in the parsing rules.
      properties:
        name:
          description: The name of the Grok helper rule.
          example: user
          type: string
        rule:
          description: The definition of the Grok helper rule.
          example: ' %{word:user.name}'
          type: string
      required:
      - name
      - rule
      type: object
    MetricTagConfigurationUpdateAttributes:
      description: Object containing the definition of a metric tag configuration to be updated.
      properties:
        aggregations:
          $ref: '#/components/schemas/MetricCustomAggregations'
        exclude_tags_mode:
          description: 'When set to true, the configuration will exclude the configured tags and include any other submitted tags.

            When set to false, the configuration will include the configured tags and exclude any other submitted tags.

            Defaults to false. Requires `tags` property.'
          type: boolean
          example: true
        include_percentiles:
          description: 'Toggle to include/exclude percentiles for a distribution metric.

            Defaults to false. Can only be applied to metrics that have a `metric_type` of `distribution`.'
          example: true
          type: boolean
        tags:
          default: []
          description: A list of tag keys that will be queryable for your metric.
          example:
          - app
          - datacenter
          items:
            description: Tag keys to group by.
            type: string
          type: array
      type: object
    SecurityMonitoringRuleCase:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    IncidentAttachmentPostmortemAttachmentType:
      default: postmortem
      description: The type of postmortem attachment attributes.
      enum:
      - postmortem
      example: postmortem
      type: string
      x-enum-varnames:
      - POSTMORTEM
    EntityV3QueueKind:
      description: The definition of Entity V3 Queue Kind object.
      enum:
      - queue
      example: queue
      type: string
      x-enum-varnames:
      - QUEUE
    ObservabilityPipelineSplunkTcpSourceType:
      default: splunk_tcp
      description: The source type. Always `splunk_tcp`.
      enum:
      - splunk_tcp
      example: splunk_tcp
      type: string
      x-enum-varnames:
      - SPLUNK_TCP
    EscalationPolicyDataRelationshipsStepsDataItems:
      description: Defines a relationship to a single step within an escalation policy. Contains the step's `id` and `type`.
      properties:
        id:
          description: Specifies the unique identifier for the step resource.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItemsType'
      required:
      - type
      - id
      type: object
    HTTPTokenUpdate:
      description: The definition of `HTTPTokenUpdate` object.
      properties:
        deleted:
          description: Should the header be deleted.
          type: boolean
          example: true
        name:
          description: The `HTTPToken` `name`.
          example: MyToken
          pattern: ^[A-Za-z][A-Za-z\\d]*$
          type: string
        type:
          $ref: '#/components/schemas/TokenType'
        value:
          description: The `HTTPToken` `value`.
          example: Some Token Value
          type: string
      required:
      - name
      - type
      - value
      type: object
    LogsArchiveEncryptionS3Type:
      description: Type of S3 encryption for a destination.
      enum:
      - NO_OVERRIDE
      - SSE_S3
      - SSE_KMS
      example: SSE_S3
      type: string
      x-enum-varnames:
      - NO_OVERRIDE
      - SSE_S3
      - SSE_KMS
    CaseUpdatePriorityRequest:
      description: Case update priority request
      properties:
        data:
          $ref: '#/components/schemas/CaseUpdatePriority'
      required:
      - data
      type: object
    SpansMetricType:
      default: spans_metrics
      description: The type of resource. The value should always be spans_metrics.
      enum:
      - spans_metrics
      example: spans_metrics
      type: string
      x-enum-varnames:
      - SPANS_METRICS
    RolesType:
      default: roles
      description: Roles type.
      enum:
      - roles
      example: roles
      type: string
      x-enum-varnames:
      - ROLES
    MetricCustomTimeAggregation:
      description: A time aggregation for use in query.
      enum:
      - avg
      - count
      - max
      - min
      - sum
      example: sum
      type: string
      x-enum-varnames:
      - AVG
      - COUNT
      - MAX
      - MIN
      - SUM
    ObservabilityPipelineKafkaSourceType:
      default: kafka
      description: The source type. The value should always be `kafka`.
      enum:
      - kafka
      example: kafka
      type: string
      x-enum-varnames:
      - KAFKA
    CustomDestinationForwardDestinationElasticsearch:
      description: The Elasticsearch destination.
      properties:
        auth:
          $ref: '#/components/schemas/CustomDestinationElasticsearchDestinationAuth'
        endpoint:
          description: 'The destination for which logs will be forwarded to.

            Must have HTTPS scheme and forwarding back to Datadog is not allowed.'
          example: https://example.com
          type: string
        index_name:
          description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)).
          example: nginx-logs
          type: string
        index_rotation:
          description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-`

            (that is, `${index_name}-${indexPattern}`).

            You can customize the index rotation naming pattern by choosing one of these options:

            - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`)

            - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`)

            - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`)

            - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`)


            If this field is missing or is blank, it means that the index name will always be the same

            (that is, no rotation).'
          example: yyyy-MM-dd
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearchType'
      required:
      - type
      - endpoint
      - auth
      - index_name
      type: object
    ObservabilityPipelineConfig:
      description: Specifies the pipeline's configuration, including its sources, processors, and destinations.
      properties:
        destinations:
          description: A list of destination components where processed logs are sent.
          example:
          - id: datadog-logs-destination
            inputs:
            - filter-processor
            type: datadog_logs
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigDestinationItem'
          type: array
        processors:
          description: A list of processors that transform or enrich log data.
          example:
          - id: filter-processor
            include: service:my-service
            inputs:
            - datadog-agent-source
            type: filter
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigProcessorItem'
          type: array
        sources:
          description: A list of configured data sources for the pipeline.
          example:
          - id: datadog-agent-source
            type: datadog_agent
          items:
            $ref: '#/components/schemas/ObservabilityPipelineConfigSourceItem'
          type: array
      required:
      - sources
      - destinations
      type: object
    UserTeamUpdate:
      description: A user's relationship with a team
      properties:
        attributes:
          $ref: '#/components/schemas/UserTeamAttributes'
        type:
          $ref: '#/components/schemas/UserTeamType'
      required:
      - type
      type: object
    UsersType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    ServiceDefinitionV1Org:
      description: Org related information about the service.
      properties:
        application:
          description: App feature this service supports.
          example: E-Commerce
          type: string
        team:
          description: Team that owns the service.
          example: my-team
          type: string
      type: object
    WorkflowDataUpdate:
      description: Data related to the workflow being updated.
      properties:
        attributes:
          $ref: '#/components/schemas/WorkflowDataUpdateAttributes'
        id:
          description: The workflow identifier
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/WorkflowDataRelationships'
        type:
          $ref: '#/components/schemas/WorkflowDataType'
      required:
      - type
      - attributes
      type: object
    StartStepNames:
      description: A list of steps that run first after a trigger fires.
      example:
      - ''
      items:
        description: The `StartStepNames` `items`.
        type: string
      type: array
    EntityToRawSchema:
      description: Entity to raw schema relationship.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipItem'
      type: object
    CustomDestinationElasticsearchDestinationAuth:
      description: Basic access authentication.
      properties:
        password:
          description: The password of the authentication. This field is not returned by the API.
          example: datadog-custom-destination-password
          type: string
          writeOnly: true
        username:
          description: The username of the authentication. This field is not returned by the API.
          example: datadog-custom-destination-username
          type: string
          writeOnly: true
      required:
      - username
      - password
      type: object
    ApplicationSecurityWafCustomRuleUpdateAttributes:
      description: Update a WAF custom rule.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction'
        blocking:
          description: Indicates whether the WAF custom rule will block the request.
          example: false
          type: boolean
        conditions:
          description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF

