Datadog Search API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Search API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Search
paths:
  /api/v2/audit/events/search:
    post:
      description: 'List endpoint returns Audit Logs events that match an Audit search query.

        [Results are paginated][1].


        Use this endpoint to build complex Audit Logs events filtering and search.


        [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination'
      operationId: SearchAuditLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogsSearchEventsRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogsEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Search Audit Logs Events
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - audit_logs_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/cases:
    get:
      description: Search cases.
      operationId: SearchCases
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - $ref: '#/components/parameters/CaseSortableFieldParameter'
      - description: Search query
        in: query
        name: filter
        required: false
        schema:
          example: status:open (team:case-management OR team:event-management)
          type: string
        example: status:open (team:case-management OR team:event-management)
      - description: Specify if order is ascending or not
        in: query
        name: sort[asc]
        required: false
        schema:
          default: false
          type: boolean
        example: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CasesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - cases_read
      summary: Datadog Search Cases
      tags:
      - Search
      x-menu-order: 1
      x-pagination:
        limitParam: page[size]
        pageParam: page[number]
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ci/pipelines/events/search:
    post:
      description: 'List endpoint returns CI Visibility pipeline events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/).

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to build complex events filtering and search.'
      operationId: SearchCIAppPipelineEvents
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CIAppPipelineEventsRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppPipelineEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Search Pipelines Events
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ci/tests/events/search:
    post:
      description: 'List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/).

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to build complex events filtering and search.'
      operationId: SearchCIAppTestEvents
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CIAppTestEventsRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppTestEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Search Tests Events
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 2
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/events/search:
    x-merge-override:
      post: false
    post:
      description: 'List endpoint returns events that match an events search query.

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to build complex events filtering and search.'
      operationId: SearchEvents
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EventsListRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventsListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Search Events
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 2
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - events_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/incidents/search:
    get:
      description: Search for incidents matching a certain query.
      operationId: SearchIncidents
      parameters:
      - $ref: '#/components/parameters/IncidentSearchIncludeQueryParameter'
      - $ref: '#/components/parameters/IncidentSearchQueryQueryParameter'
      - $ref: '#/components/parameters/IncidentSearchSortQueryParameter'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentSearchResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Search for Incidents
      tags:
      - Search
      x-menu-order: 6
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data.attributes.incidents
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/events:
    get:
      description: 'List endpoint returns logs that match a log search query.

        [Results are paginated][1].


        Use this endpoint to search and filter your logs.


        **If you are considering archiving logs for your organization,

        consider use of the Datadog archive capabilities instead of the log list API.

        See [Datadog Logs Archive documentation][2].**


        [1]: /logs/guide/collect-multiple-logs-with-pagination

        [2]: https://docs.datadoghq.com/logs/archives'
      operationId: ListLogsGet
      parameters:
      - description: Search query following logs syntax.
        example: '@datacenter:us @role:db'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: 'For customers with multiple indexes, the indexes to search.

          Defaults to ''*'' which means all indexes'
        example:
        - main
        - web
        explode: false
        in: query
        name: filter[indexes]
        required: false
        schema:
          items:
            description: The name of a log index.
            type: string
          type: array
      - description: Minimum timestamp for requested logs.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: Maximum timestamp for requested logs.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: Specifies the storage type to be used
        example: indexes
        in: query
        name: filter[storage_tier]
        required: false
        schema:
          $ref: '#/components/schemas/LogsStorageTier'
      - description: Order of logs in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/LogsSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of logs in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogsListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Search Logs (get)
      tags:
      - Search
      x-menu-order: 4
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - logs_read_data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/logs/events/search:
    post:
      description: 'List endpoint returns logs that match a log search query.

        [Results are paginated][1].


        Use this endpoint to search and filter your logs.


        **If you are considering archiving logs for your organization,

        consider use of the Datadog archive capabilities instead of the log list API.

