Datadog Rules API
The Rules API from Datadog — 27 operation(s) for rules.
Datadog Rules API is one of 290 APIs that Datadog publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
This API exposes 4 JSON Schema definitions.
Tagged areas include Rules. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, authentication docs, an API reference, and 4 JSON Schemas.
This API exposes 54 operations across 27 paths, and defines 266 schemas. It is described by OpenAPI 3.0.0, at version 1.0.
Requests are made against 3 base URLs: https://{subdomain}.{site}, {protocol}://{name}, https://{subdomain}.{site}.
54 operations
27 paths
266 schemas
10 DELETE19 GET7 PATCH14 POST4 PUT
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 4
Datadog Rules API declares
4 security schemes
for authenticating requests.
It supports OAuth 2.0 (AuthZ) using the authorizationCode flow, exposing 68 scopes.
An API key is passed in the header as DD-API-KEY (apiKeyAuth).
An API key is passed in the header as DD-APPLICATION-KEY (appKeyAuth).
It accepts HTTP bearer tokens (bearerAuth).
By default, every request must be authenticated.
AuthZ— This API uses OAuth 2 with the implicit grant flow.apiKeyAuth— Your Datadog API Key.appKeyAuth— Your Datadog APP Key.
Paths & Operations 54
Across 27 paths, the API surfaces 54 operations — 10 DELETE, 19 GET, 7 PATCH, 14 POST, 4 PUT. Each is listed below with its method, path, parameters, and response codes.
Rules 54
GET
/api/v2/monitor/notification_rule
Datadog Get All Monitor Notification Rules
POST
/api/v2/monitor/notification_rule
Datadog Create a Monitor Notification Rule
DELETE
/api/v2/monitor/notification_rule/{rule_id}
Datadog Delete a Monitor Notification Rule
GET
/api/v2/monitor/notification_rule/{rule_id}
Datadog Get a Monitor Notification Rule
PATCH
/api/v2/monitor/notification_rule/{rule_id}
Datadog Update a Monitor Notification Rule
GET
/api/v2/on-call/teams/{team_id}/routing-rules
Datadog Get On-call Team Routing Rules
PUT
/api/v2/on-call/teams/{team_id}/routing-rules
Datadog Set On-call Team Routing Rules
GET
/api/v2/remote_config/products/asm/waf/custom_rules
Datadog List All Waf Custom Rules
POST
/api/v2/remote_config/products/asm/waf/custom_rules
Datadog Create a Waf Custom Rule
DELETE
/api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}
Datadog Delete a Waf Custom Rule
GET
/api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}
Datadog Get a Waf Custom Rule
PUT
/api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}
Datadog Update a Waf Custom Rule
GET
/api/v2/remote_config/products/cws/agent_rules
Datadog Get All Workload Protection Agent Rules
POST
/api/v2/remote_config/products/cws/agent_rules
Datadog Create a Workload Protection Agent Rule
DELETE
/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}
Datadog Delete a Workload Protection Agent Rule
GET
/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}
Datadog Get a Workload Protection Agent Rule
PATCH
/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}
Datadog Update a Workload Protection Agent Rule
GET
/api/v2/scorecard/outcomes
Datadog List All Rule Outcomes
GET
/api/v2/scorecard/rules
Datadog List All Rules
POST
/api/v2/scorecard/rules
Datadog Create a New Rule
DELETE
/api/v2/scorecard/rules/{rule_id}
Datadog Delete a Rule
PUT
/api/v2/scorecard/rules/{rule_id}
Datadog Update an Existing Rule
GET
/api/v2/security/signals/notification_rules
Datadog Get the List of Signal-based Notification Rules
POST
/api/v2/security/signals/notification_rules
Datadog Create a New Signal-based Notification Rule
DELETE
/api/v2/security/signals/notification_rules/{id}
Datadog Delete a Signal-based Notification Rule
GET
/api/v2/security/signals/notification_rules/{id}
Datadog Get Details of a Signal-based Notification Rule
PATCH
/api/v2/security/signals/notification_rules/{id}
Datadog Patch a Signal-based Notification Rule
GET
/api/v2/security/vulnerabilities/notification_rules
Datadog Get the List of Vulnerability Notification Rules
POST