            rule to trigger.'
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition'
          type: array
        enabled:
          description: Indicates whether the WAF custom rule is enabled.
          example: false
          type: boolean
        name:
          description: The Name of the WAF custom rule.
          example: Block request from bad useragent
          type: string
        path_glob:
          description: The path glob for the WAF custom rule.
          example: /api/search/*
          type: string
        scope:
          description: The scope of the WAF custom rule.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope'
          type: array
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags'
      required:
      - enabled
      - blocking
      - name
      - tags
      - conditions
      type: object
    ResourceFilterAttributes:
      description: Attributes of a resource filter.
      example:
        aws:
          '123456789':
          - environment:production
          - team:devops
        azure:
          sub-001:
          - app:frontend
        gcp:
          project-abc:
          - region:us-central1
      properties:
        cloud_provider:
          additionalProperties:
            additionalProperties:
              items:
                description: Tag filter in format "key:value"
                example: environment:production
                type: string
              type: array
            type: object
          description: A map of cloud provider names (e.g., "aws", "gcp", "azure") to a map of account/resource IDs and their associated tag filters.
          type: object
        uuid:
          description: The UUID of the resource filter.
          type: string
          example: abc-123-def
      required:
      - cloud_provider
      type: object
    CloudWorkloadSecurityAgentRuleUpdateData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateAttributes'
        id:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleID'
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      required:
      - attributes
      - type
      type: object
    SpansMetricResponseAttributes:
      description: The object describing a Datadog span-based metric.
      properties:
        compute:
          $ref: '#/components/schemas/SpansMetricResponseCompute'
        filter:
          $ref: '#/components/schemas/SpansMetricResponseFilter'
        group_by:
          description: The rules for the group by.
          items:
            $ref: '#/components/schemas/SpansMetricResponseGroupBy'
          type: array
      type: object
    RumRetentionFilterAttributes:
      description: The object describing attributes of a RUM retention filter.
      properties:
        enabled:
          $ref: '#/components/schemas/RumRetentionFilterEnabled'
        event_type:
          $ref: '#/components/schemas/RumRetentionFilterEventType'
        name:
          $ref: '#/components/schemas/RunRetentionFilterName'
        query:
          $ref: '#/components/schemas/RumRetentionFilterQuery'
        sample_rate:
          $ref: '#/components/schemas/RumRetentionFilterSampleRate'
      type: object
    RestrictionPolicyResponse:
      description: Response containing information about a single restriction policy.
      properties:
        data:
          $ref: '#/components/schemas/RestrictionPolicy'
      required:
      - data
      type: object
    IncidentIntegrationMetadataResponseIncludedItem:
      description: An object related to an incident integration metadata that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/User'
    GithubWebhookTriggerWrapper:
      description: Schema for a GitHub webhook-based trigger.
      properties:
        githubWebhookTrigger:
          $ref: '#/components/schemas/GithubWebhookTrigger'
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - githubWebhookTrigger
      type: object
    MetricTagConfigurationMetricTypes:
      default: gauge
      description: The metric's type.
      enum:
      - gauge
      - count
      - rate
      - distribution
      example: count
      type: string
      x-enum-varnames:
      - GAUGE
      - COUNT
      - RATE
      - DISTRIBUTION
    UpdateWorkflowResponse:
      description: The response object after updating a workflow.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowDataUpdate'
      type: object
    TeamLinkResponse:
      description: Team link response
      properties:
        data:
          $ref: '#/components/schemas/TeamLink'
      type: object
    IncidentServiceUpdateRequest:
      description: Update request with an incident service payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentServiceUpdateData'
      required:
      - data
      type: object
    CustomDestinationHttpDestinationAuthCustomHeaderType:
      default: custom_header
      description: Type of the custom header access authentication.
      enum:
      - custom_header
      example: custom_header
      type: string
      x-enum-varnames:
      - CUSTOM_HEADER
    EntityV3API:
      additionalProperties: false
      description: Schema for API entities.
      properties:
        apiVersion:
          $ref: '#/components/schemas/EntityV3APIVersion'
        datadog:
          $ref: '#/components/schemas/EntityV3APIDatadog'
        extensions:
          additionalProperties: {}
          description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field.
          type: object
          x-ignore-duplicate-object: true
        integrations:
          $ref: '#/components/schemas/EntityV3Integrations'
        kind:
          $ref: '#/components/schemas/EntityV3APIKind'
        metadata:
          $ref: '#/components/schemas/EntityV3Metadata'
        spec:
          $ref: '#/components/schemas/EntityV3APISpec'
      required:
      - apiVersion
      - kind
      - metadata
      type: object
    TimeRestriction:
      description: Defines a single time restriction rule with start and end times and the applicable weekdays.
      properties:
        end_day:
          $ref: '#/components/schemas/Weekday'
        end_time:
          description: Specifies the ending time for this restriction.
          type: string
          example: '2026-04-17T12:00:00Z'
        start_day:
          $ref: '#/components/schemas/Weekday'
        start_time:
          description: Specifies the starting time for this restriction.
          type: string
          example: '2026-04-17T12:00:00Z'
      type: object
    DashboardListItemRequest:
      description: A dashboard within a list.
      properties:
        id:
          description: ID of the dashboard.
          example: q5j-nti-fv6
          type: string
        type:
          $ref: '#/components/schemas/DashboardType'
      required:
      - type
      - id
      type: object
    ApplicationSecurityWafCustomRuleActionAction:
      default: block_request
      description: Override the default action to take when the WAF custom rule would block.
      enum:
      - redirect_request
      - block_request
      example: block_request
      type: string
      x-enum-varnames:
      - REDIRECT_REQUEST
      - BLOCK_REQUEST
    EntityV3SystemSpec:
      additionalProperties: false
      description: The definition of Entity V3 System Spec object.
      properties:
        components:
          description: A list of components belongs to the system.
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the component.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: An entity reference to the owner of the component.
          minLength: 1
          type: string
          example: example_value
      type: object
    ScheduleDataIncludedItem:
      description: Any additional resources related to this schedule, such as teams and layers.
      oneOf:
      - $ref: '#/components/schemas/TeamReference'
      - $ref: '#/components/schemas/Layer'
      - $ref: '#/components/schemas/ScheduleMember'
      - $ref: '#/components/schemas/ScheduleUser'
    ObservabilityPipelineGoogleCloudStorageDestinationAcl:
      description: Access control list setting for objects written to the bucket.
      enum:
      - private
      - project-private
      - public-read
      - authenticated-read
      - bucket-owner-read
      - bucket-owner-full-control
      example: private
      type: string
      x-enum-varnames:
      - PRIVATE
      - PROJECTNOT_PRIVATE
      - PUBLICNOT_READ
      - AUTHENTICATEDNOT_READ
      - BUCKETNOT_OWNERNOT_READ
      - BUCKETNOT_OWNERNOT_FULLNOT_CONTROL
    LogsArchiveAttributes:
      description: The attributes associated with the archive.
      properties:
        destination:
          $ref: '#/components/schemas/LogsArchiveDestination'
        include_tags:
          default: false
          description: 'To store the tags in the archive, set the value "true".

            If it is set to "false", the tags will be deleted when the logs are sent to the archive.'
          example: false
          type: boolean
        name:
          description: The archive name.
          example: Nginx Archive
          type: string
        query:
          description: The archive query/filter. Logs matching this query are included in the archive.
          example: source:nginx
          type: string
        rehydration_max_scan_size_in_gb:
          description: Maximum scan size for rehydration from this archive.
          example: 100
          format: int64
          nullable: true
          type: integer
        rehydration_tags:
          description: An array of tags to add to rehydrated logs from an archive.
          example:
          - team:intake
          - team:app
          items:
            description: A given tag in the `<KEY>:<VALUE>` format.
            type: string
          type: array
        state:
          $ref: '#/components/schemas/LogsArchiveState'
      required:
      - name
      - query
      - destination
      type: object
    ObservabilityPipelineGoogleChronicleDestinationType:
      default: google_chronicle
      description: The destination type. The value should always be `google_chronicle`.
      enum:
      - google_chronicle
      example: google_chronicle
      type: string
      x-enum-varnames:
      - GOOGLE_CHRONICLE
    RoleUpdateResponseData:
      description: Role object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/RoleUpdateAttributes'
        id:
          description: The unique identifier of the role.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RoleResponseRelationships'
        type:
          $ref: '#/components/schemas/RolesType'
      required:
      - type
      type: object
    ObservabilityPipelineAmazonS3DestinationType:
      default: amazon_s3
      description: The destination type. Always `amazon_s3`.
      enum:
      - amazon_s3
      example: amazon_s3
      type: string
      x-enum-varnames:
      - AMAZON_S3
    ObservabilityPipelineGoogleChronicleDestinationEncoding:
      description: The encoding format for the logs sent to Chronicle.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    SensitiveDataScannerRuleUpdateResponse:
      description: Update rule response.
      properties:
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      type: object
    RelationshipToIncidentUserDefinedFieldData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentUserDefinedFieldType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineFilterProcessorType:
      default: filter
      description: The processor type. The value should always be `filter`.
      enum:
      - filter
      example: filter
      type: string
      x-enum-varnames:
      - FILTER
    MicrosoftTeamsTenantBasedHandleAttributes:
      description: Tenant-based handle attributes.
      properties:
        channel_id:
          description: Channel id.
          example: fake-channel-id
          maxLength: 255
          type: string
        name:
          description: Tenant-based handle name.
          example: fake-handle-name
          maxLength: 255
          type: string
        team_id:
          description: Team id.
          example: 00000000-0000-0000-0000-000000000000
          maxLength: 255
          type: string
        tenant_id:
          description: Tenant id.
          example: 00000000-0000-0000-0000-000000000001
          maxLength: 255
          type: string
      type: object
      x-merge-override:
        required: false
    ApplicationSecurityWafExclusionFilterRulesTargetTags:
      additionalProperties:
        type: string
      description: Target multiple WAF rules based on their tags.
      properties:
        category:
          description: The category of the targeted WAF rules.
          example: attack_attempt
          type: string
        type:
          description: The type of the targeted WAF rules.
          example: lfi
          type: string
      type: object
    ObservabilityPipelineParseGrokProcessorRule:
      description: 'A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields

        from a specific log field using Grok patterns.

        '
      properties:
        match_rules:
          description: 'A list of Grok parsing rules that define how to extract fields from the source field.

            Each rule must contain a name and a valid Grok pattern.

            '
          example:
          - name: MyParsingRule
            rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule'
          type: array
        source:
          description: The name of the field in the log event to apply the Grok rules to.
          example: message
          type: string
        support_rules:
          description: 'A list of Grok helper rules that can be referenced by the parsing rules.