        See [Datadog Logs Archive documentation][2].**


        [1]: /logs/guide/collect-multiple-logs-with-pagination

        [2]: https://docs.datadoghq.com/logs/archives'
      operationId: ListLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogsListRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogsListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Search Logs (post)
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - logs_read_data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/rum/events/search:
    post:
      description: 'List endpoint returns RUM events that match a RUM search query.

        [Results are paginated][1].


        Use this endpoint to build complex RUM events filtering and search.


        [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination'
      operationId: SearchRUMEvents
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RUMSearchEventsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RUMEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Search Rum Events
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 1
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OPEN
        permissions: []
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/spans/events/search:
    post:
      description: 'List endpoint returns spans that match a span search query.

        [Results are paginated][1].


        Use this endpoint to build complex spans filtering and search.

        This endpoint is rate limited to `300` requests per hour.


        [1]: /logs/guide/collect-multiple-logs-with-pagination?tab=v2api'
      operationId: ListSpans
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SpansListRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpansListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/SpansBadRequestResponse'
        '403':
          $ref: '#/components/responses/SpansForbiddenResponse'
        '422':
          $ref: '#/components/responses/SpansUnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/SpansTooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_read
      summary: Datadog Search Spans
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 2
      x-pagination:
        cursorParam: body.data.attributes.page.cursor
        cursorPath: meta.page.after
        limitParam: body.data.attributes.page.limit
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    RUMResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    JiraIssueResult:
      description: Jira issue information
      properties:
        issue_id:
          description: Jira issue ID
          type: string
          example: abc-123-def
        issue_key:
          description: Jira issue key
          type: string
          example: example_value
        issue_url:
          description: Jira issue URL
          type: string
          example: https://app.datadoghq.com
        project_key:
          description: Jira project key
          type: string
          example: example_value
      type: object
    AuditLogsResponsePage:
      description: Paging attributes.
      properties:
        after:
          description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    RUMEventAttributes:
      description: JSON object containing all event attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from RUM events.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        service:
          description: 'The name of the application or service generating RUM events.