/api/v2/security/vulnerabilities/notification_rules
Datadog Create a New Vulnerability-based Notification Rule
DELETE
/api/v2/security/vulnerabilities/notification_rules/{id}
Datadog Delete a Vulnerability-based Notification Rule
GET
/api/v2/security/vulnerabilities/notification_rules/{id}
Datadog Get Details of a Vulnerability Notification Rule
PATCH
/api/v2/security/vulnerabilities/notification_rules/{id}
Datadog Patch a Vulnerability-based Notification Rule
GET
/api/v2/security_monitoring/cloud_workload_security/agent_rules
Datadog Get All Workload Protection Agent Rules (us1-fed)
POST
/api/v2/security_monitoring/cloud_workload_security/agent_rules
Datadog Create a Workload Protection Agent Rule (us1-fed)
DELETE
/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}
Datadog Delete a Workload Protection Agent Rule (us1-fed)
GET
/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}
Datadog Get a Workload Protection Agent Rule (us1-fed)
PATCH
/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}
Datadog Update a Workload Protection Agent Rule (us1-fed)
GET
/api/v2/security_monitoring/configuration/suppressions
Datadog Get All Suppression Rules
POST
/api/v2/security_monitoring/configuration/suppressions
Datadog Create a Suppression Rule
DELETE
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}
Datadog Delete a Suppression Rule
GET
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}
Datadog Get a Suppression Rule
PATCH
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}
Datadog Update a Suppression Rule
GET
/api/v2/security_monitoring/rules
Datadog List Rules
POST
/api/v2/security_monitoring/rules
Datadog Create a Detection Rule
POST
/api/v2/security_monitoring/rules/convert
Datadog Convert a Rule from Json to Terraform
POST
/api/v2/security_monitoring/rules/test
Datadog Test a Rule
POST
/api/v2/security_monitoring/rules/validation
Datadog Validate a Detection Rule
DELETE
/api/v2/security_monitoring/rules/{rule_id}
Datadog Delete an Existing Rule
PUT
/api/v2/security_monitoring/rules/{rule_id}
Datadog Update an Existing Rule
GET
/api/v2/security_monitoring/rules/{rule_id}/convert
Datadog Convert an Existing Rule from Json to Terraform
POST
/api/v2/security_monitoring/rules/{rule_id}/test
Datadog Test an Existing Rule
POST
/api/v2/sensitive-data-scanner/config/rules
Datadog Create Scanning Rule
DELETE
/api/v2/sensitive-data-scanner/config/rules/{rule_id}
Datadog Delete Scanning Rule
PATCH
/api/v2/sensitive-data-scanner/config/rules/{rule_id}
Datadog Update Scanning Rule
Schemas 266
The contract defines 266 schemas that model the data the API accepts and returns. The most detailed are SecurityMonitoringStandardRuleResponse (24 properties), CloudWorkloadSecurityAgentRuleAttributes (21 properties), SecurityMonitoringSignalRuleResponse (18 properties), SecurityMonitoringSuppressionAttributes (14 properties). Each schema is shown below with its type and property counts.
SecurityMonitoringRuleEvaluationWindow
integer
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection…
UpdateRuleRequestData
object
Data for the request to update a scorecard rule.
2 properties
SendTeamsMessageActionType
string
Indicates that the action is a send Microsoft Teams message action.
SecurityMonitoringRuleTypeRead
string
The rule type.
SensitiveDataScannerStandardPattern
object
Data containing the standard pattern id.
2 properties
SecurityMonitoringRuleMaxSignalDuration
integer
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
RuleName
string
Name of the notification rule.
SecurityMonitoringRuleCaseActionOptionsUserBehaviorName
string
Used with the case action of type 'userbehavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
UsersType
string
Users resource type.
SecurityMonitoringRuleNewValueOptionsLearningThreshold
integer
A number of occurrences after which signals will be generated for values that weren't learned.
SecurityMonitoringRuleNewValueOptionsForgetAfter
integer
The duration in days after which a learned value is forgotten.
