Datadog Validate API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Validate API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Validate
paths:
  /api/v2/remote_config/products/obs_pipelines/pipelines/validate:
    post:
      description: 'Validates a pipeline configuration without creating or updating any resources.

        Returns a list of validation errors, if any.

        '
      operationId: ValidatePipeline
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObservabilityPipelineSpec'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Validate an Observability Pipeline
      tags:
      - Validate
      x-menu-order: 5
      x-permission:
        operator: OR
        permissions:
        - observability_pipelines_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/validation:
    post:
      description: Validate a detection rule.
      operationId: ValidateSecurityMonitoringRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleValidatePayload'
        required: true
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Validate a Detection Rule
      tags:
      - Validate
      x-codegen-request-body-name: body
      x-menu-order: 10
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    ObservabilityPipelineAmazonOpenSearchDestinationType:
      default: amazon_opensearch
      description: The destination type. The value should always be `amazon_opensearch`.
      enum:
      - amazon_opensearch
      example: amazon_opensearch
      type: string
      x-enum-varnames:
      - AMAZON_OPENSEARCH
    ObservabilityPipelineNewRelicDestination:
      description: The `new_relic` destination sends logs to the New Relic platform.
      properties:
        id:
          description: The unique identifier for this component.
          example: new-relic-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        region:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationType'
      required:
      - id
      - type
      - inputs
      - region
      type: object
    ObservabilityPipelineHttpServerSourceAuthStrategy:
      description: HTTP authentication method.
      enum:
      - none
      - plain
      example: plain
      type: string
      x-enum-varnames:
      - NONE
      - PLAIN
    ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern:
      description: Defines a custom regex-based pattern for identifying sensitive data in logs.
      properties:
        options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType'
      required:
      - type
      - options
      type: object
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    ObservabilityPipelineRemoveFieldsProcessorType:
      default: remove_fields
      description: The processor type. The value should always be `remove_fields`.
      enum:
      - remove_fields
      example: remove_fields
      type: string
      x-enum-varnames:
      - REMOVE_FIELDS
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    ObservabilityPipelineRsyslogSource:
      description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: rsyslog-source
          type: string
        mode:
          $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType'
      required:
      - id
      - type
      - mode
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    ObservabilityPipelineSplunkHecDestinationEncoding:
      description: Encoding format for log events.
      enum:
      - json
      - raw_message
      example: json
      type: string
      x-enum-varnames:
      - JSON
      - RAW_MESSAGE
    ObservabilityPipelineFluentBitSource:
      description: The `fluent_bit` source ingests logs from Fluent Bit.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentBitSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineFluentdSource:
      description: The `fluentd` source ingests logs from a Fluentd-compatible service.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components).
          example: fluent-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineFluentdSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineRenameFieldsProcessorType:
      default: rename_fields
      description: The processor type. The value should always be `rename_fields`.
      enum:
      - rename_fields
      example: rename_fields
      type: string
      x-enum-varnames:
      - RENAME_FIELDS
    ObservabilityPipelineLogstashSourceType:
      default: logstash
      description: The source type. The value should always be `logstash`.
      enum:
      - logstash
      example: logstash
      type: string
      x-enum-varnames:
      - LOGSTASH
    CloudConfigurationRuleType:
      description: The rule type.
      enum:
      - cloud_configuration
      type: string
      x-enum-varnames:
      - CLOUD_CONFIGURATION
    ObservabilityPipelineSumoLogicSource:
      description: The `sumo_logic` source receives logs from Sumo Logic collectors.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sumo-logic-source
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineGeneratedMetric:
      description: 'Defines a log-based custom metric, including its name, type, filter, value computation strategy,

        and optional grouping fields.

