Datadog Rules API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Rules API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Rules
paths:
  /api/v2/monitor/notification_rule:
    get:
      description: Returns a list of all monitor notification rules.
      operationId: GetMonitorNotificationRules
      parameters:
      - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource

          path is `created_by`.'
        in: query
        name: include
        required: false
        schema:
          example: created_by
          type: string
        example: created_by
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleListResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitors_read
      summary: Datadog Get All Monitor Notification Rules
      tags:
      - Rules
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - monitors_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Creates a monitor notification rule.
      operationId: CreateMonitorNotificationRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MonitorNotificationRuleCreateRequest'
        description: Request body to create a monitor notification rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Create a Monitor Notification Rule
      tags:
      - Rules
      x-given:
        monitor_notification_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"monitor-notification-rule\",\n    \"attributes\": {\n      \"name\":\"test rule\",\n      \"filter\": {\n        \"tags\": [\n          \"app:{{ unique_lower }}\"\n        ]\n      },\n      \"recipients\":[\n        \"slack-monitor-app\"\n      ]\n    }\n  }\n}"
          step: there is a valid "monitor_notification_rule" in the system
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        operationId: DeleteMonitorNotificationRule
        parameters:
        - name: rule_id
          source: data.id
        type: unsafe
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/monitor/notification_rule/{rule_id}:
    delete:
      description: Deletes a monitor notification rule by `rule_id`.
      operationId: DeleteMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to delete.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '204':
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Delete a Monitor Notification Rule
      tags:
      - Rules
      x-menu-order: 18
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Returns a monitor notification rule by `rule_id`.
      operationId: GetMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to fetch.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource

          path is `created_by`.'
        in: query
        name: include
        required: false
        schema:
          example: created_by
          type: string
        example: created_by
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitors_read
      summary: Datadog Get a Monitor Notification Rule
      tags:
      - Rules
      x-menu-order: 14
      x-permission:
        operator: OR
        permissions:
        - monitors_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Updates a monitor notification rule by `rule_id`.
      operationId: UpdateMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to update.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MonitorNotificationRuleUpdateRequest'
        description: Request body to update the monitor notification rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Update a Monitor Notification Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 17
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/on-call/teams/{team_id}/routing-rules:
    get:
      description: Get a team's On-Call routing rules
      operationId: GetOnCallTeamRoutingRules
      parameters:
      - description: The team ID
        in: path
        name: team_id
        required: true
        schema:
          example: 27590dae-47be-4a7d-9abf-8f4e45124020
          type: string
        example: 27590dae-47be-4a7d-9abf-8f4e45124020
      - description: 'Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`.'
        in: query
        name: include
        schema:
          type: string
        example: example_value
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamRoutingRules'
          description: OK
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Get On-call Team Routing Rules
      tags:
      - Rules
      x-menu-order: 9
      x-permission:
        operator: AND
        permissions:
        - on_call_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: Set a team's On-Call routing rules
      operationId: SetOnCallTeamRoutingRules
      parameters:
      - description: The team ID
        in: path
        name: team_id
        required: true
        schema:
          example: 27590dae-47be-4a7d-9abf-8f4e45124020
          type: string
        example: 27590dae-47be-4a7d-9abf-8f4e45124020
      - description: 'Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`.'
        in: query
        name: include
        schema:
          type: string
        example: example_value
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamRoutingRulesRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamRoutingRules'
          description: OK
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Set On-call Team Routing Rules
      tags:
      - Rules
      x-given:
        routing_rules:
          parameters:
          - name: team_id
            source: dd_team.data.id
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"team_routing_rules\",\n    \"id\": \"{{ dd_team.data.id }}\",\n    \"attributes\": {\n      \"rules\": [\n        {\n          \"query\": \"\",\n          \"policy_id\": \"{{ escalation_policy.data.id }}\",\n          \"urgency\": \"low\",\n          \"actions\": []\n        }\n      ]\n    }\n  }\n}"
          step: there are valid "routing_rules" in the system
      x-menu-order: 10
      x-permission:
        operator: AND
        permissions:
        - on_call_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/custom_rules:
    get:
      description: Retrieve a list of WAF custom rule.
      operationId: ListApplicationSecurityWAFCustomRules
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Waf Custom Rules
      tags:
      - Rules
      x-menu-order: 13
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Create a new WAF custom rule with the given parameters.
      operationId: CreateApplicationSecurityWafCustomRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateRequest'
        description: The definition of the new WAF Custom Rule.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Waf Custom Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        custom_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"custom_rule\",\n    \"attributes\": {\n      \"blocking\": false,\n      \"conditions\": [\n        {\n          \"operator\": \"match_regex\",\n          \"parameters\": {\n            \"inputs\": [\n              {\n                \"address\": \"server.request.query\",\n                \"key_path\": [\n                  \"id\"\n                ]\n              }\n            ],\n            \"regex\": \"badactor\"\n          }\n        }\n      ],\n      \"enabled\": true,\n      \"name\": \"test\",\n      \"path_glob\": \"/test\",\n      \"scope\": [\n        {\n          \"env\": \"test\",\n          \"service\": \"test\"\n        }\n      ],\n      \"tags\": {\n        \"category\": \"attack_attempt\",\n        \"type\": \"test\"\n      }\n    }\n  }\n}"
          step: there is a valid "custom_rule" in the system
      x-menu-order: 12
      x-undo:
        operationId: DeleteApplicationSecurityWafCustomRule
        parameters:
        - name: custom_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}:
    delete:
      description: Delete a specific WAF custom rule.
      operationId: DeleteApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      responses:
        '204':
          description: No Content
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Waf Custom Rule
      tags:
      - Rules
      x-menu-order: 16
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Retrieve a WAF custom rule by ID.
      operationId: GetApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Waf Custom Rule
      tags:
      - Rules
      x-menu-order: 10
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: 'Update a specific WAF custom Rule.