ApplicationSecurityWafCustomRuleAction
object
The definition of ApplicationSecurityWafCustomRuleAction object.
2 properties
SensitiveDataScannerRuleDeleteResponse
object
Delete rule response.
1 property
CloudWorkloadSecurityAgentRuleKill
object
Kill system call applied on the container matching the rule
1 property
RoutingRule
object
Represents a routing rule, including its attributes, relationships, and unique identifier.
4 properties
1 required
JSONAPIErrorItem
object
API error response body
5 properties
ApplicationSecurityWafCustomRuleTagsCategory
string
The category of the WAF Rule, can be either businesslogic, attackattempt or securityresponse.
MonitorNotificationRuleRelationships
object
All relationships associated with monitor notification rule.
1 property
SensitiveDataScannerRuleCreate
object
Data related to the creation of a rule.
3 properties
3 required
RuleOutcomeRelationships
object
The JSON:API relationship to a scorecard rule.
1 property
OutcomesResponseIncluded
array
Array of rule details.
CloudConfigurationRuleType
string
The rule type.
ApplicationSecurityWafCustomRuleResponse
object
Response object that includes a single WAF custom rule.
1 property
RuleTypesItems
string
Security rule type which can be used in security rules. Signal-based notification rules can filter signals based on rule types applicationsecurity, logdetectio…
ListRulesResponseLinks
object
Links attributes.
1 property
SensitiveDataScannerRuleDeleteRequest
object
Delete rule request.
1 property
1 required
SensitiveDataScannerRuleAttributes
object
Attributes of the Sensitive Data Scanner rule.
10 properties
ApplicationSecurityWafCustomRuleConditionParameters
object
The scope of the WAF custom rule.
6 properties
1 required
UserAttributes
object
Attributes of user object returned by the API.
12 properties
SensitiveDataScannerTextReplacementType
string
Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacementstring means that one can chose a text to replace the…
SecurityMonitoringSuppressionID
string
The ID of the suppression rule.
SecurityMonitoringRuleQueryAggregation
string
The aggregation type.
SecurityMonitoringRuleTypeTest
string
The rule type.
SecurityMonitoringRuleResponse
Create a new rule.
SecurityMonitoringRuleTestResponse
object
Result of the test of the rule queries.
1 property
MonitorNotificationRuleId
string
The ID of the monitor notification rule.
NotificationRuleAttributes
object
Attributes of the notification rule.
10 properties
9 required
RelationshipToRuleDataObject
object
Rule relationship data.
2 properties
SensitiveDataScannerIncludedKeywordConfiguration
object
Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a define…
3 properties
2 required
ApplicationSecurityWafCustomRuleUpdateAttributes
object
Update a WAF custom rule.
8 properties
5 required
RelationshipToOutcome
object
The JSON:API relationship to a scorecard outcome.
1 property
SecurityMonitoringStandardRuleQuery
object
Query for matching rule.
9 properties
SecurityMonitoringFilterAction
string
The type of filtering action.
SecurityMonitoringSignalRuleResponse
object
Rule.
18 properties
JSONAPIErrorResponse
object
API error response.
1 property
1 required
NotificationRule
object
Notification rules allow full control over notifications generated by the various Datadog security products. They allow users to define the conditions under wh…
3 properties
3 required
SecurityMonitoringRuleThirdPartyOptions
object
Options on third party detection method.
4 properties
CloudWorkloadSecurityAgentRuleUpdateData
object
Object for a single Agent rule
3 properties
2 required
MonitorNotificationRuleResponseAttributes
object
Attributes of the monitor notification rule.
5 properties
SecurityMonitoringSuppressionResponse
object
Response object containing a single suppression rule.
1 property
MonitorNotificationRuleUpdateRequestData
object
Object to update a monitor notification rule.
3 properties
2 required
PatchNotificationRuleParameters
object
Body of the notification rule patch request.
1 property
ApplicationSecurityWafCustomRuleCondition
object
One condition of the WAF Custom Rule.
2 properties
2 required
SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is dec…
SecurityMonitoringRuleQueryPayloadData
object
Payload used to test the rule query.