        '
      properties:
        group_by:
          description: Optional fields used to group the metric series.
          example:
          - service
          - env
          items:
            type: string
          type: array
        include:
          description: Datadog filter query to match logs for metric generation.
          example: service:billing
          type: string
        metric_type:
          $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType'
        name:
          description: Name of the custom metric to be created.
          example: logs.processed
          type: string
        value:
          $ref: '#/components/schemas/ObservabilityPipelineMetricValue'
      required:
      - name
      - include
      - metric_type
      - value
      type: object
    ObservabilityPipelineHttpClientSourceAuthStrategy:
      description: Optional authentication strategy for HTTP requests.
      enum:
      - basic
      - bearer
      example: basic
      type: string
      x-enum-varnames:
      - BASIC
      - BEARER
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    ObservabilityPipelineGoogleChronicleDestination:
      description: The `google_chronicle` destination sends logs to Google Chronicle.
      properties:
        auth:
          $ref: '#/components/schemas/ObservabilityPipelineGcpAuth'
        customer_id:
          description: The Google Chronicle customer ID.
          example: abcdefg123456789
          type: string
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding'
        id:
          description: The unique identifier for this component.
          example: google-chronicle-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        log_type:
          description: The log type metadata associated with the Chronicle destination.
          example: nginx_logs
          type: string
        type:
          $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType'
      required:
      - id
      - type
      - inputs
      - auth
      - customer_id
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction:
      description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content.
      enum:
      - hash
      example: hash
      type: string
      x-enum-varnames:
      - HASH
    ObservabilityPipelineOcsfMapperProcessorMapping:
      description: Defines how specific events are transformed to OCSF using a mapping configuration.
      properties:
        include:
          description: A Datadog search query used to select the logs that this mapping should apply to.
          example: service:my-service
          type: string
        mapping:
          $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping'
      required:
      - include
      - mapping
      type: object
    MicrosoftSentinelDestinationType:
      default: microsoft_sentinel
      description: The destination type. The value should always be `microsoft_sentinel`.
      enum:
      - microsoft_sentinel
      example: microsoft_sentinel
      type: string
      x-enum-varnames:
      - MICROSOFT_SENTINEL
    AzureStorageDestination:
      description: The `azure_storage` destination forwards logs to an Azure Blob Storage container.
      properties:
        blob_prefix:
          description: Optional prefix for blobs written to the container.
          example: logs/
          type: string
        container_name:
          description: The name of the Azure Blob Storage container to store logs in.
          example: my-log-container
          type: string
        id:
          description: The unique identifier for this component.
          example: azure-storage-destination
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - processor-id
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/AzureStorageDestinationType'
      required:
      - id
      - type
      - inputs
      - container_name
      type: object
    ObservabilityPipelineSensitiveDataScannerProcessorRule:
      description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take.
      properties:
        keyword_options:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions'
        name:
          description: A name identifying the rule.
          example: Redact Credit Card Numbers
          type: string
        on_match:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction'
        pattern:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern'
        scope:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope'
        tags:
          description: Tags assigned to this rule for filtering and classification.
          example:
          - pii
          - ccn
          items:
            type: string
          type: array
      required:
      - name
      - tags
      - pattern
      - scope
      - on_match
      type: object
    ObservabilityPipelineHttpClientSourceType:
      default: http_client
      description: The source type. The value should always be `http_client`.
      enum:
      - http_client
      example: http_client
      type: string
      x-enum-varnames:
      - HTTP_CLIENT
    ObservabilityPipelineEnrichmentTableFileKeyItemsComparison:
      description: Defines how to compare key fields for enrichment table lookups.
      enum:
      - equals
      example: equals
      type: string
      x-enum-varnames:
      - EQUALS
    SecurityMonitoringStandardRuleQuery:
      description: Query for matching rule.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metric:
          deprecated: true
          description: '(Deprecated) The target field to aggregate over when using the sum or max

            aggregations. `metrics` field should be used instead.'
          type: string
          example: example_value
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    ObservabilityPipelineQuotaProcessorLimit:
      description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events.
      properties:
        enforce:
          $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType'
        limit:
          description: The limit for quota enforcement.
          example: 1000
          format: int64
          type: integer
      required:
      - enforce
      - limit
      type: object
    ObservabilityPipelineParseGrokProcessorRuleMatchRule:
      description: 'Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns.

        Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field.

        '
      properties:
        name:
          description: The name of the rule.
          example: MyParsingRule
          type: string
        rule:
          description: The definition of the Grok rule.
          example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}'
          type: string
      required:
      - name
      - rule
      type: object
    ObservabilityPipelineKafkaSource:
      description: The `kafka` source ingests data from Apache Kafka topics.
      properties:
        group_id:
          description: Consumer group ID used by the Kafka client.
          example: consumer-group-0
          type: string
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: kafka-source
          type: string
        librdkafka_options:
          description: Optional list of advanced Kafka client configuration options, defined as key-value pairs.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceLibrdkafkaOption'
          type: array
        sasl:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceSasl'
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        topics:
          description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified.
          example:
          - topic1
          - topic2
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceType'
      required:
      - id
      - type
      - group_id
      - topics
      type: object
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    ObservabilityPipelineHttpServerSource:
      description: The `http_server` source collects logs over HTTP POST from external services.
      properties:
        auth_strategy:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy'
        decoding:
          $ref: '#/components/schemas/ObservabilityPipelineDecoding'
        id:
          description: Unique ID for the HTTP server source.
          example: http-server-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType'
      required:
      - id
      - type
      - auth_strategy
      - decoding
      type: object
    ObservabilityPipelineRsyslogSourceType:
      default: rsyslog
      description: The source type. The value should always be `rsyslog`.
      enum:
      - rsyslog
      example: rsyslog
      type: string
      x-enum-varnames:
      - RSYSLOG
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    ObservabilityPipelineSplunkTcpSource:
      description: 'The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.