        Returns the Custom Rule object when the request is successful.'
      operationId: UpdateApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateRequest'
        description: New definition of the WAF Custom Rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Waf Custom Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/agent_rules:
    get:
      description: 'Get the list of Workload Protection agent rules.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: ListCSMThreatsAgentRules
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get All Workload Protection Agent Rules
      tags:
      - Rules
      x-menu-order: 1
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: 'Create a new Workload Protection agent rule with the given parameters.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: CreateCSMThreatsAgentRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest'
        description: The definition of the new agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Workload Protection Agent Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        agent_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"agent_rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique_lower_alnum }}\",\n      \"description\": \"My Agent rule\",\n      \"expression\": \"exec.file.name == \\\"sh\\\"\",\n      \"enabled\": true,\n      \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n      \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n      \"policy_id\": \"{{ policy.data.id }}\"\n     }\n  }\n}"
          step: there is a valid "agent_rule_rc" in the system
      x-menu-order: 3
      x-undo:
        operationId: DeleteCSMThreatsAgentRule
        parameters:
        - name: agent_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}:
    delete:
      description: 'Delete a specific Workload Protection agent rule.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: DeleteCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Workload Protection Agent Rule
      tags:
      - Rules
      x-menu-order: 5
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific Workload Protection agent rule.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: GetCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Workload Protection Agent Rule
      tags:
      - Rules
      x-menu-order: 2
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific Workload Protection Agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: UpdateCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/outcomes:
    get:
      description: Fetches all rule outcomes.
      operationId: ListScorecardOutcomes
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - description: Include related rule details in the response.
        in: query
        name: include
        required: false
        schema:
          example: rule
          type: string
        example: rule
      - description: Return only specified values in the outcome attributes.
        in: query
        name: fields[outcome]
        required: false
        schema:
          example: state, service_name
          type: string
        example: state, service_name
      - description: Return only specified values in the included rule details.
        in: query
        name: fields[rule]
        required: false
        schema:
          example: name
          type: string
        example: name
      - description: Filter the outcomes on a specific service name.
        in: query
        name: filter[outcome][service_name]
        required: false
        schema:
          example: web-store
          type: string
        example: web-store
      - description: Filter the outcomes by a specific state.
        in: query
        name: filter[outcome][state]
        required: false
        schema:
          example: fail
          type: string
        example: fail
      - description: Filter outcomes on whether a rule is enabled/disabled.
        in: query
        name: filter[rule][enabled]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter outcomes based on rule ID.
        in: query
        name: filter[rule][id]
        required: false
        schema:
          example: f4485c79-0762-449c-96cf-c31e54a659f6
          type: string
        example: f4485c79-0762-449c-96cf-c31e54a659f6
      - description: Filter outcomes based on rule name.
        in: query
        name: filter[rule][name]
        required: false
        schema:
          example: SLOs Defined
          type: string
        example: SLOs Defined
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutcomesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog List All Rule Outcomes
      tags:
      - Rules
      x-menu-order: 2
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules:
    get:
      description: Fetch all rules.
      operationId: ListScorecardRules
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - description: Include related scorecard details in the response.
        in: query
        name: include
        required: false
        schema:
          example: scorecard
          type: string
        example: scorecard
      - description: Filter the rules on a rule ID.
        in: query
        name: filter[rule][id]
        required: false
        schema:
          example: 37d2f990-c885-4972-949b-8b798213a166
          type: string
        example: 37d2f9

# --- truncated at 32 KB (251 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-rules-api-openapi.yml