            '
          example:
          - name: user
            rule: '%{word:user.name}'
          items:
            $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule'
          type: array
      required:
      - source
      - match_rules
      - support_rules
      type: object
    CustomDestinationResponse:
      description: The custom destination.
      properties:
        data:
          $ref: '#/components/schemas/CustomDestinationResponseDefinition'
      type: object
    SensitiveDataScannerFilter:
      description: Filter for the Scanning Group.
      properties:
        query:
          description: Query to filter the events.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    ServiceNowTicketResult:
      description: ServiceNow ticket information
      properties:
        sys_target_link:
          description: Link to the Incident created on ServiceNow
          type: string
          example: example_value
      type: object
    MonitorNotificationRuleName:
      description: The name of the monitor notification rule.
      example: A notification rule name
      maxLength: 1000
      minLength: 1
      type: string
    ObservabilityPipelineNewRelicDestinationRegion:
      description: The New Relic region.
      enum:
      - us
      - eu
      example: us
      type: string
      x-enum-varnames:
      - US
      - EU
    SpansMetricUpdateData:
      description: The new span-based metric properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SpansMetricUpdateAttributes'
        type:
          $ref: '#/components/schemas/SpansMetricType'
      required:
      - type
      - attributes
      type: object
    SpansMetricUpdateAttributes:
      description: The span-based metric properties that will be updated.
      properties:
        compute:
          $ref: '#/components/schemas/SpansMetricUpdateCompute'
        filter:
          $ref: '#/components/schemas/SpansMetricFilter'
        group_by:
          description: The rules for the group by.
          items:
            $ref: '#/components/schemas/SpansMetricGroupBy'
          type: array
      type: object
    DowntimeResponseData:
      description: Downtime data.
      properties:
        attributes:
          $ref: '#/components/schemas/DowntimeResponseAttributes'
        id:
          description: The downtime ID.
          example: 00000000-0000-1234-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/DowntimeRelationships'
        type:
          $ref: '#/components/schemas/DowntimeResourceType'
      type: object
    GCPServiceAccountType:
      default: gcp_service_account
      description: The type of account.
      enum:
      - gcp_service_account
      example: gcp_service_account
      type: string
      x-enum-varnames:
      - GCP_SERVICE_ACCOUNT
    LogsMetricUpdateRequest:
      description: The new log-based metric body.
      properties:
        data:
          $ref: '#/components/schemas/LogsMetricUpdateData'
      required:
      - data
      type: object
    IncidentIntegrationMetadataMetadata:
      description: Incident integration metadata's metadata attribute.
      oneOf:
      - $ref: '#/components/schemas/SlackIntegrationMetadata'
      - $ref: '#/components/schemas/JiraIntegrationMetadata'
      - $ref: '#/components/schemas/MSTeamsIntegrationMetadata'
    ScheduleTargetType:
      default: schedules
      description: Indicates that the resource is of type `schedules`.
      enum:
      - schedules
      example: schedules
      type: string
      x-enum-varnames:
      - SCHEDULES
    ActionQuerySpecObject:
      description: The action query spec object.
      properties:
        connectionGroup:
          $ref: '#/components/schemas/ActionQuerySpecConnectionGroup'
        connectionId:
          description: The ID of the custom connection to use for this action query.
          example: 65bb1f25-52e1-4510-9f8d-22d1516ed693
          type: string
        fqn:
          description: The fully qualified name of the action type.
          example: com.datadoghq.http.request
          type: string
        inputs:
          $ref: '#/components/schemas/ActionQuerySpecInputs'
      required:
      - fqn
      type: object
    GCPServiceAccountMeta:
      description: Additional information related to your service account.
      properties:
        accessible_projects:
          description: The current list of projects accessible from your service account.
          items:
            description: List of GCP projects.
            type: string
          type: array
      type: object
    ServiceDefinitionV2Dot2OpsgenieRegion:
      description: Opsgenie instance region.
      enum:
      - US
      - EU
      example: US
      type: string
      x-enum-varnames:
      - US
      - EU
    UpsertCatalogEntityResponseIncluded:
      description: Upsert entity response included.
      items:
        $ref: '#/components/schemas/UpsertCatalogEntityResponseIncludedItem'
      type: array
    HTTPTokenAuth:
      description: The definition of `HTTPTokenAuth` object.
      properties:
        body:
          $ref: '#/components/schemas/HTTPBody'
        headers:
          description: The `HTTPTokenAuth` `headers`.
          items:
            $ref: '#/components/schemas/HTTPHeader'
          type: array
        tokens:
          description: The `HTTPTokenAuth` `tokens`.
          items:
            $ref: '#/components/schemas/HTTPToken'
          type: array
        type:
          $ref: '#/components/schemas/HTTPTokenAuthType'
        url_parameters:
          description: The `HTTPTokenAuth` `url_parameters`.
          items:
            $ref: '#/components/schemas/UrlParam'
          type: array
      required:
      - type
      type: object
    CustomFrameworkDataHandleAndVersion:
      description: Framework Handle and Version.
      properties:
        handle:
          description: Framework Handle
          example: sec2
          type: string
        version:
          description: Framework Version
          example: '2'
          type: string
      type: object
    CustomDestinationHttpDestinationAuthBasicType:
      default: basic
      description: Type of the basic access authentication.
      enum:
      - basic
      example: basic
      type: string
      x-enum-varnames:
      - BASIC
    ServiceDefinitionV2Slack:
      description: Service owner's Slack channel.
      properties:
        contact:
          description: Slack Channel.
          example: https://yourcompany.slack.com/archives/channel123
          type: string
        name:
          description: Contact Slack.
          example: Team Slack
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2SlackType'
      required:
      - type
      - contact
      type: object
    ApplicationSecurityWafExclusionFilterAttributes:
      description: Attributes describing a WAF exclusion filter.
      properties:
        description:
          description: A description for the exclusion filter.
          example: Exclude false positives on a path
          type: string
        enabled:
          description: Indicates whether the exclusion filter is enabled.
          example: true
          type: boolean
        event_query:
          description: The event query matched by the legacy exclusion filter. Cannot be created nor updated.
          type: string
          example: avg:system.cpu.user{*}
        ip_list:
          description: The client IP addresses matched by the exclusion filter (CIDR notation is supported).
          items:
            example: 198.51.100.72
            type: string
          type: array
        metadata:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterMetadata'
        on_match:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch'
        parameters:
          description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character.
          items:
            example: list.search.query
            type: string
          type: array
        path_glob:
          description: The HTTP path glob expression matched by the exclusion filter.
          example: /accounts/*
          type: string
        rules_target:
          description: The WAF rules targeted by the exclusion filter.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget'
          type: array
        scope:
          description: The services where the exclusion filter is deployed.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterScope'
          type: array
        search_query:
          description: Generated event search query for traces matching the exclusion filter.
          readOnly: true
          type: string
          example: avg:system.cpu.user{*}
      type: object
    RumMetricUniquenessWhen:
      description: When to count updatable events. `match` when the event is first seen, or `end` when the event is complete.
      enum:
      - match
      - end
      example: match
      type: string
      x-enum-varnames:
      - WHEN_MATCH
      - WHEN_END
    LogsMetricResponseCompute:
      description: The compute rule to compute the log-based metric.
      properties:
        aggregation_type:
          $ref: '#/components/schemas/LogsMetricResponseComputeAggregationType'
        include_percentiles:
          $ref: '#/components/schemas/LogsMetricComputeIncludePercentiles'
        path:
          description: The path to the value the log-based metric will aggregate on (only used if the aggregation type is a "distribution").
          example: '@duration'
          type: string
      type: object
    InputSchemaParametersType:
      description: The definition of `InputSchemaParametersType` object.
      enum:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
      example: STRING
      type: string
      x-enum-varnames:
      - STRING
      - NUMBER
      - BOOLEAN
      - OBJECT
      - ARRAY_STRING
      - ARRAY_NUMBER
      - ARRAY_BOOLEAN
      - ARRAY_OBJECT
    MicrosoftTeamsUpdateTenantBasedHandleRequest:
      description: Update tenant-based handle request.
      properties:
        data:
          $ref: '#/components/schemas/MicrosoftTeamsUpdateTenantBasedHandleRequestData'
      required:
      - data
      type: object
    ApplicationSecurityWafExclusionFilterMetadata:
      description: Extra information about the exclusion filter.
      properties:
        added_at:
          description: The creation date of the exclusion filter.
          format: date-time
          type: string
          example: example_value
        added_by:
          description: The handle of the user who created the exclusion filter.
          type: string
          example: example_value
        added_by_name:
          description: The name of the user who created the exclusion filter.
          type: string
          example: Example Monitor
        modified_at:
          description: The last modification date of the exclusion filter.
          format: date-time
          type: string
          example: example_value
        modified_by:
          description: The handle of the user who last modified the exclusion filter.
          type: string
          example: example_value
        modified_by_name:
          description: The name of the user who last modified the exclusion filter.
          type: string
          example: Example Monitor
      readOnly: true
      type: object
    ScheduleData:
      description: Represents the primary data object for a schedule, linking attributes and relationships.
      properties:
        attributes:
          $ref: '#/components/schemas/ScheduleDataAttributes'
        id:
          description: The schedule's unique identifier.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        relationships:
          $ref: '#/components/schemas/ScheduleDataRelationships'
        type:
          $ref: '#/components/schemas/ScheduleDataType'
      required:
      - type
      type: object
    Organization:
      description: Organization object.
      properties:
        attributes:
          $ref: '#/components/schemas/OrganizationAttributes'
        id:
          description: ID of the organization.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/OrganizationsType'
      required:
      - type
      type: object
    RumMetricResponseData:
      description: The rum-based metric properties.
      properties:
        attributes:
          $ref: '#/components/schemas/RumMetricResponseAttributes'
        id:
          $ref: '#/components/schemas/RumMetricID'
        type:
          $ref: '#/components/schemas/RumMetricType'
      type: object
    IncidentAttachmentUpdateResponse:
      description: The response object containing the created or updated incident attachments.
      properties:
        data:
          description: 'An array of incident attachments. Only the attachments that were created or updated by the request are

