Datadog Patch API

openapi: 3.2.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Patch API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Patch
paths:
  /api/v2/scim/Users/{user_uuid}:
    patch:
      description: Patch the user with the given `user_uuid`.
      operationId: PatchSCIMUser
      parameters:
      - description: None
        in: path
        name: user_uuid
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            examples:
              json-request-body:
                value:
                  Operations:
                  - op: replace
                    path: title
                    value: CEO
                  - op: replace
                    value:
                      name:
                        formatted: John Doe
                  schemas:
                  - urn:ietf:params:scim:api:messages:2.0:PatchOp
            schema:
              $ref: '#/components/schemas/ExternalUserPatchRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalUser'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - bearerAuth: []
      summary: Datadog Patch User
      tags:
      - Patch
      x-menu-order: 5
      x-permission:
        operator: AND
        permissions:
        - user_access_invite
        - user_access_manage
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/signals/notification_rules/{id}:
    patch:
      description: Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
      operationId: PatchSignalNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchNotificationRuleParameters'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule successfully patched.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '422':
          $ref: '#/components/responses/UnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Patch a Signal-based Notification Rule
      tags:
      - Patch
      x-codegen-request-body-name: body
      x-menu-order: 20
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities/notification_rules/{id}:
    patch:
      description: Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
      operationId: PatchVulnerabilityNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchNotificationRuleParameters'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule successfully patched.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '422':
          $ref: '#/components/responses/UnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Patch a Vulnerability-based Notification Rule
      tags:
      - Patch
      x-codegen-request-body-name: body
      x-menu-order: 20
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    RuleName:
      description: Name of the notification rule.
      example: Rule 1
      type: string
    RuleTypes:
      description: Security rule types used as filters in security rules.
      example:
      - misconfiguration
      - attack_path
      items:
        $ref: '#/components/schemas/RuleTypesItems'
      type: array
    NotificationRulesType:
      description: The rule type associated to notification rules.
      enum:
      - notification_rules
      example: notification_rules
      type: string
      x-enum-varnames:
      - NOTIFICATION_RULES
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    EmailTypeType:
      description: The type of email.
      enum:
      - work
      type: string
      x-enum-varnames:
      - WORK
    Selectors:
      description: 'Selectors are used to filter security issues for which notifications should be generated.

        Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.

        Only the trigger_source field is required.'
      properties:
        query:
          $ref: '#/components/schemas/NotificationRuleQuery'
        rule_types:
          $ref: '#/components/schemas/RuleTypes'
        severities:
          description: The security rules severities to consider.
          items:
            $ref: '#/components/schemas/RuleSeverity'
          type: array
        trigger_source:
          $ref: '#/components/schemas/TriggerSource'
      required:
      - trigger_source
      type: object
    TimeAggregation:
      description: 'Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.

        Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.

        Notifications are only sent for new issues discovered during the window.

        Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation

        is done.'
      example: 86400
      format: int64
      type: integer
    RuleTypesItems:
      description: 'Security rule type which can be used in security rules.

        Signal-based notification rules can filter signals based on rule types application_security, log_detection,

        workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.

        Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,

        application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, and api_security.'
      enum:
      - application_security
      - log_detection
      - workload_security
      - signal_correlation
      - cloud_configuration
      - infrastructure_configuration
      - application_code_vulnerability
      - application_library_vulnerability
      - attack_path
      - container_image_vulnerability
      - identity_risk
      - misconfiguration
      - api_security
      type: string
      x-enum-varnames:
      - APPLICATION_SECURITY
      - LOG_DETECTION
      - WORKLOAD_SECURITY
      - SIGNAL_CORRELATION
      - CLOUD_CONFIGURATION
      - INFRASTRUCTURE_CONFIGURATION
      - APPLICATION_CODE_VULNERABILITY
      - APPLICATION_LIBRARY_VULNERABILITY
      - ATTACK_PATH
      - CONTAINER_IMAGE_VULNERABILITY
      - IDENTITY_RISK
      - MISCONFIGURATION
      - API_SECURITY
    TriggerSource:
      description: 'The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",

        while notification rules based on security vulnerabilities need to use the trigger source "security_findings".'
      enum:
      - security_findings
      - security_signals
      example: security_findings
      type: string
      x-enum-varnames:
      - SECURITY_FINDINGS
      - SECURITY_SIGNALS
    NotificationRuleAttributes:
      description: Attributes of the notification rule.
      properties:
        created_at:
          $ref: '#/components/schemas/Date'
        created_by:
          $ref: '#/components/schemas/RuleUser'
        enabled:
          $ref: '#/components/schemas/Enabled'
        modified_at:
          $ref: '#/components/schemas/Date'
        modified_by:
          $ref: '#/components/schemas/RuleUser'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
        version:
          $ref: '#/components/schemas/Version'
      required:
      - created_at
      - created_by
      - enabled
      - modified_at
      - modified_by
      - name
      - selectors
      - targets
      - version
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    PatchNotificationRuleParametersData:
      description: 'Data of the notification rule patch request: the rule ID, the rule type, and the rule attributes. All fields are required.'
      properties:
        attributes:
          $ref: '#/components/schemas/PatchNotificationRuleParametersDataAttributes'
        id:
          $ref: '#/components/schemas/ID'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - id
      - type
      type: object
    Targets:
      description: 'List of recipients to notify when a notification rule is triggered. Many different target types are supported,

        such as email addresses, Slack channels, and PagerDuty services.

