Datadog Existing API

openapi: 3.2.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Existing API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Existing
paths:
  /api/v2/incidents/{incident_id}:
    x-merge-override:
      delete: true
    patch:
      description: Updates an incident. Provide only the attributes that should be updated as this request is a partial update.
      operationId: UpdateIncident
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentIncludeQueryParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentUpdateRequest'
        description: Incident Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Existing Incident
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/{incident_id}/relationships/integrations/{integration_metadata_id}:
    patch:
      description: Update an existing incident integration metadata.
      operationId: UpdateIncidentIntegration
      parameters:
      - $ref: '#/components/parameters/IncidentIDPathParameter'
      - $ref: '#/components/parameters/IncidentIntegrationMetadataIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentIntegrationMetadataPatchRequest'
        description: Incident integration metadata payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentIntegrationMetadataResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_write
      summary: Datadog Update an Existing Incident Integration Metadata
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 12
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules/{rule_id}:
    put:
      description: Updates an existing rule.
      operationId: UpdateScorecardRule
      parameters:
      - $ref: '#/components/parameters/RuleId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRuleRequest'
        description: Rule attributes.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRuleResponse'
          description: Rule updated successfully
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Update an Existing Rule
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}:
    put:
      description: 'Update an existing rule. When updating `cases`, `queries` or `options`, the whole field

        must be included. For example, when modifying a query all queries must be included.

        Default rules can only be updated to be enabled, to change notifications, or to update