            returned.'
          example:
          - attributes:
              attachment:
                documentUrl: ''
                title: Postmortem IR-123
              attachment_type: postmortem
            id: 00000000-abcd-0002-0000-000000000000
            relationships:
              last_modified_by_user:
                data:
                  id: 00000000-0000-0000-cccc-000000000000
                  type: users
            type: incident_attachments
          items:
            $ref: '#/components/schemas/IncidentAttachmentData'
          type: array
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentAttachmentsResponseIncludedItem'
          type: array
      required:
      - data
      type: object
    ObservabilityPipelineHttpServerSourceType:
      default: http_server
      description: The source type. The value should always be `http_server`.
      enum:
      - http_server
      example: http_server
      type: string
      x-enum-varnames:
      - HTTP_SERVER
    CaseUpdatePriority:
      description: Case priority status
      properties:
        attributes:
          $ref: '#/components/schemas/CaseUpdatePriorityAttributes'
        type:
          $ref: '#/components/schemas/CaseResourceType'
      required:
      - attributes
      - type
      type: object
    CloudWorkloadSecurityAgentRuleAttributes:
      description: A Cloud Workload Security Agent rule returned by the API
      properties:
        actions:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
        agentConstraint:
          description: The version of the Agent
          type: string
          example: example_value
        blocking:
          description: The blocking policies that the rule belongs to
          items:
            type: string
          type: array
        category:
          description: The category of the Agent rule
          example: Process Activity
          type: string
        creationAuthorUuId:
          description: The ID of the user who created the rule
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
        creationDate:
          description: When the Agent rule was created, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        creator:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreatorAttributes'
        defaultRule:
          description: Whether the rule is included by default
          example: false
          type: boolean
        description:
          description: The description of the Agent rule
          example: My Agent rule
          type: string
        disabled:
          description: The disabled policies that the rule belongs to
          items:
            type: string
          type: array
        enabled:
          description: Whether the Agent rule is enabled
          example: true
          type: boolean
        expression:
          description: The SECL expression of the Agent rule
          example: exec.file.name == "sh"
          type: string
        filters:
          description: The platforms the Agent rule is supported on
          items:
            type: string
          type: array
        monitoring:
          description: The monitoring policies that the rule belongs to
          items:
            type: string
          type: array
        name:
          description: The name of the Agent rule
          example: my_agent_rule
          type: string
        product_tags:
          description: The list of product tags associated with the rule
          items:
            type: string
          type: array
        updateAuthorUuId:
          description: The ID of the user who updated the rule
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
        updateDate:
          description: Timestamp in milliseconds when the Agent rule was last updated
          example: 1624366480320
          format: int64
          type: integer
        updatedAt:
          description: When the Agent rule was last updated, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        updater:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdaterAttributes'
        version:
          description: The version of the Agent rule
          example: 23
          format: int64
          type: integer
      type: object
    RestrictionQueryWithoutRelationshipsResponse:
      description: Response containing information about a single restriction query.
      properties:
        data:
          $ref: '#/components/schemas/RestrictionQueryWithoutRelationships'
      type: object
    NullableRelationshipToUserData:
      description: Relationship to user object.
      nullable: true
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions:
      description: Options for selecting a predefined library pattern and enabling keyword support.
      properties:
        id:
          description: Identifier for a predefined pattern from the sensitive data scanner pattern library.
          example: credit_card
          type: string
        use_recommended_keywords:
          description: Whether to augment the pattern with recommended keywords (optional).
          type: boolean
          example: true
      required:
      - id
      type: object
    ObservabilityPipelineAmazonS3DestinationStorageClass:
      description: S3 storage class.
      enum:
      - STANDARD
      - REDUCED_REDUNDANCY
      - INTELLIGENT_TIERING
      - STANDARD_IA
      - EXPRESS_ONEZONE
      - ONEZONE_IA
      - GLACIER
      - GLACIER_IR
      - DEEP_ARCHIVE
      example: STANDARD
      type: string
      x-enum-varnames:
      - STANDARD
      - REDUCED_REDUNDANCY
      - INTELLIGENT_TIERING
      - STANDARD_IA
      - EXPRESS_ONEZONE
      - ONEZONE_IA
      - GLACIER
      - GLACIER_IR
      - DEEP_ARCHIVE
    ObservabilityPipelineDecoding:
      description: The decoding format used to interpret incoming logs.
      enum:
      - bytes
      - gelf
      - json
      - syslog
      example: json
      type: string
      x-enum-varnames:
      - DECODE_BYTES
      - DECODE_GELF
      - DECODE_JSON
      - DECODE_SYSLOG
    EntityV3DatadogCodeLocations:
      additionalProperties: false
      description: Schema for mapping source code locations to an entity.
      items:
        $ref: '#/components/schemas/EntityV3DatadogCodeLocationItem'
      type: array
    ServiceDefinitionV1Contact:
      description: Contact information about the service.
      properties:
        email:
          description: Service owner’s email.
          example: contact@datadoghq.com
          type: string
        slack:
          description: Service owner’s Slack channel.
          example: https://yourcompany.slack.com/archives/channel123
          type: string
      type: object
    CloudWorkloadSecurityAgentPolicyType:
      default: policy
      description: The type of the resource, must always be `policy`
      enum:
      - policy
      example: policy
      type: string
      x-enum-varnames:
      - POLICY
    ServiceDefinitionV2Dot1Link:
      description: Service's external links.
      properties:
        name:
          description: Link name.
          example: Runbook
          type: string
        provider:
          description: Link provider.
          example: Github
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1LinkType'
        url:
          description: Link URL.
          example: https://my-runbook
          type: string
      required:
      - name
      - type
      - url
      type: object
    RumMetricFilter:
      description: The rum-based metric filter. Events matching this filter will be aggregated in this metric.
      properties:
        query:
          default: '*'
          description: The search query - following the RUM search syntax.
          example: '@service:web-ui: '
          type: string
      required:
      - query
      type: object
    MicrosoftTeamsWorkflowsWebhookResponseAttributes:
      description: Workflows Webhook handle attributes.
      properties:
        name:
          description: Workflows Webhook handle name.
          example: fake-handle-name
          maxLength: 255
          type: string
      type: object
    ObservabilityPipeline:
      description: Top-level schema representing a pipeline.
      properties:
        data:
          $ref: '#/components/schemas/ObservabilityPipelineData'
      required:
      - data
      type: object
    EscalationPolicyUpdateRequestDataAttributesStepsItems:
      description: Defines a single escalation step within an escalation policy update request. Contains assignment strategy, escalation timeout, an optional step ID, and a list of targets.
      properties:
        assignment:
          $ref: '#/components/schemas/EscalationPolicyStepAttributesAssignment'
        escalate_after_seconds:
          description: Defines how many seconds to wait before escalating to the next step.
          example: 3600
          format: int64
          type: integer
        id:
          description: Specifies the unique identifier of this step.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        targets:
          description: Specifies the collection of escalation targets for this step.
          items:
            $ref: '#/components/schemas/EscalationPolicyStepTarget'
          type: array
      required:
      - targets
      type: object
    IncidentIntegrationMetadataAttributes:
      description: Incident integration metadata's attributes for a create request.
      properties:
        created:
          description: Timestamp when the incident todo was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        incident_id:
          description: UUID of the incident this integration metadata is connected to.
          example: 00000000-aaaa-0000-0000-000000000000
          type: string
        integration_type:
          description: 'A number indicating the type of integration this metadata is for. 1 indicates Slack;

            8 indicates Jira.'
          example: 1
          format: int32
          maximum: 9
          type: integer
        metadata:
          $ref: '#/components/schemas/IncidentIntegrationMetadataMetadata'
        modified:
          description: Timestamp when the incident todo was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        status:
          description: 'A number indicating the status of this integration metadata. 0 indicates unknown;

            1 indicates pending; 2 indicates complete; 3 indicates manually created;

            4 indicates manually updated; 5 indicates failed.'
          format: int32
          maximum: 5
          type: integer
          example: 42
      required:
      - integration_type
      - metadata
      type: object
    ObservabilityPipelineConfigDestinationItem:
      description: A destination for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Destination'
      - $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestination'
      - $ref: '#/components/schemas/AzureStorageDestination'
      - $ref: '#/components/schemas/MicrosoftSentinelDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination'
    SensitiveDataScannerGroup:
      description: A scanning group.
      properties:
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    HTTPIntegrationUpdate:
      description: The definition of `HTTPIntegrationUpdate` object.
      properties:
        base_url:
          description: Base HTTP url for the integration
          example: http://datadoghq.com
          type: string
        credentials:
          $ref: '#/components/schemas/HTTPCredentialsUpdate'
        type:
          $ref: '#/components/schemas/HTTPIntegrationType'
      required:
      - type
      type: object
    SecurityMonitoringSuppressionUpdateRequest:
      description: Request object containing the fields to update on the suppression rule.
      properties:
        data:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateData'
      required:
      - data
      type: object
    RestrictionPolicyType:
      default: restriction_policy
      description: Restriction policy type.
      enum:
      - restriction_policy
      example: restriction_policy
      type: string
      x-enum-varnames:
      - RESTRICTION_POLICY
    EntityV3DatastoreSpec:
      additionalProperties: false
      description: The definition of Entity V3 Datastore Spec object.
      properties:
        componentOf:
          description: A list of components the datastore is a part of
          items:
            type: string
          type: array
        lifecycle:
          description: The lifecycle state of the datastore.
          minLength: 1
          type: string
          example: example_value
        tier:
          description: The importance of the datastore.
          minLength: 1
          type: string
          example: example_value
        type:
          description: The type of datastore.
          type: string
          example: metric alert
      type: object
    ObservabilityPipelineConfigSourceItem:
      description: A data source for the pipeline.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineKafkaSource'
      - $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSource'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Source'
      - $ref: '#/components/schemas/ObservabilityPipelineFluentdSource'
      - $ref: '#/components/schemas/ObservabilityPipelineFluentBitSource'
      - $ref: '#/components/schemas/ObservabilityPipelineHttpServerSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSource'
      - $ref: '#/components/schemas/ObservabilityPipelineRsyslogSource'
      - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSource'
      - $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSource'
      - $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource'
      - $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource'
      - $ref: '#/components/schemas/ObservabilityPipelineLogstashSource'
    IncidentTeamType:
      default: teams
      description: Incident Team resource type.
      enum:
      - teams
      example: teams
      type: string
      x-enum-varnames:
      - TEAMS
    ObservabilityPipelineSensitiveDataScannerProcessorAction:
      description: Defines what action to take when sensitive data is matched.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedact'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHash'
      - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact'
    SoftwareCatalogTriggerWrapper:
      description: Schema for a Software Catalog-based trigger.
      properties:
        softwareCatalogTrigger:
          description: Trigger a workflow from Software Catalog.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - softwareCatalogTrigger
      type: object
    UpdateRuleRequestData:
      description: Data for the request to update a scorecard rule.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    ObservabilityPipelineNewRelicDestination:
      description: The `new_relic` destination sends logs to the New Relic platform.
      properties:
        id:
          description: The unique identifier for this component.
          example: new-relic-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        region:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationType'
      required:
      - id
      - type
      - inputs
      - region
      type: object
    ApplicationSecurityWafCustomRuleAction:
      description: The definition of `ApplicationSecurityWafCustomRuleAction` object.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionAction'
        parameters:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters'
      type: object
    DowntimeScheduleCurrentDowntimeResponse:
      description: 'The most recent actual start and end dates for a recurring downtime. For a canceled downtime,

        this is the previously occurring downtime. For active downtimes, this is the ongoing downtime, and for scheduled