        The appropriate integrations need to be properly configured to send notifications to the specified targets.'
      example:
      - '@john.doe@email.com'
      items:
        description: Recipients to notify.
        type: string
      type: array
    Version:
      description: Version of the notification rule. It is updated when the rule is modified.
      example: 1
      format: int64
      type: integer
    ExternalUserPatchRequestOperationsItems:
      description: The definition of an individual patch operation in a patch request.
      properties:
        op:
          $ref: '#/components/schemas/ExternalUserPatchRequestOperationsItemsOp'
        path:
          description: An attribute path describing the target of the operation.
          example: title
          type: string
        value:
          description: New value to use for the patch operation.
          example: example_value
      type: object
    RuleUser:
      description: User creating or modifying a rule.
      properties:
        handle:
          description: The user handle.
          example: john.doe@domain.com
          type: string
        name:
          description: The user name.
          example: John Doe
          type: string
      type: object
    PatchNotificationRuleParameters:
      description: Body of the notification rule patch request.
      properties:
        data:
          $ref: '#/components/schemas/PatchNotificationRuleParametersData'
      type: object
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    Enabled:
      description: Field used to enable or disable the rule.
      example: true
      type: boolean
    Date:
      description: Date as Unix timestamp in milliseconds.
      example: 1722439510282
      format: int64
      type: integer
    ExternalUser:
      description: Definition of a user.
      properties:
        active:
          description: A Boolean value indicating the User's administrative status.
          type: boolean
          example: true
        emails:
          description: Email addresses for the user.
          items:
            $ref: '#/components/schemas/ExternalUserEmailType'
          type: array
        id:
          description: The identifier of the resource. Not required when creating a user.
          type: string
          example: abc-123-def
        meta:
          $ref: '#/components/schemas/ExternalUserMeta'
        name:
          $ref: '#/components/schemas/ExternalUserNameType'
        schemas:
          description: User JSON Schemas.
          example:
          - urn:ietf:params:scim:schemas:core:2.0:User
          items:
            type: string
          type: array
        title:
          description: The user's title.
          type: string
          example: Example Monitor
        userName:
          description: Unique identifier for the User.
          type: string
          example: Example Monitor
      type: object
    ExternalUserEmailType:
      description: Email address for the user.
      properties:
        primary:
          description: Boolean indicating if this email is the primary email address.
          type: boolean
          example: true
        type:
          $ref: '#/components/schemas/EmailTypeType'
        value:
          description: Email addresses for the user.
          type: string
          example: example_value
      type: object
    NotificationRuleResponse:
      description: Response object which includes a notification rule.
      properties:
        data:
          $ref: '#/components/schemas/NotificationRule'
      type: object
    ExternalUserMeta:
      description: Metadata associated with a user.
      properties:
        created:
          description: The date and time the user was created.
          example: '2024-10-17T12:53:35.793Z'
          format: date-time
          type: string
        lastModified:
          description: The date and time the user was last changed.
          example: '2024-10-19T12:53:35.793Z'
          format: date-time
          type: string
        location:
          description: URL identifying the resource.
          example: https://app.datadoghq.com/api/scim/v2/Users/13a95654-b76d-478d-8636-157a7e461d7c
          type: string
        resourceType:
          description: Type of resource.
          example: User
          type: string
      type: object
    ExternalUserPatchRequest:
      description: Request object for patching a user.
      properties:
        Operations:
          description: A list of update operations to be performed on a user.
          items:
            $ref: '#/components/schemas/ExternalUserPatchRequestOperationsItems'
          type: array
        schemas:
          description: Input JSON Schemas
          example:
          - urn:ietf:params:scim:api:messages:2.0:PatchOp
          items:
            type: string
          type: array
      type: object
    RuleSeverity:
      description: Severity of a security rule.
      enum:
      - critical
      - high
      - medium
      - low
      - unknown
      - info
      example: critical
      type: string
      x-enum-varnames:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - UNKNOWN
      - INFO
    NotificationRuleQuery:
      description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
      example: (source:production_service OR env:prod)
      type: string
    ID:
      description: The ID of a notification rule.
      example: aaa-bbb-ccc
      type: string
    ExternalUserNameType:
      description: The components of user's real name
      properties:
        formatted:
          description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
          type: string
          example: example_value
      type: object
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    PatchNotificationRuleParametersDataAttributes:
      description: Attributes of the notification rule patch request. It is required to update the version of the rule when patching it.
      properties:
        enabled:
          $ref: '#/components/schemas/Enabled'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
        version:
          $ref: '#/components/schemas/Version'
      type: object
    NotificationRule:
      description: 'Notification rules allow full control over notifications generated by the various Datadog security products.

