Datadog Search API

openapi: 3.2.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Search API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Search
paths:
  /api/v2/incidents/search:
    get:
      description: Search for incidents matching a certain query.
      operationId: SearchIncidents
      parameters:
      - $ref: '#/components/parameters/IncidentSearchIncludeQueryParameter'
      - $ref: '#/components/parameters/IncidentSearchQueryQueryParameter'
      - $ref: '#/components/parameters/IncidentSearchSortQueryParameter'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentSearchResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - incident_read
      summary: Datadog Search for Incidents
      tags:
      - Search
      x-menu-order: 6
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data.attributes.incidents
      x-permission:
        operator: OR
        permissions:
        - incident_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/spans/events/search:
    post:
      description: 'List endpoint returns spans that match a span search query.

        [Results are paginated][1].


        Use this endpoint to build complex spans filtering and search.

        This endpoint is rate limited to `300` requests per hour.


        [1]: /logs/guide/collect-multiple-logs-with-pagination?tab=v2api'
      operationId: ListSpans
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SpansListRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpansListResponse'
          description: OK
        '400':
          $ref: '#/components/responses/SpansBadRequestResponse'
        '403':
          $ref: '#/components/responses/SpansForbiddenResponse'
        '422':
          $ref: '#/components/responses/SpansUnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/SpansTooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_read
      summary: Datadog Search Spans
      tags:
      - Search
      x-codegen-request-body-name: body
      x-menu-order: 2
      x-pagination:
        cursorParam: body.data.attributes.page.cursor
        cursorPath: meta.page.after
        limitParam: body.data.attributes.page.limit
        resultsPath: data
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    IncidentAttachmentPostmortemAttributes:
      description: The attributes object for a postmortem attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType'
      required:
      - attachment_type
      - attachment
      type: object
    IncidentUserDefinedFieldType:
      description: The incident user defined fields type.
      enum:
      - user_defined_field
      example: user_defined_field
      type: string
      x-enum-varnames:
      - USER_DEFINED_FIELD
    SpansAggregateResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    IncidentImpactsType:
      description: The incident impacts type.
      enum:
      - incident_impacts
      example: incident_impacts
      type: string
      x-enum-varnames:
      - INCIDENT_IMPACTS
    IncidentSearchSortOrder:
      description: The ways searched incidents can be sorted.
      enum:
      - created
      - -created
      type: string
      x-enum-varnames:
      - CREATED_ASCENDING
      - CREATED_DESCENDING
    IncidentResponseData:
      description: Incident data from a response.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentResponseAttributes'
        id:
          description: The incident's ID.
          example: 00000000-0000-0000-1234-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentResponseRelationships'
        type:
          $ref: '#/components/schemas/IncidentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentAttachmentLinkAttributes:
      description: The attributes object for a link attachment.
      properties:
        attachment:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject'
        attachment_type:
          $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType'
        modified:
          description: Timestamp when the incident attachment link was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
      required:
      - attachment_type
      - attachment
      type: object
    SpansListRequestAttributes:
      description: The object containing all the query parameters.
      properties:
        filter:
          $ref: '#/components/schemas/SpansQueryFilter'
        options:
          $ref: '#/components/schemas/SpansQueryOptions'
        page:
          $ref: '#/components/schemas/SpansListRequestPage'
        sort:
          $ref: '#/components/schemas/SpansSort'
      type: object
    SpansSort:
      description: Sort parameters when querying spans.
      enum:
      - timestamp
      - -timestamp
      type: string
      x-enum-varnames:
      - TIMESTAMP_ASCENDING
      - TIMESTAMP_DESCENDING
    IncidentRelatedObject:
      description: Object related to an incident.
      enum:
      - users
      - attachments
      type: string
      x-enum-varnames:
      - USERS
      - ATTACHMENTS
    IncidentSearchResponseIncidentsData:
      description: Incident returned by the search.
      properties:
        data:
          $ref: '#/components/schemas/IncidentResponseData'
      required:
      - data
      type: object
    RelationshipToIncidentResponderData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentRespondersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    IncidentNonDatadogCreator:
      description: Incident's non Datadog creator.
      properties:
        image_48_px:
          description: Non Datadog creator `48px` image.
          type: string
          example: example_value
        name:
          description: Non Datadog creator name.
          type: string
          example: Example Monitor
      type:
      - object
      - 'null'
    SpansListRequest:
      description: The request for a spans list.
      properties:
        data:
          $ref: '#/components/schemas/SpansListRequestData'
      type: object
    SpansQueryFilter:
      description: The search and filter query settings.
      properties:
        from:
          default: now-15m
          description: The minimum time for the requested spans, supports date-time ISO8601, date math, and regular timestamps (milliseconds).
          example: now-15m
          type: string
        query:
          default: '*'
          description: The search query - following the span search syntax.
          example: service:web* AND @http.status_code:[200 TO 299]
          type: string
        to:
          default: now
          description: The maximum time for the requested spans, supports date-time ISO8601, date math, and regular timestamps (milliseconds).
          example: now
          type: string
      type: object
    SpansAttributes:
      description: JSON object containing all span attributes and their associated values.
      properties:
        attributes:
          additionalProperties: {}
          description: JSON object of attributes from your span.
          example:
            customAttribute: 123
            duration: 2345
          type: object
        custom:
          additionalProperties: {}
          description: JSON object of custom spans data.
          type: object
        end_timestamp:
          description: End timestamp of your span.
          example: '2023-01-02T09:42:36.420Z'
          format: date-time
          type: string
        env:
          description: Name of the environment from where the spans are being sent.
          example: prod
          type: string
        host:
          description: Name of the machine from where the spans are being sent.
          example: i-0123
          type: string
        ingestion_reason:
          description: The reason why the span was ingested.
          example: rule
          type: string
        parent_id:
          description: Id of the span that's parent of this span.
          example: '0'
          type: string
        resource_hash:
          description: Unique identifier of the resource.
          example: a12345678b91c23d
          type: string
        resource_name:
          description: The name of the resource.
          example: agent
          type: string
        retained_by:
          description: The reason why the span was indexed.
          example: retention_filter
          type: string
        service:
          description: 'The name of the application or service generating the span events.

