Datadog Protections API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Protections API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Protections
paths:
  /api/v2/remote_config/products/cws/agent_rules:
    get:
      description: 'Get the list of Workload Protection agent rules.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: ListCSMThreatsAgentRules
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get All Workload Protection Agent Rules
      tags:
      - Protections
      x-menu-order: 1
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: 'Create a new Workload Protection agent rule with the given parameters.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: CreateCSMThreatsAgentRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest'
        description: The definition of the new agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Workload Protection Agent Rule
      tags:
      - Protections
      x-codegen-request-body-name: body
      x-given:
        agent_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"agent_rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique_lower_alnum }}\",\n      \"description\": \"My Agent rule\",\n      \"expression\": \"exec.file.name == \\\"sh\\\"\",\n      \"enabled\": true,\n      \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n      \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n      \"policy_id\": \"{{ policy.data.id }}\"\n     }\n  }\n}"
          step: there is a valid "agent_rule_rc" in the system
      x-menu-order: 3
      x-undo:
        operationId: DeleteCSMThreatsAgentRule
        parameters:
        - name: agent_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}:
    delete:
      description: 'Delete a specific Workload Protection agent rule.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: DeleteCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Workload Protection Agent Rule
      tags:
      - Protections
      x-menu-order: 5
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific Workload Protection agent rule.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: GetCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Workload Protection Agent Rule
      tags:
      - Protections
      x-menu-order: 2
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific Workload Protection Agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: UpdateCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule
      tags:
      - Protections
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/policy:
    get:
      description: 'Get the list of Workload Protection policies.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: ListCSMThreatsAgentPolicies
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentPoliciesListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get All Workload Protection Policies
      tags:
      - Protections
      x-menu-order: 6
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: 'Create a new Workload Protection policy with the given parameters.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: CreateCSMThreatsAgentPolicy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateRequest'
        description: The definition of the new Agent policy
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Workload Protection Policy
      tags:
      - Protections
      x-codegen-request-body-name: body
      x-given:
        policy:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"policy\",\n    \"attributes\": {\n      \"name\": \"{{ unique_lower_alnum }}\",\n      \"description\": \"My agent policy\",\n      \"hostTags\": [\"env:staging\"],\n      \"enabled\": true\n     }\n  }\n}"
          step: there is a valid "policy_rc" in the system
      x-menu-order: 8
      x-undo:
        operationId: DeleteCSMThreatsAgentPolicy
        parameters:
        - name: policy_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/policy/download:
    get:
      description: 'The download endpoint generates a Workload Protection policy file from your currently active

        Workload Protection agent rules, and downloads them as a `.policy` file. This file can then be deployed to

        your agents to update the policy running in your environment.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: DownloadCSMThreatsPolicy
      responses:
        '200':
          content:
            application/zip:
              schema:
                format: binary
                type: string
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Download the Workload Protection Policy
      tags:
      - Protections
      x-menu-order: 11
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/policy/{policy_id}:
    delete:
      description: 'Delete a specific Workload Protection policy.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: DeleteCSMThreatsAgentPolicy
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID'
      responses:
        '202':
          description: OK
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Workload Protection Policy
      tags:
      - Protections
      x-menu-order: 10
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific Workload Protection policy.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: GetCSMThreatsAgentPolicy
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Workload Protection Policy
      tags:
      - Protections
      x-menu-order: 7
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific Workload Protection policy.

        Returns the policy object when the request is successful.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: UpdateCSMThreatsAgentPolicy
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateRequest'
        description: New definition of the Agent policy
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Policy
      tags:
      - Protections
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/cloud_workload/policy/download:
    get:
      description: 'The download endpoint generates a Workload Protection policy file from your currently active

        Workload Protection agent rules, and downloads them as a `.policy` file. This file can then be deployed to

