Datadog
Datadog Filter API

The Filter API from Datadog — 8 operation(s) for filter.
Documentation GitHub OpenAPI
OpenAPI Specification

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Filter API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Filter
paths:
  /api/v2/apm/config/retention-filters:
    post:
      description: 'Create a retention filter to index spans in your organization.

        Returns the retention filter definition when the request is successful.


        Default filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor cannot be created.'
      operationId: CreateApmRetentionFilter
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RetentionFilterCreateRequest'
        description: The definition of the new retention filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RetentionFilterCreateResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Retention Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-given:
        retention_filter:
          parameters:
          - name: body
            value: "{\n    \"data\": {\n        \"attributes\": {\n            \"name\": \"demo retention filter\",\n            \"rate\": 0.90,\n            \"filter\": {\n                \"query\": \"@_top_level:1 test:service-demo\"\n            },\n            \"enabled\": true,\n            \"filter_type\": \"spans-sampling-processor\"\n        },\n        \"type\": \"apm_retention_filter\"\n    }\n}"
          step: there is a valid "retention_filter" in the system
      x-menu-order: 2
      x-permission:
        operator: OR
        permissions:
        - apm_retention_filter_write
        - apm_pipelines_write
      x-undo:
        operationId: DeleteApmRetentionFilter
        parameters:
        - name: filter_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/apm/config/retention-filters/{filter_id}:
    delete:
      description: 'Delete a specific retention filter from your organization.


        Default filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor cannot be deleted.'
      operationId: DeleteApmRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RetentionFilterIdParam'
      responses:
        '200':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Retention Filter
      tags:
      - Filter
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - apm_retention_filter_write
        - apm_pipelines_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get an APM retention filter.
      operationId: GetApmRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RetentionFilterIdParam'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RetentionFilterResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Given Apm Retention Filter
      tags:
      - Filter
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - apm_retention_filter_read
        - apm_pipelines_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: 'Update a retention filter from your organization.


        Default filters (filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor) cannot be renamed or removed.'
      operationId: UpdateApmRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RetentionFilterIdParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RetentionFilterUpdateRequest'
        description: The updated definition of the retention filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RetentionFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Retention Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - apm_retention_filter_write
        - apm_pipelines_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/exclusion_filters:
    post:
      description: 'Create a new WAF exclusion filter with the given parameters.


        A request matched by an exclusion filter will be ignored by the Application Security WAF product.

        Go to https://app.datadoghq.com/security/appsec/passlist to review existing exclusion filters (also called passlist entries).'
      operationId: CreateApplicationSecurityWafExclusionFilter
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterCreateRequest'
        description: The definition of the new WAF exclusion filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Waf Exclusion Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-given:
        exclusion_filter:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"exclusion_filter\",\n    \"attributes\": {\n      \"description\": \"My Exclusion Filter\",\n      \"enabled\": true,\n      \"path_glob\": \"*\",\n      \"parameters\": [\n        \"list.search.query\"\n      ],\n      \"rules_target\": [\n        {\n          \"tags\": {\n            \"category\":\"attack_attempt\",\n            \"type\":\"xss\"\n          }\n        }\n      ],\n      \"scope\": [\n        {\n          \"env\": \"staging\",\n          \"service\": \"event-query\"\n        }\n      ]\n    }\n  }\n}"
          step: there is a valid "exclusion_filter" in the system
      x-menu-order: 2
      x-permission:
        operator: AND
        permissions:
        - appsec_protect_write
      x-terraform-resource: appsec_waf_exclusion_filter
      x-undo:
        operationId: DeleteApplicationSecurityWafExclusionFilter
        parameters:
        - name: exclusion_filter_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/exclusion_filters/{exclusion_filter_id}:
    delete:
      description: Delete a specific WAF exclusion filter using its identifier.
      operationId: DeleteApplicationSecurityWafExclusionFilter
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafExclusionFilterID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Waf Exclusion Filter
      tags:
      - Filter
      x-menu-order: 6
      x-permission:
        operator: AND
        permissions:
        - appsec_protect_write
      x-terraform-resource: appsec_waf_exclusion_filter
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Retrieve a specific WAF exclusion filter using its identifier.
      operationId: GetApplicationSecurityWafExclusionFilter
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafExclusionFilterID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Waf Exclusion Filter
      tags:
      - Filter
      x-menu-order: 1
      x-permission:
        operator: AND
        permissions:
        - appsec_protect_read
      x-terraform-resource: appsec_waf_exclusion_filter
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: 'Update a specific WAF exclusion filter using its identifier.