            It is used to switch from APM to Logs, so make sure you define the same

            value when you use both products.'
          example: agent
          type: string
        single_span:
          description: Whether or not the span was collected as a stand-alone span. Always associated to "single_span" ingestion_reason if true.
          example: true
          type: boolean
        span_id:
          description: Id of the span.
          example: '1234567890987654321'
          type: string
        start_timestamp:
          description: Start timestamp of your span.
          example: '2023-01-02T09:42:36.320Z'
          format: date-time
          type: string
        tags:
          description: Array of tags associated with your span.
          example:
          - team:A
          items:
            description: Tag associated with your span.
            type: string
          type: array
        trace_id:
          description: Id of the trace to which the span belongs.
          example: '1234567890987654321'
          type: string
        type:
          description: The type of the span.
          example: web
          type: string
      type: object
    RelationshipToIncidentAttachmentData:
      description: The attachment relationship data.
      properties:
        id:
          description: A unique identifier that represents the attachment.
          example: 00000000-0000-abcd-1000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    SpansType:
      default: spans
      description: Type of the span.
      enum:
      - spans
      example: spans
      type: string
      x-enum-varnames:
      - SPANS
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    IncidentSearchResponseFacetsData:
      description: Facet data for incidents returned by a search query.
      properties:
        commander:
          description: Facet data for incident commander users.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseUserFacetData'
          type: array
        created_by:
          description: Facet data for incident creator users.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseUserFacetData'
          type: array
        fields:
          description: Facet data for incident property fields.
          items:
            $ref: '#/components/schemas/IncidentSearchResponsePropertyFieldFacetData'
          type: array
        impact:
          description: Facet data for incident impact attributes.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseFieldFacetData'
          type: array
        last_modified_by:
          description: Facet data for incident last modified by users.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseUserFacetData'
          type: array
        postmortem:
          description: Facet data for incident postmortem existence.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseFieldFacetData'
          type: array
        responder:
          description: Facet data for incident responder users.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseUserFacetData'
          type: array
        severity:
          description: Facet data for incident severity attributes.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseFieldFacetData'
          type: array
        state:
          description: Facet data for incident state attributes.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseFieldFacetData'
          type: array
        time_to_repair:
          description: Facet data for incident time to repair metrics.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseNumericFacetData'
          type: array
        time_to_resolve:
          description: Facet data for incident time to resolve metrics.
          items:
            $ref: '#/components/schemas/IncidentSearchResponseNumericFacetData'
          type: array
      type: object
    IncidentResponseIncludedItem:
      description: An object related to an incident that is included in the response.
      oneOf:
      - $ref: '#/components/schemas/IncidentUserData'
      - $ref: '#/components/schemas/IncidentAttachmentData'
    RelationshipToIncidentIntegrationMetadataData:
      description: A relationship reference for an integration metadata object.
      example:
        id: 00000000-abcd-0002-0000-000000000000
        type: incident_integrations
      properties:
        id:
          description: A unique identifier that represents the integration metadata.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentIntegrationMetadataType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentResponseAttributes:
      description: The incident's attributes from a response.
      properties:
        archived:
          description: Timestamp of when the incident was archived.
          format: date-time
          readOnly: true
          type:
          - string
          - 'null'
          example: example_value
        case_id:
          description: The incident case id.
          format: int64
          type:
          - integer
          - 'null'
          example: 42
        created:
          description: Timestamp when the incident was created.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        customer_impact_duration:
          description: 'Length of the incident''s customer impact in seconds.