        your agents to update the policy running in your environment.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: DownloadCloudWorkloadPolicyFile
      responses:
        '200':
          content:
            application/yaml:
              schema:
                format: binary
                type: string
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Download the Workload Protection Policy (us1-fed)
      tags:
      - Protections
      x-menu-order: 17
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/cloud_workload_security/agent_rules:
    get:
      description: 'Get the list of agent rules.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: ListCloudWorkloadSecurityAgentRules
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get All Workload Protection Agent Rules (us1-fed)
      tags:
      - Protections
      x-menu-order: 12
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: 'Create a new agent rule with the given parameters.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: CreateCloudWorkloadSecurityAgentRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest'
        description: The definition of the new agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Workload Protection Agent Rule (us1-fed)
      tags:
      - Protections
      x-codegen-request-body-name: body
      x-given:
        agent_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"agent_rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique_lower_alnum }}\",\n      \"description\": \"My Agent rule\",\n      \"expression\": \"exec.file.name == \\\"sh\\\"\",\n      \"enabled\": true\n     }\n  }\n}"
          step: there is a valid "agent_rule" in the system
      x-menu-order: 14
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        operationId: DeleteCloudWorkloadSecurityAgentRule
        parameters:
        - name: agent_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}:
    delete:
      description: 'Delete a specific agent rule.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: DeleteCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Workload Protection Agent Rule (us1-fed)
      tags:
      - Protections
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific agent rule.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: GetCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Workload Protection Agent Rule (us1-fed)
      tags:
      - Protections
      x-menu-order: 13
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: UpdateCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule (us1-fed)
      tags:
      - Protections
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    CloudWorkloadSecurityAgentRuleAttributes:
      description: A Cloud Workload Security Agent rule returned by the API
      properties:
        actions:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
        agentConstraint:
          description: The version of the Agent
          type: string
          example: example_value
        blocking:
          description: The blocking policies that the rule belongs to
          items:
            type: string
          type: array
        category:
          description: The category of the Agent rule
          example: Process Activity
          type: string
        creationAuthorUuId:
          description: The ID of the user who created the rule
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
        creationDate:
          description: When the Agent rule was created, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        creator:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreatorAttributes'
        defaultRule:
          description: Whether the rule is included by default
          example: false
          type: boolean
        description:
          description: The description of the Agent rule
          example: My Agent rule
          type: string
        disabled:
          description: The disabled policies that the rule belongs to
          items:
            type: string
          type: array
        enabled:
          description: Whether the Agent rule is enabled
          example: true
          type: boolean
        expression:
          description: The SECL expression of the Agent rule
          example: exec.file.name == "sh"
          type: string
        filters:
          description: The platforms the Agent rule is supported on
          items:
            type: string
          type: array
        monitoring:
          description: The monitoring policies that the rule belongs to
          items:
            type: string
          type: array
        name:
          description: The name of the Agent rule
          example: my_agent_rule
          type: string
        product_tags:
          description: The list of product tags associated with the rule
          items:
            type: string
          type: array
        updateAuthorUuId:
          description: The ID of the user who updated the rule
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
        updateDate:
          description: Timestamp in milliseconds when the Agent rule was last updated
          example: 1624366480320
          format: int64
          type: integer
        updatedAt:
          description: When the Agent rule was last updated, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        updater:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdaterAttributes'
        version:
          description: The version of the Agent rule
          example: 23
          format: int64
          type: integer
      type: object
    CloudWorkloadSecurityAgentPolicyResponse:
      description: Response object that includes an Agent policy
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyData'
      type: object
    CloudWorkloadSecurityAgentRuleResponse:
      description: Response object that includes an Agent rule
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData'
      type: object
    CloudWorkloadSecurityAgentPolicyUpdaterAttributes:
      description: The attributes of the user who last updated the policy
      properties:
        handle:
          description: The handle of the user
          example: datadog.user@example.com
          type: string
        name:
          description: The name of the user
          example: Datadog User
          nullable: true
          type: string
      type: object
    CloudWorkloadSecurityAgentRuleCreateData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateAttributes'
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      required:
      - attributes
      - type
      type: object
    CloudWorkloadSecurityAgentRuleAction:
      description: The action the rule can perform if triggered
      properties:
        filter:
          description: SECL expression used to target the container to apply the action on
          type: string
          example: example_value
        kill:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
        metadata:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
        set:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
      type: object
    CloudWorkloadSecurityAgentPolicyCreateAttributes:
      description: Create a new Cloud Workload Security Agent policy
      properties:
        description:
          description: The description of the policy
          example: My agent policy
          type: string
        enabled:
          description: Whether the policy is enabled
          example: true
          type: boolean
        hostTags:
          description: The host tags defining where this policy is deployed
          items:
            type: string
          type: array
        hostTagsLists:
          description: The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
          items:
            items:
              type: string
            type: array
          type: array
        name:
          description: The name of the policy
          example: my_agent_policy
          type: string
      required:
      - name
      type: object
    CloudWorkloadSecurityAgentRuleData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAttributes'
        id:
          description: The ID of the Agent rule
          example: 3dd-0uc-h1s
          type: string
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      type: object
    CloudWorkloadSecurityAgentRuleKill:
      description: Kill system call applied on the container matching the rule
      properties:
        signal:
          description: Supported signals for the kill system call
          type: string
          example: example_value
      type: object
    CloudWorkloadSecurityAgentPolicyUpdateAttributes:
      description: Update an existing Cloud Workload Security Agent policy
      properties:
        description:
          description: The description of the policy
          example: My agent policy
          type: string
        enabled:
          description: Whether the policy is enabled
          example: true
          type: boolean
        hostTags:
          description: The host tags defining where this policy is deployed
          items:
            type: string
          type: array
        hostTagsLists:
          description: The 

# --- truncated at 32 KB (53 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-protections-api-openapi.yml