        Returns the exclusion filter object when the request is successful.'
      operationId: UpdateApplicationSecurityWafExclusionFilter
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafExclusionFilterID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateRequest'
        description: The exclusion filter to update.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Waf Exclusion Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-menu-order: 5
      x-permission:
        operator: AND
        permissions:
        - appsec_protect_write
      x-terraform-resource: appsec_waf_exclusion_filter
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/applications/{app_id}/retention_filters:
    post:
      description: 'Create a RUM retention filter for a RUM application.

        Returns RUM retention filter objects from the request body when the request is successful.'
      operationId: CreateRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RumApplicationIDParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RumRetentionFilterCreateRequest'
        description: The definition of the new RUM retention filter.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RumRetentionFilterResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Rum Retention Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/applications/{app_id}/retention_filters/{rf_id}:
    delete:
      description: Delete a RUM retention filter for a RUM application.
      operationId: DeleteRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RumApplicationIDParameter'
      - $ref: '#/components/parameters/RumRetentionFilterIDParameter'
      responses:
        '204':
          description: No Content
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Rum Retention Filter
      tags:
      - Filter
      x-menu-order: 5
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get a RUM retention filter for a RUM application.
      operationId: GetRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RumApplicationIDParameter'
      - $ref: '#/components/parameters/RumRetentionFilterIDParameter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RumRetentionFilterResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Rum Retention Filter
      tags:
      - Filter
      x-menu-order: 2
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a RUM retention filter for a RUM application.

        Returns RUM retention filter objects from the request body when the request is successful.'
      operationId: UpdateRetentionFilter
      parameters:
      - $ref: '#/components/parameters/RumApplicationIDParameter'
      - $ref: '#/components/parameters/RumRetentionFilterIDParameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RumRetentionFilterUpdateRequest'
        description: New definition of the RUM retention filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RumRetentionFilterResponse'
          description: Updated
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Rum Retention Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/configuration/security_filters:
    post:
      description: 'Create a security filter.


        See the [security filter guide](https://docs.datadoghq.com/security_platform/guide/how-to-setup-security-filters-using-security-monitoring-api/)

        for more examples.'
      operationId: CreateSecurityFilter
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityFilterCreateRequest'
        description: The definition of the new security filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_write
      summary: Datadog Create a Security Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-given:
        security_filter:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"security_filters\",\n    \"attributes\": {\n      \"name\": \"{{ unique }}\",\n      \"query\": \"service:{{ unique_alnum }}\",\n      \"exclusion_filters\":[\n        {\n          \"name\": \"Exclude logs from staging\",\n          \"query\": \"source:staging\"\n        }\n     ],\n      \"filtered_data_type\":\"logs\",\n      \"is_enabled\": true\n     }\n  }\n}"
          step: there is a valid "security_filter" in the system
      x-menu-order: 17
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_write
      x-undo:
        operationId: DeleteSecurityFilter
        parameters:
        - name: security_filter_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/configuration/security_filters/{security_filter_id}:
    delete:
      description: Delete a specific security filter.
      operationId: DeleteSecurityFilter
      parameters:
      - $ref: '#/components/parameters/SecurityFilterID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_write
      summary: Datadog Delete a Security Filter
      tags:
      - Filter
      x-menu-order: 14
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific security filter.


        See the [security filter guide](https://docs.datadoghq.com/security_platform/guide/how-to-setup-security-filters-using-security-monitoring-api/)

        for more examples.'
      operationId: GetSecurityFilter
      parameters:
      - $ref: '#/components/parameters/SecurityFilterID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityFilterResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_read
      summary: Datadog Get a Security Filter
      tags:
      - Filter
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific security filter.