            Equals the difference between `customer_impact_start` and `customer_impact_end`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        customer_impact_end:
          description: Timestamp when customers were no longer impacted by the incident.
          format: date-time
          type:
          - string
          - 'null'
          example: example_value
        customer_impact_scope:
          description: A summary of the impact customers experienced during the incident.
          example: An example customer impact scope
          type:
          - string
          - 'null'
        customer_impact_start:
          description: Timestamp when customers began being impacted by the incident.
          format: date-time
          type:
          - string
          - 'null'
          example: example_value
        customer_impacted:
          description: A flag indicating whether the incident caused customer impact.
          example: false
          type: boolean
        detected:
          description: Timestamp when the incident was detected.
          format: date-time
          type:
          - string
          - 'null'
          example: example_value
        fields:
          additionalProperties:
            $ref: '#/components/schemas/IncidentFieldAttributes'
          description: A condensed view of the user-defined fields attached to incidents.
          example:
            severity:
              type: dropdown
              value: SEV-5
          type: object
        incident_type_uuid:
          description: A unique identifier that represents an incident type.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        modified:
          description: Timestamp when the incident was last modified.
          format: date-time
          readOnly: true
          type: string
          example: example_value
        non_datadog_creator:
          $ref: '#/components/schemas/IncidentNonDatadogCreator'
        notification_handles:
          description: Notification handles that will be notified of the incident during update.
          example:
          - display_name: Jane Doe
            handle: '@user@email.com'
          - display_name: Slack Channel
            handle: '@slack-channel'
          - display_name: Incident Workflow
            handle: '@workflow-from-incident'
          items:
            $ref: '#/components/schemas/IncidentNotificationHandle'
          type:
          - array
          - 'null'
        public_id:
          description: The monotonically increasing integer ID for the incident.
          example: 1
          format: int64
          type: integer
        resolved:
          description: Timestamp when the incident's state was last changed from active or stable to resolved or completed.
          format: date-time
          type:
          - string
          - 'null'
          example: example_value
        severity:
          $ref: '#/components/schemas/IncidentSeverity'
        state:
          description: The state incident.
          type:
          - string
          - 'null'
          example: example_value
        time_to_detect:
          description: 'The amount of time in seconds to detect the incident.

            Equals the difference between `customer_impact_start` and `detected`.'
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_internal_response:
          description: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_repair:
          description: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        time_to_resolve:
          description: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`.
          format: int64
          readOnly: true
          type: integer
          example: 42
        title:
          description: The title of the incident, which summarizes what happened.
          example: A test incident title
          type: string
        visibility:
          description: The incident visibility status.
          type:
          - string
          - 'null'
          example: example_value
      required:
      - title
      type: object
    SpansResponseMetadataPage:
      description: Paging attributes.
      properties:
        after:
          description: 'The cursor to use to get the next results, if any. To make the next request, use the same

            parameters with the addition of the `page[cursor]`.'
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    SpansListRequestPage:
      description: Paging attributes for listing spans.
      properties:
        cursor:
          description: List following results with a cursor provided in the previous query.
          example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
        limit:
          default: 10
          description: Maximum number of spans in the response.
          example: 25
          format: int32
          maximum: 1000
          type: integer
      type: object
    IncidentFieldAttributesValueType:
      default: multiselect
      description: Type of the multiple value field definitions.
      enum:
      - multiselect
      - textarray
      - metrictag
      - autocomplete
      example: multiselect
      type: string
      x-enum-varnames:
      - MULTISELECT
      - TEXTARRAY
      - METRICTAG
      - AUTOCOMPLETE
    SpansListResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: 'Link for the next set of results. Note that the request can also be made using the