        downtimes it is the upcoming downtime.'
      properties:
        end:
          description: The end of the current downtime.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          nullable: true
          type: string
        start:
          description: The start of the current downtime.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          type: string
      type: object
    ApplicationSecurityWafCustomRuleResponse:
      description: Response object that includes a single WAF custom rule.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData'
      type: object
    ScheduleMemberRelationshipsUserData:
      description: Points to the user data associated with this schedule member, including an ID and type.
      properties:
        id:
          description: The user's unique identifier.
          example: 00000000-aba1-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/ScheduleMemberRelationshipsUserDataType'
      required:
      - type
      - id
      type: object
    EntityV3DatadogLogItem:
      additionalProperties: false
      description: Log association item.
      properties:
        name:
          description: The name of the query.
          type: string
          example: Example Monitor
        query:
          description: The query to run.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    DowntimeScheduleRecurrenceCreateUpdateRequest:
      additionalProperties: {}
      description: An object defining the recurrence of the downtime.
      properties:
        duration:
          $ref: '#/components/schemas/DowntimeScheduleRecurrenceDuration'
        rrule:
          $ref: '#/components/schemas/DowntimeScheduleRecurrenceRrule'
        start:
          description: 'ISO-8601 Datetime to start the downtime. Must not include a UTC offset. If not provided, the

            downtime starts the moment it is created.'
          example: 2020-01-02T03:04
          nullable: true
          type: string
      required:
      - duration
      - rrule
      type: object
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    UserUpdateRequest:
      description: Update a user.
      properties:
        data:
          $ref: '#/components/schemas/UserUpdateData'
      required:
      - data
      type: object
    AzureStorageDestination:
      description: The `azure_storage` destination forwards logs to an Azure Blob Storage container.
      properties:
        blob_prefix:
          description: Optional prefix for blobs written to the container.
          example: logs/
          type: string
        container_name:
          description: The name of the Azure Blob Storage container to store logs in.
          example: my-log-container
          type: string
        id:
          description: The unique identifier for this component.
          example: azure-storage-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - processor-id
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/AzureStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - container_name
      type: object
    MonitorNotificationRuleResponseAttributes:
      additionalProperties: {}
      description: Attributes of the monitor notification rule.
      properties:
        created:
          description: Creation time of the monitor notification rule.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          type: string
        filter:
          $ref: '#/components/schemas/MonitorNotificationRuleFilter'
        modified:
          description: Time the monitor notification rule was last modified.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          type: string
        name:
          $ref: '#/components/schemas/MonitorNotificationRuleName'
        recipients:
          $ref: '#/components/schemas/MonitorNotificationRuleRecipients'
      type: object
    HTTPBody:
      description: The definition of `HTTPBody` object.
      properties:
        content:
          description: Serialized body content
          example: '{"some-json": "with-value"}'
          type: string
        content_type:
          description: Content type of the body
          example: application/json
          type: string
      type: object
    ObservabilityPipelineHttpServerSource:
      description: The `http_server` source collects logs over HTTP POST from external services.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: Unique ID for the HTTP server source.
          example: http-server-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType'
      required:
      - id
      - type
      - auth_strategy
      - decoding
      type: object
    RumMetricUpdateData:
      description: The new rum-based metric properties.
      properties:
        attributes:
          $ref: '#/components/schemas/RumMetricUpdateAttributes'
        id:
          $ref: '#/components/schemas/RumMetricID'
        type:
          $ref: '#/components/schemas/RumMetricType'
      required:
      - type
      - attributes
      type: object
    OktaAccountType:
      default: okta-accounts
      description: Account type for an Okta account.
      enum:
      - okta-accounts
      example: okta-accounts
      type: string
      x-enum-varnames:
      - OKTA_ACCOUNTS
    EscalationPolicyStep:
      description: Represents a single step in an escalation policy, including its attributes, relationships, and resource type.
      properties:
        attributes:
          $ref: '#/components/schemas/EscalationPolicyStepAttributes'
        id:
          description: Specifies the unique identifier of this escalation policy step.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/EscalationPolicyStepRelationships'
        type:
          $ref: '#/components/schemas/EscalationPolicyStepType'
      required:
      - type
      type: object
    ServiceDefinitionData:
      description: Service definition data.
      properties:
        attributes:
          $ref: '#/components/schemas/ServiceDefinitionDataAttributes'
        id:
          description: Service definition id.
          type: string
          example: abc-123-def
        type:
          description: Service definition type.
          type: string
          example: metric alert
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorType:
      default: sensitive_data_scanner
      description: The processor type. The value should always be `sensitive_data_scanner`.
      enum:
      - sensitive_data_scanner
      example: sensitive_data_scanner
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER
    IncidentFieldAttributesValueType:
      default: multiselect
      description: Type of the multiple value field definitions.
      enum:
      - multiselect
      - textarray
      - metrictag
      - autocomplete
      example: multiselect
      type: string
      x-enum-varnames:
      - MULTISELECT
      - TEXTARRAY
      - METRICTAG
      - AUTOCOMPLETE
    IncidentServiceRelationships:
      description: The incident service's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    RelationshipToIncidentIntegrationMetadatas:
      description: A relationship reference for multiple integration metadata objects.
      example:
        data:
        - id: 00000000-abcd-0005-0000-000000000000
          type: incident_integrations
        - id: 00000000-abcd-0006-0000-000000000000
          type: incident_integrations
      properties:
        data:
          description: Integration metadata relationship array
          example:
          - id: 00000000-abcd-0003-0000-000000000000
            type: incident_integrations
          - id: 00000000-abcd-0004-0000-000000000000
            type: incident_integrations
          items:
            $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadataData'
          type: array
      required:
      - data
      type: object
    SecurityMonitoringRuleHardcodedEvaluatorType:
      description: Hardcoded evaluator type.
      enum:
      - log4shell
      type: string
      x-enum-varnames:
      - LOG4SHELL
    ObservabilityPipelineGooglePubSubSourceType:
      default: google_pubsub
      description: The source type. The value should always be `google_pubsub`.
      enum:
      - google_pubsub
      example: google_pubsub
      type: string
      x-enum-varnames:
      - GOOGLE_PUBSUB
    GCPMetricNamespaceConfig:
      description: Configuration for a GCP metric namespace.
      properties:
        disabled:
          default: false
          description: When disabled, Datadog does not collect metrics that are related to this GCP metric namespace.
          example: true
          type: boolean
        id:
          description: The id of the GCP metric namespace.
          example: aiplatform
          type: string
      type: object
    TeamTargetType:
      default: teams
      description: Indicates that the resource is of type `teams`.
      enum:
      - teams
      example: teams
      type: string
      x-enum-varnames:
      - TEAMS
    TeamPermissionSettingValues:
      description: Possible values for action
      items:
        $ref: '#/components/schemas/TeamPermissionSettingValue'
      readOnly: true
      type: array
    CloudWorkloadSecurityAgentRuleActions:
      description: The array of actions the rule can perform if triggered
      items:
        $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAction'
      nullable: true
      type: array
    ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact:
      description: Configuration for partially redacting matched sensitive data.
      properties:
        action:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction'
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions'
      required:
      - action
      - options
      type: object
    ObservabilityPipelineMetricValue:
      description: Specifies how the value of the generated metric is computed.
      oneOf:
      - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOne'
      - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByField'
    ScheduleUser:
      description: Represents a user object in the context of a schedule, including their `id`, type, and basic attributes.
      properties:
        attributes:
          $ref: '#/components/schemas/ScheduleUserAttributes'
        id:
          description: The unique user identifier.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/ScheduleUserType'
      required:
      - type
      type: object
    AWSAccountUpdateRequestData:
      description: AWS Account Update Request data.
      properties:
        attributes:
          $ref: '#/components/schemas/AWSAccountUpdateRequestAttributes'
        id:
          $ref: '#/components/schemas/AWSAccountConfigID'
        type:
          $ref: '#/components/schemas/AWSAccountType'
      required:
      - attributes
      - type
      type: object
    SecurityFilterID:
      description: The ID of the security filter.
      example: 3dd-0uc-h1s
      type: string
    IncidentTrigger:
      description: Trigger a workflow from an Incident. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    LogsArchive:
      description: The logs archive.
      properties:
        data:
          $ref: '#/components/schemas/LogsArchiveDefinition'
      type: object
    UpdateResourceEvaluationFiltersRequest:
      description: Request object to update a resource filter.
      properties:
        data:
          $ref: '#/components/schemas/UpdateResourceEvaluationFiltersRequestData'
      required:
      - data
      type: object
    RumMetricID:
      description: The name of the rum-based metric.
      example: rum.sessions.webui.count
      type: string
    SelfServiceTriggerWrapper:
      description: Schema for a Self Service-based trigger.
      properties:
        selfServiceTrigger:
          description: Trigger a workflow from Self Service.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - selfServiceTrigger
      type: object
    RestrictionQueryUpdateData:
      description: Data related to the update of a restriction query.
      properties:
        attributes:
          $ref: '#/components/schemas/RestrictionQueryUpdateAttributes'
        type:
          $ref: '#/components/schemas/LogsRestrictionQueriesType'
      type: object
    MonitorTrigger:
      description: Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    OpsgenieServiceUpdateAttributes:
      description: The Opsgenie service attributes for an update request.
      properties:
        custom_url:
          description: The custom URL for a custom region.
          example: https://example.com
          nullable: true
          type: string
        name:
          description: The name for the Opsgenie service.
          example: fake-opsgenie-service-name
          maxLength: 100
          type: string
        opsgenie_api_key:
          description: The Opsgenie API key for your Opsgenie service.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        region:
          $ref: '#/components/schemas/OpsgenieServiceRegionType'
      type: object
      x-merge-override:
        required: false
    AWSNamespaceFiltersIncludeOnly:
      description: Include only these namespaces.
      properties:
        include_only:
          description: Include only these namespaces.
          example:
          - AWS/EC2
          items:
            example: AWS/EC2
            type: string
          type: array
      required:
      - include_only
      type: object
    EntityV3DatadogLogs:
      additionalProperties: false
      description: Logs association.
      items:
        $ref: '#/components/schemas/EntityV3DatadogLogItem'
      type: array
    SecurityMonitoringSuppression:
      description: The suppression rule's properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionAttributes'
        id:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionID'
        type:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionType'
      type: object
    ServiceDefinitionV2Dot1:
      description: Service definition v2.1 for providing service metadata and integrations.
      properties:
        application:
          description: Identifier for a group of related services serving a product feature, which the service is a part of.
          example: my-app
          type: string
        contacts:
          description: A list of contacts related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Dot1Contact'
          type: array
        dd-service:
          description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog.
          example: my-service
          type: string
        description:
          description: A short description of the service.
          example: My service description
          type: string
        extensions:
          additionalProperties: {}
          description: Extensions to v2.1 schema.
          example:
            myorg/extension: extensionValue
          type: object
        integrations:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1Integrations'
        lifecycle:
          description: The current life cycle phase of the service.
          example: sandbox
          type: string
        links:
          description: A list of links related to the services.
          items:
            $ref: '#/components/schemas/ServiceDefinitionV2Dot1Link'
          type: array
        schema-version:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1Version'
        tags:
          description: A set of custom tags.
          example:
          - my:tag
          - service:tag
          items:
            type: string
          type: array
        team:
          description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists.
          example: my-team
          type: string
        tier:
          description: Importance of the service.
          example: High
          type: string
      required:
      - schema-version
      - dd-service
      type: object
    RelationshipToIncidentResponders:
      description: Relationship to incident responders.
      properties:
        data:
          description: An array of incident responders.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentResponderData'
          type: array
      required:
      - data
      type: object
    RetentionFilterAllType:
      default: spans-sampling-processor
      description: The type of retention filter.
      enum:
      - spans-sampling-processor
      - spans-errors-sampling-processor
      - spans-appsec-sampling-processor
      example: spans-sampling-processor
      type: string
      x-enum-varnames:
      - SPANS_SAMPLING_PROCESSOR
      - SPANS_ERRORS_SAMPLING_PROCESSOR
      - SPANS_APPSEC_SAMPLING_PROCESSOR
    CloudflareAccountResponseAttributes:
      description: Attributes object of a Cloudflare account.
      properties:
        email:
          description: The email associated with the Cloudflare account.
          example: test-email@example.com
          type: string
        name:
          description: The name of the Cloudflare account.
          example: test-name
          type: string
        resources:
          description: An allowlist of resources, such as `web`, `dns`, `lb` (load balancer), `worker`, that restricts pulling metrics from those resources.
          example:
          - web
          - dns
          - lb
          - worker
          items:
            type: string
          type: array
        zones:
          description: An allowlist of zones to restrict pulling metrics for.
          example:
          - zone_id_1
          - zone_id_2
          items:
            type: string
          type: array
      required:
      - name
      type: object
    ObservabilityPipelineEnrichmentTableFile:
      description: Defines a static enrichment table loaded from a CSV file.
      properties:
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncoding'
        key:
          description: Key fields used to look up enrichment values.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItems'
          type: array
        path:
          description: Path to the CSV file.
          example: /etc/enrichment/lookup.csv
          type: string
        schema:
          description: Schema defining column names and their types.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItems'
          type: array
      required:
      - encoding
      - key
      - path
      - schema
      type: object
    CloudWorkloadSecurityAgentRuleActionMetadata:
      description: The metadata action applied on the scope matching the rule
      properties:
        image_tag:
          description: The image tag of the metadata action
          type: string
          example: env:production
        service:
          description: The service of the metadata action
          type: string
          example: example_value
        short_image:
          description: The short image of the metadata action
          type: string
          example: example_value
      type: object
    Layer:
      description: Encapsulates a layer resource, holding attributes like rotation details, plus relationships to the members covering that layer.
      properties:
        attributes:
          $ref: '#/components/schemas/LayerAttributes'
        id:
          description: A unique identifier for this layer.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/LayerRelationships'
        type:
          $ref: '#/components/schemas/LayerType'
      required:
      - type
      type: object
    RumRetentionFilterEventType:
      description: The type of RUM events to filter on.
      enum:
      - session
      - view
      - action
      - error
      - resource
      - long_task
      - vital
      example: session
      type: string
      x-enum-varnames:
      - SESSION
      - VIEW
      - ACTION
      - ERROR
      - RESOURCE
      - LONG_TASK
      - VITAL
    ApplicationSecurityWafCustomRuleTags:
      additionalProperties:
        type: string
      description: 'Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security