        TLS is supported for secure transmission.

        '
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-tcp-source
          type: string
        tls:
          $ref: '#/components/schemas/ObservabilityPipelineTls'
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSourceType'
      required:
      - id
      - type
      type: object
    ObservabilityPipelineParseJSONProcessor:
      description: The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string.
      properties:
        field:
          description: The name of the log field that contains a JSON string.
          example: message
          type: string
        id:
          description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: parse-json-processor
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: service:my-service
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - datadog-agent-source
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessorType'
      required:
      - id
      - type
      - include
      - field
      - inputs
      type: object
    ObservabilityPipelineOcsfMappingLibrary:
      description: Predefined library mappings for common log formats.
      enum:
      - CloudTrail Account Change
      - GCP Cloud Audit CreateBucket
      - GCP Cloud Audit CreateSink
      - GCP Cloud Audit SetIamPolicy
      - GCP Cloud Audit UpdateSink
      - Github Audit Log API Activity
      - Google Workspace Admin Audit addPrivilege
      - Microsoft 365 Defender Incident
      - Microsoft 365 Defender UserLoggedIn
      - Okta System Log Authentication
      - Palo Alto Networks Firewall Traffic
      example: CloudTrail Account Change
      type: string
      x-enum-varnames:
      - CLOUDTRAIL_ACCOUNT_CHANGE
      - GCP_CLOUD_AUDIT_CREATEBUCKET
      - GCP_CLOUD_AUDIT_CREATESINK
      - GCP_CLOUD_AUDIT_SETIAMPOLICY
      - GCP_CLOUD_AUDIT_UPDATESINK
      - GITHUB_AUDIT_LOG_API_ACTIVITY
      - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE
      - MICROSOFT_365_DEFENDER_INCIDENT
      - MICROSOFT_365_DEFENDER_USERLOGGEDIN
      - OKTA_SYSTEM_LOG_AUTHENTICATION
      - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC
    ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType:
      description: Indicates that a predefined library pattern is used.
      enum:
      - library
      example: library
      type: string
      x-enum-varnames:
      - LIBRARY
    ObservabilityPipelineOpenSearchDestinationType:
      default: opensearch
      description: The destination type. The value should always be `opensearch`.
      enum:
      - opensearch
      example: opensearch
      type: string
      x-enum-varnames:
      - OPENSEARCH
    ObservabilityPipelineSensitiveDataScannerProcessor:
      description: The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log events.
      properties:
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: sensitive-scanner
          type: string
        include:
          description: A Datadog search query used to determine which logs this processor targets.
          example: source:prod
          type: string
        inputs:
          description: A list of component IDs whose output is used as the `input` for this component.
          example:
          - parse-json-processor
          items:
            type: string
          type: array
        rules:
          description: A list of rules for identifying and acting on sensitive data patterns.
          items:
            $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule'
          type: array
        type:
          $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType'
      required:
      - id
      - type
      - include
      - inputs
      - rules
      type: object
    ObservabilityPipelineDatadogLogsDestinationType:
      default: datadog_logs
      description: The destination type. The value should always be `datadog_logs`.
      enum:
      - datadog_logs
      example: datadog_logs
      type: string
      x-enum-varnames:
      - DATADOG_LOGS
    ObservabilityPipelineSensitiveDataScannerProcessorType:
      default: sensitive_data_scanner
      description: The processor type. The value should always be `sensitive_data_scanner`.
      enum:
      - sensitive_data_scanner
      example: sensitive_data_scanner
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER
    ObservabilityPipelineKafkaSourceSasl:
      description: Specifies the SASL mechanism for authenticating with a Kafka cluster.
      properties:
        mechanism:
          $ref: '#/components/schemas/ObservabilityPipelinePipelineKafkaSourceSaslMechanism'
      type: object
    ObservabilityPipelineSplunkHecDestination:
      description: 'The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC).

        '
      properties:
        auto_extract_timestamp:
          description: 'If `true`, Splunk tries to extract timestamps from incoming log events.

            If `false`, Splunk assigns the time the event was received.

            '
          example: true
          type: boolean
        encoding:
          $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding'
        id:
          description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components).
          example: splunk-hec-destination
          type: string
        index:
          description: Optional name of the Splunk index where logs are written.
          example: main
          type: string
        inputs:
          description: A list of component IDs whose output is used as th

# --- truncated at 32 KB (145 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-validate-api-openapi.yml