            POST endpoint.'
          example: https://app.datadoghq.com/api/v2/spans/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
          type: string
      type: object
    IncidentRespondersType:
      description: The incident responders type.
      enum:
      - incident_responders
      example: incident_responders
      type: string
      x-enum-varnames:
      - INCIDENT_RESPONDERS
    RelationshipToIncidentUserDefinedFieldData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the responder.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentUserDefinedFieldType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentSearchResponse:
      description: Response with incidents and facets.
      properties:
        data:
          $ref: '#/components/schemas/IncidentSearchResponseData'
        included:
          description: Included related resources that the user requested.
          items:
            $ref: '#/components/schemas/IncidentResponseIncludedItem'
          readOnly: true
          type: array
        meta:
          $ref: '#/components/schemas/IncidentSearchResponseMeta'
      required:
      - data
      type: object
    RelationshipToIncidentImpactData:
      description: Relationship to impact object.
      properties:
        id:
          description: A unique identifier that represents the impact.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/IncidentImpactsType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    IncidentSearchResponseNumericFacetData:
      description: Facet data numeric attributes of an incident.
      properties:
        aggregates:
          $ref: '#/components/schemas/IncidentSearchResponseNumericFacetDataAggregates'
        name:
          description: Name of the incident property field.
          example: time_to_repair
          type: string
      required:
      - name
      - aggregates
      type: object
    RelationshipToIncidentAttachment:
      description: A relationship reference for attachments.
      properties:
        data:
          description: An array of incident attachments.
          items:
            $ref: '#/components/schemas/RelationshipToIncidentAttachmentData'
          type: array
      required:
      - data
      type: object
    IncidentUserData:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentUserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    IncidentFieldAttributes:
      description: Dynamic fields for which selections can be made, with field names as keys.
      oneOf:
      - $ref: '#/components/schemas/IncidentFieldAttributesSingleValue'
      - $ref: '#/components/schemas/IncidentFieldAttributesMultipleValue'
    IncidentFieldAttributesSingleValue:
      description: A field with a single value selected.
      properties:
        type:
          $ref: '#/components/schemas/IncidentFieldAttributesSingleValueType'
        value:
          description: The single value selected for this field.
          example: SEV-1
          type:
          - string
          - 'null'
      type: object
    IncidentResponseRelationships:
      description: The incident's relationships from a response.
      properties:
        attachments:
          $ref: '#/components/schemas/RelationshipToIncidentAttachment'
        commander_user:
          $ref: '#/components/schemas/NullableRelationshipToUser'
        created_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        impacts:
          $ref: '#/components/schemas/RelationshipToIncidentImpacts'
        integrations:
          $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas'
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
        responders:
          $ref: '#/components/schemas/RelationshipToIncidentResponders'
        user_defined_fields:
          $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields'
      type: object
    IncidentAttachmentData:
      description: A single incident attachment.
      example:
        attributes:
          attachment:
            documentUrl: ''
            title: Postmortem IR-123
          attachment_type: postmortem
        id: 00000000-abcd-0002-0000-000000000000
        relationships:
          last_modified_by_user:
            data:
              id: 00000000-0000-0000-cccc-000000000000
              type: users
        type: incident_attachments
      properties:
        attributes:
          $ref: '#/components/schemas/IncidentAttachmentAttributes'
        id:
          description: A unique identifier that represents the incident attachment.
          example: 00000000-abcd-0001-0000-000000000000
          type: string
        relationships:
          $ref: '#/components/schemas/IncidentAttachmentRelationships'
        type:
          $ref: '#/components/schemas/IncidentAttachmentType'
      required:
      - type
      - attributes
      - id
      - relationships
      type: object
    IncidentAttachmentRelationships:
      description: The incident attachment's relationships.
      properties:
        last_modified_by_user:
          $ref: '#/components/schemas/RelationshipToUser'
      type: object
    IncidentSearchResponseFieldFacetData:
      description: Facet value and number of occurrences for a property field of an incident.
      properties:
        count:
          $ref: '#/components/schemas/IncidentSearchResponseFacetCount'
        name:
          description: The facet value appearing in search results.
          example: SEV-2
          type: string
      type: object
    NullableRelationshipToUserData:
      description: Relationship to user object.
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type:
      - object
      - 'null'
      x-merge-override:
        required: false
    SpansListResponse:
      description: Response object with all spans matching the request and pagination information.
      properties:
        data:
          description: Array of spans matching the request.
          items:
            $ref: '#/components/schemas/Span'
          type: array
        links:
          $ref: '#/components/schemas/SpansListResponseLinks'
        meta:
          $ref: '#/components/schemas/SpansListResponseMetadata'
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    IncidentSearchResponseNumericFacetDa

# --- truncated at 32 KB (57 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-search-api-openapi.yml