        the tags (default tags cannot be removed).'
      operationId: UpdateSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleUpdatePayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Update an Existing Rule
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}/test:
    post:
      description: Test an existing rule.
      operationId: TestExistingSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test an Existing Rule
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/services/{service_id}:
    patch:
      deprecated: true
      description: Updates an existing incident service. Only provide the attributes which should be updated as this request is a partial update.
      operationId: UpdateIncidentService
      parameters:
      - $ref: '#/components/parameters/IncidentServiceIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentServiceUpdateRequest'
        description: Incident Service Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentServiceResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Existing Incident Service
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/teams/{team_id}:
    patch:
      deprecated: true
      description: Updates an existing incident team. Only provide the attributes which should be updated as this request is a partial update.
      operationId: UpdateIncidentTeam
      parameters:
      - $ref: '#/components/parameters/IncidentTeamIDPathParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentTeamUpdateRequest'
        description: Incident Team Payload.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentTeamResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_settings_write
      summary: Datadog Update an Existing Incident Team
      tags:
      - Existing
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - incident_settings_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/workflows/{workflow_id}:
    get:
      description: Get a workflow by ID.  This API requires an application key scoped with the `workflows_read` permission.
      operationId: GetWorkflow
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWorkflowResponse'
          description: Successfully got a workflow.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too many requests
      summary: Datadog Get an Existing Workflow
      tags:
      - Existing
      x-menu-order: 1
      x-permission:
        operator: OR
        permissions:
        - workflows_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Update a workflow by ID. This API requires an application key scoped with the `workflows_write` permission.
      operationId: UpdateWorkflow
      parameters:
      - $ref: '#/components/parameters/WorkflowId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWorkflowRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateWorkflowResponse'
          description: Successfully updated a workflow.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Bad request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Not found
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: Too many requests
      summary: Datadog Update an Existing Workflow
      tags:
      - Existing
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - workflows_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    IncidentAttachmentPostmortemAttributes:
      description: The attributes object for a postmortem attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType'
      required:
      - attachment_type
      - attachment
      type: object
    IncidentPostmortemType:
      default: incident_postmortems
      description: Incident postmortem resource type.
      enum:
      - incident_postmortems
      example: incident_postmortems
      type: string
      x-enum-varnames:
      - INCIDENT_POSTMORTEMS
    IncidentServiceType:
      default: services
      description: Incident service resource type.
      enum:
      - services
      example: services
      type: string
      x-enum-varnames:
      - SERVICES
    IncidentUserDefinedFieldType:
      description: The incident user defined fields type.
      enum:
      - user_defined_field
      example: user_defined_field
      type: string
      x-enum-varnames:
      - USER_DEFINED_FIELD
    APITrigger:
      description: Trigger a workflow from an API request. The workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    WorkflowDataUpdateAttributes:
      description: The definition of `WorkflowDataUpdateAttributes` object.
      properties:
        createdAt:
          description: When the workflow was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        description:
          description: Description of the workflow.
          type: string
          example: example_value
        name:
          description: Name of the workflow.
          type: string
          example: Example Monitor
        published:
          description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
          type: boolean
          example: true
        spec:
          $ref: '#/components/schemas/Spec'
        tags:
          description: Tags of the workflow.
          items:
            type: string
          type: array
        updatedAt:
          description: When the workflow was last updated.
          format: date-time
          readOnly: true
          type: string
          example: '2026-04-17T12:00:00Z'
        webhookSecret:
          description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
          type: string
          writeOnly: true
          example: example_value
      type: object
    CloudConfigurationRegoRule:
      description: Rule details.
      properties:
        policy:
          description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/'
          example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n"
          type: string
        resourceTypes:
          description: List of resource types that will be evaluated upon. Must have at least one element.
          example:
          - gcp_iam_service_account
          - gcp_iam_policy
          items:
            type: string
          type: array
      required:
      - policy
      - resourceTypes
      type: object
    IncidentTeamRelationships:
      description: The incident team's relationships.
      properties:
        created_by:
          $ref: '#/components/schemas/RelationshipToUser'
        last_modified_by:
          $ref: '#/components/schemas/RelationshipToUser'
      readOnly: true
      type: object
    IncidentIntegrationMetadataResponse:
      description: Response with an incident integration metadata.
      properties:
        data:
          $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem'
          readOnly: true
          type: array
      required:
      - data
      type: object
    MSTeamsIntegrationMetadataTeamsItem:
      description: Item in the Microsoft Teams integration metadata teams array.
      properties:
        ms_channel_id:
          description: Microsoft Teams channel ID.
          example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2
          type: string
        ms_channel_name:
          description: Microsoft Teams channel name.
          example: incident-0001-example
          type: string
        ms_tenant_id:
          description: Microsoft Teams tenant ID.
          example: 00000000-abcd-0005-0000-000000000000
          type: string
        redirect_url:
          description: URL redirecting to the Microsoft Teams channel.
          example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000
          type: string
      required:
      - ms_tenant_id
      - ms_channel_id
      - ms_channel_name
      - redirect_url
      type: object
    IncidentServiceUpdateRequest:
      description: Update request with an incident service payload.
      properties:
        data:
          $ref: '#/components/schemas/IncidentServiceUpdateData'
      required:
      - data
      type: object
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    IncidentIntegrationMetadataMetadata:
      description: Incident integration metadata's metadata attribute.
      oneOf:
      - $ref: '#/components/schemas/SlackIntegrationMetadata'
      - $ref: '#/components/schemas/JiraIntegrationMetadata'
      - $ref: '#/components/schemas/MSTeamsIntegrationMetadata'
    IncidentImpactsType:
      description: The incident impacts type.
      enum:
      - incident_impacts
      example: incident_impacts
      type: string
      x-enum-varnames:
      - INCIDENT_IMPACTS
    Connection:
      description: The definition of `Connection` object.
      properties:
        connectionId:
          description: The `Connection` `connectionId`.
          example: ''
          type: string
        label:
          description: The `Connection` `label`.
          example: ''
          type: string
      required:
      - connectionId
      - label
      type: object
    SecurityMonitoringSignalRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    SoftwareCatalogTriggerWrapper:
      description: Schema for a Software Catalog-based trigger.
      properties:
        softwareCatalogTrigger:
          description: Trigger a workflow from Software Catalog.
          type: object
        startStepNames:
          $ref: '#/components/schemas/StartStepNames'
      required:
      - softwareCatalogTrigger
      type: object
    UpdateWorkflowResponse:
      description: The response object after updating a workflow.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowDataUpdate'
      type: object
    RelationshipToIncidentPostmortem:
      description: A relationship reference for postmortems.
      example:
        data:
          id: 00000000-0000-abcd-3000-000000000000
          type: incident_postmortems
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToIncidentPostmortemData'
      required:
      - data
      type: object
    IncidentTeamIncludedItems:
      description: An object related to an incident team which is present in the included payload.
      oneOf:
      - $ref: '#/components/schemas/User'
    GetWorkflowResponse:
      description: The response object after getting a workflow.
      properties:
        data:
          $ref: '#/components/schemas/WorkflowData'
      type: object
    IncidentResponseData:
      description: Incident data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentResponseAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentResponseRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    CaseTrigger:
      description: Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
      properties:
        rateLimit:
          $ref: '#/components/schemas/TriggerRateLimit'
      type: object
    IncidentServiceUpdateAttributes:
      description: The incident service's attributes for an update request.
      properties:
        name:
          description: Name of the incident service.
          example: an example service name
          type: string
      required:
      - name
      type: object
    IncidentAttachmentLinkAttributes:
      description: The attributes object for a link attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType'
        modified:
          description: Timestamp when the incident attachment link was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - attachment_type
      - attachment
      type: object
    SecurityMonitoringRuleQueryPayloadData:
      additionalProperties: {}
      description: Payload used to test the rule query.
      properties:
        ddsource:
          description: Source of the payload.
          example: nginx
          type: string
        ddtags:
          description: Tags associated with your data.
          example: env:staging,version:5.1
          type: string
        hostname:
          description: The name of the originating host of the log.
          example: i-012345678
          type: string
        message:
          description: The message of the payload.
          example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World
          type: string
        service:
          description: The name of the application or service generating the data.
          example: payment
          type: string
      type: object
    UpdateRuleRequestData:
      description: Data for the request to update a scorecard rule.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior

# --- truncated at 32 KB (148 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-existing-api-openapi.yml