        Returns the security filter object when the request is successful.'
      operationId: UpdateSecurityFilter
      parameters:
      - $ref: '#/components/parameters/SecurityFilterID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityFilterUpdateRequest'
        description: New definition of the security filter.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityFilterResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_filters_write
      summary: Datadog Update a Security Filter
      tags:
      - Filter
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_filters_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    RumRetentionFilterEnabled:
      description: Whether the retention filter is enabled.
      example: true
      type: boolean
    SpansFilterCreate:
      description: The spans filter. Spans matching this filter will be indexed and stored.
      properties:
        query:
          description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/).
          example: '@http.status_code:200 service:my-service'
          type: string
      required:
      - query
      type: object
    SecurityFilterExclusionFilter:
      description: Exclusion filter for the security filter.
      example:
        name: Exclude staging
        query: source:staging
      properties:
        name:
          description: Exclusion filter name.
          example: Exclude staging
          type: string
        query:
          description: Exclusion filter query. Logs that match this query are excluded from the security filter.
          example: source:staging
          type: string
      required:
      - name
      - query
      type: object
    RetentionFilterAll:
      description: The definition of the retention filter.
      properties:
        attributes:
          $ref: '#/components/schemas/RetentionFilterAllAttributes'
        id:
          description: The ID of the retention filter.
          example: 7RBOb7dLSYWI01yc3pIH8w
          type: string
        type:
          $ref: '#/components/schemas/ApmRetentionFilterType'
      required:
      - id
      - type
      - attributes
      type: object
    RumRetentionFilterType:
      default: retention_filters
      description: The type of the resource. The value should always be retention_filters.
      enum:
      - retention_filters
      example: retention_filters
      type: string
      x-enum-varnames:
      - RETENTION_FILTERS
    RetentionFilterCreateAttributes:
      description: The object describing the configuration of the retention filter to create/update.
      properties:
        enabled:
          description: Enable/Disable the retention filter.
          example: true
          type: boolean
        filter:
          $ref: '#/components/schemas/SpansFilterCreate'
        filter_type:
          $ref: '#/components/schemas/RetentionFilterType'
        name:
          description: The name of the retention filter.
          example: my retention filter
          type: string
        rate:
          description: 'Sample rate to apply to spans going through this retention filter.

            A value of 1.0 keeps all spans matching the query.'
          example: 1
          format: double
          type: number
        trace_rate:
          description: 'Sample rate to apply to traces containing spans going through this retention filter.

            A value of 1.0 keeps all traces with spans matching the query.'
          example: 1
          format: double
          type: number
      required:
      - name
      - filter
      - enabled
      - filter_type
      - rate
      type: object
    SecurityFilterFilteredDataType:
      description: The filtered data type.
      enum:
      - logs
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
    ApplicationSecurityWafExclusionFilterResource:
      description: A JSON:API resource for an WAF exclusion filter.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterAttributes'
        id:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterID'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType'
      type: object
    ApplicationSecurityWafExclusionFilterScope:
      description: Deploy on services based on their environment and/or service name.
      properties:
        env:
          description: Deploy on this environment.
          example: www
          type: string
        service:
          description: Deploy on this service.
          example: prod
          type: string
      type: object
    SecurityFilterUpdateData:
      description: The new security filter properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityFilterUpdateAttributes'
        type:
          $ref: '#/components/schemas/SecurityFilterType'
      required:
      - type
      - attributes
      type: object
    ApplicationSecurityWafExclusionFilterUpdateData:
      description: Object for updating a single WAF exclusion filter.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateAttributes'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType'
      required:
      - attributes
      - type
      type: object
    RumRetentionFilterUpdateAttributes:
      description: The object describing attributes of a RUM retention filter to update.
      properties:
        enabled:
          $ref: '#/components/schemas/RumRetentionFilterEnabled'
        event_type:
          $ref: '#/components/schemas/RumRetentionFilterEventType'
        name:
          $ref: '#/components/schemas/RunRetentionFilterName'
        query:
          $ref: '#/components/schemas/RumRetentionFilterQuery'
        sample_rate:
          $ref: '#/components/schemas/RumRetentionFilterSampleRate'
      type: object
    ApplicationSecurityWafExclusionFilterCreateRequest:
      description: Request object for creating a single WAF exclusion filter.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterCreateData'
      required:
      - data
      type: object
    RumRetentionFilterQuery:
      description: The query string for a RUM retention filter.
      example: '@session.has_replay:true'
      type: string
    RetentionFilterAllType:
      default: spans-sampling-processor
      description: The type of retention filter.
      enum:
      - spans-sampling-processor
      - spans-errors-sampling-processor
      - spans-appsec-sampling-processor
      example: spans-sampling-processor
      type: string
      x-enum-varnames:
      - SPANS_SAMPLING_PROCESSOR
      - SPANS_ERRORS_SAMPLING_PROCESSOR
      - SPANS_APPSEC_SAMPLING_PROCESSOR
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    SecurityFilter:
      description: The security filter's properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityFilterAttributes'
        id:
          $ref: '#/components/schemas/SecurityFilterID'
        type:
          $ref: '#/components/schemas/SecurityFilterType'
      type: object
    RumRetentionFilterCreateRequest:
      description: The RUM retention filter body to create.
      properties:
        data:
          $ref: '#/components/schemas/RumRetentionFilterCreateData'
      required:
      - data
      type: object
    Retention

# --- truncated at 32 KB (67 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-filter-api-openapi.yml
Datadog Filter API

Documentation

Specifications

Schemas & Data

Other Resources

OpenAPI Specification