        activity field associated with the traces.'
      maxProperties: 32
      properties:
        category:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory'
        type:
          description: The type of the WAF rule, associated with the category will form the security activity.
          example: users.login.success
          type: string
      required:
      - category
      - type
      type: object
    IPAllowlistEntryData:
      description: Data of the IP allowlist entry object.
      properties:
        attributes:
          $ref: '#/components/schemas/IPAllowlistEntryAttributes'
        id:
          description: The unique identifier of the IP allowlist entry.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/IPAllowlistEntryType'
      required:
      - type
      type: object
    HTTPHeader:
      description: The definition of `HTTPHeader` object.
      properties:
        name:
          description: The `HTTPHeader` `name`.
          example: MyHttpHeader
          pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$
          type: string
        value:
          description: The `HTTPHeader` `value`.
          example: Some header value
          type: string
      required:
      - name
      - value
      type: object
    OktaAccountUpdateRequestData:
      description: Data object for updating an Okta account.
      properties:
        attributes:
          $ref: '#/components/schemas/OktaAccountUpdateRequestAttributes'
        type:
          $ref: '#/components/schemas/OktaAccountType'
      type: object
    OutputSchema:
      description: A list of output parameters for the workflow.
      properties:
        parameters:
          description: The `OutputSchema` `parameters`.
          items:
            $ref: '#/components/schemas/OutputSchemaParameters'
          type: array
      type: object
    LogsArchiveDefinition:
      description: The definition of an archive.
      properties:
        attributes:
          $ref: '#/components/schemas/LogsArchiveAttributes'
        id:
          description: The archive ID.
          example: a2zcMylnM4OCHpYusxIi3g
          readOnly: true
          type: string
        type:
          default: archives
          description: The type of the resource. The value should always be archives.
          example: archives
          readOnly: true
          type: string
      required:
      - type
      type: object
    AWSAssumeRole:
      description: The definition of `AWSAssumeRole` object.
      properties:
        account_id:
          description: AWS account the connection is created for
          example: '111222333444'
          pattern: ^\d{12}$
          type: string
        external_id:
          description: External ID used to scope which connection can be used to assume the role
          example: 33a1011635c44b38a064cf14e82e1d8f
          readOnly: true
          type: string
        principal_id:
          description: AWS account that will assume the role
          example: '123456789012'
          readOnly: true
          type: string
        role:
          description: Role to assume
          example: my-role
          type: string
        type:
          $ref: '#/components/schemas/AWSAssumeRoleType'
      required:
      - type
      - account_id
      - role
      type: object
    IncidentServiceResponseAttributes:
      description: The incident service's attributes from a response.
      properties:
        created:
          description: Timestamp of when the incident service was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        modified:
          description: Timestamp of when the incident service was modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        name:
          description: Name of the incident service.
          example: service name
          type: string
      type: object
    ServiceDefinitionV2Dot1Slack:
      description: Service owner's Slack channel.
      properties:
        contact:
          description: Slack Channel.
          example: https://yourcompany.slack.com/archives/channel123
          type: string
        name:
          description: Contact Slack.
          example: Team Slack
          type: string
        type:
          $ref: '#/components/schemas/ServiceDefinitionV2Dot1SlackType'
      required:
      - type
      - contact
      type: object
    RelationshipToIncidentImpactData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the impact.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentImpactsType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    FastlyAccountResponseData:
      description: Data object of a Fastly account.
      properties:
        attributes:
          $ref: '#/components/schemas/FastlyAccounResponseAttributes'
        id:
          description: The ID of the Fastly account, a hash of the account name.
          example: abc123
          type: string
        type:
          $ref: '#/components/schemas/FastlyAccountType'
      required:
      - attributes
      - id
      - type
      type: object
      x-merge-override:
        required: false
    CustomDestinationResponseForwardDestinationElasticsearch:
      description: The Elasticsearch destination.
      properties:
        auth:
          $ref: '#/components/schemas/CustomDestinationResponseElasticsearchDestinationAuth'
        endpoint:
          description: 'The destination for which logs will be forwarded to.

            Must have HTTPS scheme and forwarding back to Datadog is not allowed.'
          example: https://example.com
          type: string
        index_name:
          description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)).
          example: nginx-logs
          type: string
        index_rotation:
          description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-`

            (that is, `${index_name}-${indexPattern}`).

            You can customize the index rotation naming pattern by choosing one of these options:

            - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`)

            - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`)

            - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`)

            - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`)


            If this field is missing or is blank, it means that the index name will always be the same

            (that is, no rotation).'
          example: yyyy-MM-dd
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearchType'
      required:
      - type
      - endpoint
      - auth
      - index_name
      type: object
    CustomDestinationResponseForwardDestinationElasticsearchType:
      default: elasticsearch
      description: Type of the Elasticsearch destination.
      enum:
      - elasticsearch
      example: elasticsearch
      type: string
      x-enum-varnames:
      - ELASTICSEARCH
    RelationshipToUserTeamUser:
      description: Relationship between team membership and user
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToUserTeamUserData'
      required:
      - data
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction:
      description: Action type that completely replaces the matched sensitive data with a fixed replacement string to remove all visibility.
      enum:
      - redact
      example: redact
      type: string
      x-enum-varnames:
      - REDACT
    AWSAccountType:
      default: account
      description: AWS Account resource type.
      enum:
      - account
      example: account
      type: string
      x-enum-varnames:
      - ACCOUNT
    LayerRelationshipsMembersDataItems:
      description: 'Represents a single member object in a layer''s `members` array, referencing