        They allow users to define the conditions under which a notification should be generated (based on rule severities,

        rule types, rule tags, and so on), and the targets to notify.

        A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.

        '
      properties:
        attributes:
          $ref: '#/components/schemas/NotificationRuleAttributes'
        id:
          $ref: '#/components/schemas/ID'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - id
      - type
      type: object
    ExternalUserPatchRequestOperationsItemsOp:
      description: The operation to be performed.
      enum:
      - add
      - replace
      type: string
      x-enum-varnames:
      - ADD
      - REPLACE
  responses:
    BadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Bad Request
    ForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Forbidden
    UnprocessableEntityResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: The server cannot process the request because it contains invalid data.
    TooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Too many requests
    NotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Found
  securitySchemes:
    AuthZ:
      description: This API uses OAuth 2 with the implicit grant flow.
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          scopes:
            apm_api_catalog_read: View API catalog and API definitions.
            apm_api_catalog_write: Add, modify, and delete API catalog definitions.
            apm_read: Read and query APM and Trace Analytics.
            apm_service_catalog_read: View service catalog and service definitions.
            apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
            appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source.
            cases_read: View Cases.
            cases_write: Create and update cases.
            ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API.
            ci_visibility_read: View CI Visibility.
            cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.
            cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.
            code_analysis_read: View Code Analysis.
            continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO).
            create_webhooks: Create webhooks integrations.
            dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'.
            dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'.
            dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally.
            dashboards_read: View dashboards.
            dashboards_write: Create and change dashboards.
            data_scanner_read: View Data Scanner configurations.
            data_scanner_write: Edit Data Scanner configurations.
            embeddable_graphs_share: Generate public links to share embeddable graphs externally.
            events_read: Read Events data.
            hosts_read: List hosts and their attributes.
            incident_notification_settings_write: Configure Incidents Notification settings.
            incident_read: View incidents in Datadog.
            incident_settings_write: Configure Incident Settings.
            incident_write: Create, view, and manage incidents in Datadog.
            metrics_read: View custom metrics.
            monitor_config_policy_write: Edit and delete monitor configuration.
            monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.
            monitors_read: View monitors.
            monitors_write: Edit, delete, and resolve individual monitors.
            org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.
            security_comments_read: Read comments of vulnerabilities.
            security_monitoring_filters_read: Read Security Filters.
            security_monitoring_filters_write: Create, edit, and delete Security Filters.
            security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks.
            security_monitoring_notification_profiles_read: View Rule Security Notification rules.
            security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules.
            security_monitoring_rules_read: Read Detection Rules.
            security_monitoring_rules_write: Create and edit Detection Rules.
            security_monitoring_signals_read: View Security Signals.
            security_monitoring_suppressions_read: Read Rule Suppressions.
            security_monitoring_suppressions_write: Write Rule Suppressions.
            security_pipelines_read: View Security Pipelines.
            security_pipelines_write: Create, edit, and delete CSM Security Pipelines.
            slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.
            slos_read: View SLOs and status corrections.
            slos_write: Create, edit, and delete SLOs.
            synthetics_global_variable_read: View, search, and use Synthetics global variables.
            synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics.
            synthetics_private_location_read: View, search, and use Synthetics private locations.
            synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines.
            synthetics_read: List and view configured Synthetic tests and test results.
            synthetics_write: Create, edit, and delete Synthetic tests.
            teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.
            teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.
            test_optimization_read: View Test Optimization.
            timeseries_query: Query Timeseries data.
            usage_read: View your organization's usage and usage attribution.
            user_access_invite: Invite other users to your organization.
            user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
            user_access_read: View users and their roles and settings.
            workflows_read: View workflows.
            workflows_run: Run workflows.
            workflows_write: Create, edit, and delete workflows.
          tokenUrl: /oauth2/v1/token
      type: oauth2
    apiKeyAuth:
      description: Your Datadog API Key.
      in: header
      name: DD-API-KEY
      type: apiKey
      x-env-name: DD_API_KEY
    appKeyAuth:
      description: Your Datadog APP Key.
      in: header
      name: DD-APPLICATION-KEY
      type: apiKey
      x-env-name: DD_APP_KEY
    bearerAuth:
      scheme: bearer
      type: http
      x-env-name: DD_BEARER_TOKEN
x-group-parameters: true
x-merge-override:
  paths: false