            It is used to switch from RUM to APM, so make sure you define the same

            value when you use both products.'
          example: web-app
          type: string
        tags:
          description: Array of tags associated with your event.
          example:
          - team:A
          items:
            description: Tag associated with your event.
            type: string
          type: array
        timestamp:
          description: Timestamp of your event.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    UsersType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    IncidentAttachmentAttributes:
      description: The attributes object for an attachment.
      oneOf:
      - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes'
      - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes'
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    SpansListRequest:
      description: The request for a spans list.
      properties:
        data:
          $ref: '#/components/schemas/SpansListRequestData'
      type: object
    IncidentSearchResponse:
      description: Response with incidents and facets.
      properties:
        data:
          $ref: '#/components/schemas/IncidentSearchResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentResponseIncludedItem'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentSearchResponseMeta'
      required:
      - data
      type: object
    RelationshipToIncidentUserDefinedFields:
      description: Relationship to incident user defined fields.
      properties:
        data:
          description: An array of user defined fields.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFieldData'
          type: array
      required:
      - data
      type: object
    EventResponseAttributes:
      description: The object description of an event response attribute.
      properties:
        attributes:
          $ref: '#/components/schemas/EventAttributes'
        message:
          description: The message of the event.
          type: string
          example: CPU usage is high on {{host.name}}
        tags:
          description: An array of tags associated with the event.
          example:
          - team:A
          items:
            description: The tag associated with the event.
            type: string
          type: array
        timestamp:
          description: The timestamp of the event.
          example: '2019-01-02T09:42:36.320Z'
          format: date-time
          type: string
      type: object
    IncidentSearchResponseAttributes:
      description: Attributes returned by an incident search.
      properties:
        facets:
          $ref: '#/components/schemas/IncidentSearchResponseFacetsData'
        incidents:
          description: Incidents returned by the search.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseIncidentsData'
          type: array
        total:
          description: Number of incidents returned by the search.
          example: 10
          format: int32
          maximum: 2147483647
          type: integer
      required:
      - facets
      - incidents
      - total
      type: object
    IncidentResponseRelationships:
      description: The incident's relationships from a response.
      properties:
        attachments:
          $ref: '#/components/schemas/RelationshipToIncidentAttachment'
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        impacts:
          $ref: '#/components/schemas/RelationshipToIncidentImpacts'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        responders:
          $ref: '#/components/schemas/RelationshipToIncidentResponders'
        user_defined_fields:
          $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields'
      type: object
    CasePriority:
      default: NOT_DEFINED
      description: Case priority
      enum:
      - NOT_DEFINED
      - P1
      - P2
      - P3
      - P4
      - P5
      example: NOT_DEFINED
      type: string
      x-enum-varnames:
      - NOT_DEFINED
      - P1
      - P2
      - P3
      - P4
      - P5
    EventsRequestPage:
      description: Pagination settings.
      properties:
        cursor:
          description: The returned paging point to use to get the next results.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
        limit:
          default: 10
          description: The maximum number of logs in the response.
          example: 25
          format: int32
          maximum: 1000
          type: integer
      type: object
    SpansListRequestData:
      description: The object containing the query content.
      properties:
        attributes:
          $ref: '#/components/schemas/SpansListRequestAttributes'
        type:
          $ref: '#/components/schemas/SpansListRequestType'
      type: object
    IncidentType:
      default: incidents
      description: Incident resource type.
      enum:
      - incidents
      example: incidents
      type: string
      x-enum-varnames:
      - INCIDENTS
    IncidentIntegrationMetadataType:
      default: incident_integrations
      description: Integration metadata resource type.
      enum:
      - incident_integrations
      example: incident_integrations
      type: string
      x-enum-varnames:
      - INCIDENT_INTEGRATIONS
    EventsListResponse:
      description: The response object with all events matching the request and pagination information.
      properties:
        data:
          description: An array of events matching the request.
          items:
            $ref: '#/components/schemas/EventResponse'
          type: array
        links:
          $ref: '#/components/schemas/EventsListResponseLinks'
        meta:
          $ref: '#/components/schemas/EventsResponseMetadata'
      type: object
    IncidentSearchResponseIncidentsData:
      description: Incident returned by the search.
      properties:
        data:
          $ref: '#/components/schemas/IncidentResponseData'
      required:
      - data
      type: object
    IncidentAttachmentRelationships:
      description: The incident attachment's relationships.
      properties:
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    AuditLogsResponseMetadata:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: Time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/AuditLogsResponsePage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          $ref: '#/components/schemas/AuditLogsResponseStatus'
        warnings:
          description: 'A list of warnings (non-fatal errors) encountered. Partial results may return if

            warnings are present in the response.'
          items:
            $ref: '#/components/schemas/AuditLogsWarning'
          type: array
      type: object
    CIAppTestsQueryFilter:
      description: The search and filter query settings.
      properties:
        from:
          default: now-15m
          description: The minimum time for the requested events; supports date, math, and regular timestamps (in milliseconds).
          example: now-15m
          type: string
        query:
          default: '*'
          description: The search query following the CI Visibility Explorer search syntax.
          example: '@test.service:web-ui-tests AND @test.status:fail'
          type: string
        to:
          default: now
          description: The maximum time for the requested events, supports date, math, and regular timestamps (in milliseconds).
          example: now
          type: string
      type: object
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    LogsStorageTier:
      default: indexes
      description: Specifies storage type as indexes, online-archives or flex
      enum:
      - indexes
      - online-archives
      - flex
      example: indexes
      type: string
      x-enum-varnames:
      - INDEXES
      - ONLINE_ARCHIVES
      - FLEX
    RUMResponseMetadata:
      description: The metadata associated with a request.
      properties:
        elapsed:
          description: The time elapsed in milliseconds.
          example: 132
          format: int64
          type: integer
        page:
          $ref: '#/components/schemas/RUMResponsePage'
        request_id:
          description: The identifier of the request.
          example: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR
          type: string
        status:
          $ref: '#/components/schemas/RUMResponseStatus'
        warnings:
          description: 'A list of war

# --- truncated at 32 KB (127 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-search-api-openapi.yml