        a unique Datadog user ID.'
      properties:
        id:
          description: The unique user ID of the layer member.
          example: 00000000-0000-0000-0000-000000000002
          type: string
        type:
          $ref: '#/components/schemas/LayerRelationshipsMembersDataItemsType'
      required:
      - type
      - id
      type: object
    SecurityMonitoringSuppressionUpdateAttributes:
      description: The suppression rule properties to be updated.
      properties:
        data_exclusion_query:
          description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
          example: source:cloudtrail account_id:12345
          type: string
        description:
          description: A description for the suppression rule.
          example: This rule suppresses low-severity signals in staging environments.
          type: string
        enabled:
          description: Whether the suppression rule is enabled.
          example: true
          type: boolean
        expiration_date:
          description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. If unset, the expiration date of the suppression rule is left untouched. If set to `null`, the expiration date is removed.
          example: 1703187336000
          format: int64
          nullable: true
          type: integer
        name:
          description: The name of the suppression rule.
          example: Custom suppression
          type: string
        rule_query:
          description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
          example: type:log_detection source:cloudtrail
          type: string
        start_date:
          description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. If unset, the start date of the suppression rule is left untouched. If set to `null`, the start date is removed.
          example: 1703187336000
          format: int64
          nullable: true
          type: integer
        suppression_query:
          description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
          example: env:staging status:low
          type: string
        version:
          description: The current version of the suppression. This is optional, but it can help prevent concurrent modifications.
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
      type: object
    ObservabilityPipelineReduceProcessorMergeStrategyStrategy:
      description: The merge strategy to apply.
      enum:
      - discard
      - retain
      - sum
      - max
      - min
      - array
      - concat
      - concat_newline
      - concat_raw
      - shortest_array
      - longest_array
      - flat_unique
      example: flat_unique
      type: string
      x-enum-varnames:
      - DISCARD
      - RETAIN
      - SUM
      - MAX
      - MIN
      - ARRAY
      - CONCAT
      - CONCAT_NEWLINE
      - CONCAT_RAW
      - SHORTEST_ARRAY
      - LONGEST_ARRAY
      - FLAT_UNIQUE
    EscalationPolicyUpdateRequestDataType:
      default: policies
      description: Indicates that the resource is of type `policies`.
      enum:
      - policies
      example: policies
      type: string
      x-enum-varnames:
      - POLICIES
    MonitorNotificationRuleUpdateRequest:
      description: Request for updating a monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleUpdateRequestData'
      required:
      - data
      type: object
    SensitiveDataScannerStandardPatternType:
      default: sensitive_data_scanner_standard_pattern
      description: Sensitive Data Scanner standard pattern type.
      enum:
      - sensitive_data_scanner_standard_pattern
      example: sensitive_data_scanner_standard_pattern
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_STANDARD_PATTERN
    SecurityMonitoringThirdPartyRootQuery:
      description: A query to be combined with the third party case query.
      properties:
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        query:
          description: Query to run on logs.
          example: source:cloudtrail
          type: string
      type: object
    RumMetricUpdateAttributes:
      description: The rum-based metric properties that will be updated.
      properties:
        compute:
          $ref: '#/components/schemas/RumMetricUpdateCompute'
        filter:
          $ref: '#/components/schemas/RumMetricFilter'
        group_by:
          description: The rules for the group by.
          items:
            $ref: '#/components/schemas/RumMetricGroupBy'
          type: array
      type: object
    CustomDestinationResponseForwardDestinationHttp:
      description: The HTTP destination.
      properties:
        auth:
          $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuth'
        endpoint:
          description: 'The destination for which logs will be forwarded to.

            Must have HTTPS scheme and forwarding back to Datadog is not allowed.'
          example: https://example.com
          type: string
        type:
          $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttpType'
      required:
      - type
      - endpoint
      - auth
      type: object
    SecurityMonitoringRuleUpdatePayload:
      description: Update an existing rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        version:
          description: The version of the rule being updated.
          example: 1
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    FastlyServiceRequest:
      description: Payload schema for Fastly service requests.
      properties:
        data:
          $ref: '#/components/schemas/FastlyServiceData'
      required:
      - data
      type: object
    AWSAccountUpdateRequestAttributes:
      description: The AWS Account Integration Config to be updated.
      properties:
        account_tags:
          $ref: '#/components/schemas/AWSAccountTags'
        auth_config:
          $ref: '#/components/schemas/AWSAuthConfig'
        aws_account_id:
          $ref: '#/components/schemas/AWSAccountID'
        aws_partition:
          $ref: '#/components/schemas/AWSAccountPartition'
        aws_regions:
          $ref: '#/components/schemas/AWSRegions'
        logs_config:
          $ref: '#/components/schemas/AWSLogsConfig'
        metrics_config:
          $ref: '#/components/schemas/AWSMetricsConfig'
        resources_config:
          $ref: '#/components/schemas/AWSResourcesConfig'
        traces_config:
          $ref: '#/components/schemas/AWSTracesConfig'
      required:
      - aws_account_id
      type: object
    EscalationPolicyUpdateRequestDataAttributes:
      description: Defines the attributes that can be updated for an escalation policy, such as description, name, resolution behavior, retries, and steps.
      properties:
        name:
          description: Specifies the name of the escalation policy.
          example: On-Call Escalation Policy
          type: string
        resolve_page_on_policy_end:
          description: Indicates whether the page is automatically resolved when the policy ends.
          type: boolean
          example: true
        retries:
          description: Specifies how many times the escalation sequence is retried if there is no response.
          format: int64
          type: integer
          example: 42
        steps:
          description: A list of escalation steps, each defining assignment, escalation timeout, and targets.
          items:
            $ref: '#/components/schemas/EscalationPolicyUpdateRequestDataAttributesStepsItems'
          type: array
      required:
      - name
      - steps
      type: object
    IncidentSeverity:
      description: The incident severity.
      enum:
      - UNKNOWN
      - SEV-0
      - SEV-1
      - SEV-2
      - SEV-3
      - SEV-4
      - SEV-5
      example: UNKNOWN
      type: string
      x-enum-varnames:
      - UNKNOWN
      - SEV_0
      - SEV_1
      - SEV_2
      - SEV_3
      - SEV_4
      - SEV_5
    EscalationPolicyStepAttributes:
      description: Defines attributes for an escalation policy step, such as assignment strategy and escalation timeout.
      properties:
        assignment:
          $ref: '#/components/schemas/EscalationPolicyStepAttributesAssignment'
        escalate_after_seconds:
          description: Specifies how many seconds to wait before escalating to the next step.
          format: int64
          type: integer
          example: 42
      type: object
    UpdateAppResponseDataAttributes:
      description: The updated app definition attributes, such as name, description, and components.
      properties:
        components:
          description: The UI components that make up the app.
          items:
            $ref: '#/components/schemas/ComponentGrid'
          type: array
        description:
          description: The human-readable description for the app.
          type: string
          example: example_value
        favorite:
          description: Whether the app is marked as a favorite by the current user.
          type: boolean
          example: true
        name:
          description: The name of the app.
          type: string
          example: Example Monitor
        queries:
          description: An array of queries, such as external actions and state variables, that the app uses.
          items:
            $ref: '#/components/schemas/Query'
          type: array
        rootInstanceName:
          description: The name of the root component of the app. This must be a `grid` component that contains all other components.
          type: string
          example: Example Monitor
        tags:
          description: A list of tags for the app, which can be used to filter apps.
          example:
          - service:webshop-backend
          - team:webshop
          items:
            description: An individual tag for the app.
            type: string
          type: array
      type: object
    ApplicationSecurityWafExclusionFilterID:
      description: The identifier of the WAF exclusion filter.
      example: 3dd-0uc-h1s
      readOnly: true
      type: string
    ObservabilityPipelineOpenSearchDestination:
      description: The `opensearch` destination writes logs to an OpenSearch cluster.
      properties:
        bulk_index:
          description: The index to write logs to.
          example: logs-index
          type: string
        id:
          description: The unique identifier for this component.
          example: opensearch-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - filter-processor
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestinationType'
      required:
      - id
      - type
      - inputs
      type: object
    DowntimeResponseIncludedItem:
      description: An object related to a downtime.
      oneOf:
      - $ref: '#/components/schemas/User'
      - $ref: '#/components/schemas/DowntimeMonitorIncludedItem'
    AWSAuthConfig:
      description: AWS Authentication config.
      oneOf:
      - $ref: '#/components/schemas/AWSAuthConfigKeys'
      - $ref: '#/components/schemas/AWSAuthConfigRole'
    SecurityFilterAttributes:
      description: The object describing a security filter.
      properties:
        exclusion_filters:
          description: The list of exclusion filters applied in this security filter.
          items:
            $ref: '#/components/schemas/SecurityFilterExclusionFilterResponse'
          type: array
        filtered_data_type:
          $ref: '#/components/schemas/SecurityFilterFilteredDataType'
        is_builtin:
          description: Whether the security filter is the built-in filter.
          example: false
          type: boolean
        is_enabled:
          description: Whether the security filter is enabled.
          example: false
          type: boolean
        name:
          description: The security filter name.
          example: Custom security filter
          type: string
        query:
          description: The security filter query. Logs accepted by this query will be accepted by this filter.
          example: service:api
          type: string
        version:
          description: The version of the security filter.
          example: 1
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    SpansMetricComputeAggregationType:
      description: The type of aggregation to use.
      enum:
      - count
      - distribution
      example: distribution
      type: string
      x-enum-varnames:
      - COUNT
      - DISTRIBUTION
    TeamReferenceType:
      default: teams
      description: Teams resource type.
      enum:
      - teams
      example: teams
      type: string
      x-enum-varnames:
      - TEAMS
  responses:
    PreconditionFailedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Failed Precondition
    NotAuthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Authorized
    ForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Forbidden
    ConcurrentModificationResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Concurrent Modification
    TooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Too many requests
    UnauthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Unauthorized
    NotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Found
    ConflictResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Conflict
    BadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Bad Request
  parameters:
    SensitiveDataScannerGroupID:
      description: The ID of a group of rules.
      in: path
      name: group_id
      required: true
      schema:
        type: string
    ApplicationSecurityWafCustomRuleIDParam:
      description: The ID of the custom rule.
      example: 3b5-v82-ns6
      in: path
      name: custom_rule_id
      required: true
      schema:
        type: string
    SecurityMonitoringRuleID:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    CustomDestinationId:
      description: The ID of the custom destination.
      in: path
      name: custom_destination_id
      required: true
      schema:
        type: string
    FastlyAccountID:
      description: Fastly Account id.
      in: path
      name: account_id
      required: true
      schema:
        type: string
    RumMetricIDParameter:
      description: The name of the rum-based metric.
      in: path
      name: metric_id
      required: true
      schema:
        type: string
    IncidentTeamIDPathParameter:
      description: The ID of the incident team.
      in: path
      name: team_id
      required: true
      schema:
        type: string
    IncidentServiceIDPathParameter:
      description: The ID of the incident service.
      in: path
      name: service_id
      required: true
      schema:
        type: string
    RuleId:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    CustomFrameworkVersion:
      description: The framework version
      in: path
      name: version
      required: true
      schema:
        type: string
    SecurityMonitoringSuppressionID:
      description: The ID of the suppression rule
      in: path
      name: suppression_id
      required: true
      schema:
        type: string
    MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter:
      description: Your Workflows webhook handle id.
      in: path
      name: handle_id
      required: true
      schema:
        type: string
    FastlyServiceID:
      description: Fastly Service ID.
      in: path
      name: service_id
      required: true
      schema:
        type: string
    RestrictionQueryID:
      description: The ID of the restriction query.
      in: path
      name: restriction_query_id
      required: true
      schema:
        type: string
    CloudAccountID:
      description: Cloud Account id.
      in: path
      name: cloud_account_id
      required: true
      schema:
        type: string
    UserID:
      description: The ID of the user.
      in: path
      name: user_id
      required: true
      schema:
        example: 00000000-0000-9999-0000-000000000000
        type: string
    IncidentTypeIDPathParameter:
      description: The UUID of the incident type.
      in: path
      name: incident_type_id
      required: true
      schema:
        type: string
    IncidentTodoIDPathParameter:
      description: The UUID of the incident todo.
      in: path
      name: todo_id
      required: true
      schema:
        type: string
    WorkflowId:
      description: The ID of the workflow.
      in: path
      name: workflow_id
      required: true
      schema:
        type: string
    IncidentAttachmentIncludeQueryParameter:
      description: Specifies which types of related objects are included in the response.
      explode: false
      in: query
      name: include
      required: false
      schema:
        items:
          $ref: '#/components/schemas/IncidentAttachmentRelatedObject'
        type: array
    SecurityFilterID:
      description: The ID of the security filter.
      in: path
      name: security_filter_id
      required: true
      schema:
        type: string
    IncidentIDPathParameter:
      description: The UUID of the incident.
      in: path
      name: incident_id
      required: true
      schema:
        type: string
    IncidentIntegrationMetadataIDPathParameter:
      description: The UUID of the incident integration metadata.
      in: path
      name: integration_metadata_id
      required: true
      schema:
        type: string
    GCPSTSServiceAccountID:
      description: Your GCP STS enabled service account's unique ID.
      in: path
      name: account_id
      required: true
      schema:
        type: string
    SpansMetricIDParameter:
      description: The name of the span-based metric.
      in: path
      name: metric_id
      required: true
      schema:
        type: string
    OpsgenieServiceIDPathParameter:
      description: The UUID of the service.
      in: path
      name: integration_service_id
      required: true
      schema:
        type: string
    ResourceID:
      description: 'Identifier, formatted as `type:id`. Supported types: `connection`, `dashboard`, `integration-account`, `integration-service`, `integration-webhook`, `notebook`, `reference-table`, `security-rule`, `slo`, `workflow`, `app-builder-app`, `connection`, `connection-group`, `rum-application`.'
      example: dashboard:abc-def-ghi
      in: path
      name: resource_id
      required: true
      schema:
        type: string
    RumApplicationIDParameter:
      description: RUM application ID.
      in: path
      name: app_id
      required: true
      schema:
        type: string
    CustomFrameworkHandle:
      description: The framework handle
      in: path
      name: handle
      required: true
      schema:
        type: string
    MetricID:
      description: The name of the log-based metric.
      in: path
      name: metric_id
      required: true
      schema:
        type: string
    RoleID:
      description: The unique identifier of the role.
      in: path
      name: role_id
      required: true
      schema:
        type: string
    ApplicationSecurityWafExclusionFilterID:
      description: The identifier of the WAF exclusion filter.
      example: 3b5-v82-ns6
      in: path
      name: exclusion_filter_id
      required: true
      schema:
        type: string
    CloudWorkloadSecurityAgentRuleID:
      description: The ID of the Agent rule
      example: 3b5-v82-ns6
      in: path
      name: agent_rule_id
      required: true
      schema:
        type: string
    SensitiveDataScannerRuleID:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    ArchiveID:
      description: The ID of the archive.
      in: path
      name: archive_id
      required: true
      schema:
        type: string
    ConfluentAccountID:
      description: Confluent Account ID.
      in: path
      name: account_id
      required: true
      schema:
        type: string
    ConnectionId:
      description: The ID of the action connection
      in: path
      name: connection_id
      required: true
      schema:
        type: string
    RetentionFilterIdParam:
      description: The ID of the retention filter.
      in: path
      name: filter_id
      required: true
      schema:
        type: string
    RumRetentionFilterIDParameter:
      description: Retention filter ID.
      in: path
      name: rf_id
      required: true
      schema:
        type: string
    ConfluentResourceID:
      description: Confluent Account Resource ID.
      in: path
      name: resource_id
      required: true
      schema:
        type: string
    IncidentIncludeQueryParameter:
      description: Specifies which types of related objects should be included in the response.
      explode: false
      in: query
      name: include
      required: false
      schema:
        items:
          $ref: '#/components/schemas/IncidentRelatedObject'
        type: array
    MetricName:
      description: The name of the metric.
      example: dist.http.endpoint.request
      in: path
      name: metric_name
      required: true
      schema:
        type: string
    MicrosoftTeamsTenantBasedHandleIDPathParameter:
      description: Your tenant-based handle id.
      in: path
      name: handle_id
      required: true
      schema:
        type: string
    AWSAccountConfigIDPathParameter:
      description: 'Unique Datadog ID of the AWS Account Integration Config. To get the config ID for an account, use the

        [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations) endpoint and query by AWS Account ID.'
      in: path
      name: aws_account_config_id
      required: true
      schema:
        type: string
    OrgConfigName:
      description: The name of an Org Config.
      in: path
      name: org_config_name
      required: true
      schema:
        example: monitor_timezone
        type: string
    CloudWorkloadSecurityPathAgentPolicyID:
      description: The ID of the Agent policy
      example: 6517fcc1-cec7-4394-a655-8d6e9d085255
      in: path
      name: policy_id
      required: true
      schema:
        type: string
    CaseIDPathParameter:
      description: Case's UUID or key
      example: f98a5a5b-e0ff-45d4-b2f5-afe6e74de504
      in: path
      name: case_id
      required: true
      schema:
        type: string
    CloudWorkloadSecurityQueryAgentPolicyID:
      description: The ID of the Agent policy
      example: 6517fcc1-cec7-4394-a655-8d6e9d085255
      in: query
      name: policy_id
      required: false
      schema:
        type: string
  securitySchemes:
    AuthZ:
      description: This API uses OAuth 2 with the implicit grant flow.
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          scopes:
            apm_api_catalog_read: View API catalog and API definitions.
            apm_api_catalog_write: Add, modify, and delete API catalog definitions.
            apm_read: Read and query APM and Trace Analytics.
            apm_service_catalog_read: View service catalog and service definitions.
            apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
            appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source.
            cases_read: View Cases.
            cases_write: Create and update cases.
            ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API.
            ci_visibility_read: View CI Visibility.
            cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.
            cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.
            code_analysis_read: View Code Analysis.
            continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO).
            create_webhooks: Create webhooks integrations.
            dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'.
            dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'.
            dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally.
            dashboards_read: View dashboards.
            dashboards_write: Create and change dashboards.
            data_scanner_read: View Data Scanner configurations.
            data_scanner_write: Edit Data Scanner configurations.
            embeddable_graphs_share: Generate public links to share embeddable graphs externally.
            events_read: Read Events data.
            hosts_read: List hosts and their attributes.
            incident_notification_settings_write: Configure Incidents Notification settings.
            incident_read: View incidents in Datadog.
            incident_settings_write: Configure Incident Settings.
            incident_write: Create, view, and manage incidents in Datadog.
            metrics_read: View custom metrics.
            monitor_config_policy_write: Edit and delete monitor configuration.
            monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.
            monitors_read: View monitors.
            monitors_write: Edit, delete, and resolve individual monitors.
            org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.
            security_comments_read: Read comments of vulnerabilities.
            security_monitoring_filters_read: Read Security Filters.
            security_monitoring_filters_write: Create, edit, and delete Security Filters.
            security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks.
            security_monitoring_notification_profiles_read: View Rule Security Notification rules.
            security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules.
            security_monitoring_rules_read: Read Detection Rules.
            security_monitoring_rules_write: Create and edit Detection Rules.
            security_monitoring_signals_read: View Security Signals.
            security_monitoring_suppressions_read: Read Rule Suppressions.
            security_monitoring_suppressions_write: Write Rule Suppressions.
            security_pipelines_read: View Security Pipelines.
            security_pipelines_write: Create, edit, and delete CSM Security Pipelines.
            slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.
            slos_read: View SLOs and status corrections.
            slos_write: Create, edit, and delete SLOs.
            synthetics_global_variable_read: View, search, and use Synthetics global variables.
            synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics.
            synthetics_private_location_read: View, search, and use Synthetics private locations.
            synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines.
            synthetics_read: List and view configured Synthetic tests and test results.
            synthetics_write: Create, edit, and delete Synthetic tests.
            teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.
            teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.
            test_optimization_read: View Test Optimization.
            timeseries_query: Query Timeseries data.
            usage_read: View your organization's usage and usage attribution.
            user_access_invite: Invite other users to your organization.
            user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
            user_access_read: View users and their roles and settings.
            workflows_read: View workflows.
            workflows_run: Run workflows.
            workflows_write: Create, edit, and delete workflows.
          tokenUrl: /oauth2/v1/token
      type: oauth2
    apiKeyAuth:
      description: Your Datadog API Key.
      in: header
      name: DD-API-KEY
      type: apiKey
      x-env-name: DD_API_KEY
    appKeyAuth:
      description: Your Datadog APP Key.
      in: header
      name: DD-APPLICATION-KEY
      type: apiKey
      x-env-name: DD_APP_KEY
    bearerAuth:
      scheme: bearer
      type: http
      x-env-name: DD_BEARER_TOKEN
x-group-parameters: true
x-merge-override:
  paths: false