5 properties
ApplicationSecurityWafCustomRuleConditionOperator
string
Operator to use for the WAF Condition.
User
object
User object returned by the API.
4 properties
CloudWorkloadSecurityAgentRuleUpdateAttributes
object
Update an existing Cloud Workload Security Agent rule
9 properties
ApplicationSecurityWafCustomRuleListResponse
object
Response object that includes a list of WAF custom rules.
1 property
ApplicationSecurityWafCustomRuleConditionInputAddress
string
Input from the request on which the condition should apply.
RuleSeverity
string
Severity of a security rule.
TeamRoutingRulesData
object
Represents the top-level data object for team routing rules, containing the ID, relationships, and resource type.
3 properties
1 required
TeamRoutingRulesDataType
string
Team routing rules resource type.
CreateRuleResponse
object
Created rule in response.
1 property
SensitiveDataScannerRuleUpdateRequest
object
Update rule request.
2 properties
2 required
SensitiveDataScannerTextReplacement
object
Object describing how the scanned event will be replaced.
3 properties
Version
integer
Version of the notification rule. It is updated when the rule is modified.
CreateNotificationRuleParametersData
object
Data of the notification rule create request: the rule type, and the rule attributes. All fields are required.
2 properties
2 required
ApplicationSecurityWafCustomRuleUpdateData
object
Object for a single WAF Custom Rule.
2 properties
2 required
RelationshipToOrganization
object
Relationship to an organization.
1 property
1 required
SecurityMonitoringRuleCaseActionType
string
The action type.
RoutingRuleAttributes
object
Defines the configurable attributes of a routing rule, such as actions, query, time restriction, and urgency.
4 properties
UpdateRuleRequest
object
Request to update a scorecard rule.
1 property
SecurityMonitoringRuleHardcodedEvaluatorType
string
Hardcoded evaluator type.
CreateRuleResponseData
object
Create rule response data.
4 properties
SecurityMonitoringSignalRuleCreatePayload
object
Create a new signal correlation rule.
10 properties
6 required
SensitiveDataScannerStandardPatternData
object
A standard pattern.
1 property
SecurityMonitoringStandardDataSource
string
Source of events, either logs, audit trail, or Datadog events.
RelationshipToUserData
object
Relationship to user object.
2 properties
2 required
TeamRoutingRules
object
Represents a complete set of team routing rules, including data and optionally included related resources.
2 properties
CloudWorkloadSecurityAgentRuleData
object
Object for a single Agent rule
3 properties
SecurityMonitoringRuleTypeCreate
string
The rule type.
CloudWorkloadSecurityAgentRuleAction
object
The action the rule can perform if triggered
4 properties
TimeRestriction
object
Defines a single time restriction rule with start and end times and the applicable weekdays.
4 properties
SecurityMonitoringRuleCaseActionOptions
object
Options for the rule action
2 properties
SensitiveDataScannerMetaVersionOnly
object
Meta payload containing information about the API.
1 property
TeamRoutingRulesRequestDataAttributes
object
Represents the attributes of a request to update or create team routing rules.
1 property
ApplicationSecurityWafCustomRuleActionAction
string
Override the default action to take when the WAF custom rule would block.
SecurityMonitoringRuleConvertPayload
Convert a rule from JSON to Terraform.
SecurityMonitoringRuleCreatePayload
Create a new rule.
CloudWorkloadSecurityAgentRuleActions
array
The array of actions the rule can perform if triggered
OutcomesResponseData
array
List of rule outcomes.
OutcomesBatchResponseAttributes
object
The JSON:API attributes for an outcome.
5 properties
SecurityMonitoringUser
object
A user.
2 properties
RuleType
string
The JSON:API type for scorecard rules.
SendSlackMessageActionType
string
Indicates that the action is a send Slack message action.
MonitorNotificationRuleRelationshipsCreatedBy
object
The user who created the monitor notification rule.
1 property
RoutingRuleRelationships
object
Specifies relationships for a routing rule, linking to associated policy resources.
1 property
CloudConfigurationRuleCreatePayload
object
Create a new cloud configuration rule.
9 properties
6 required
Enabled
boolean
Field used to enable or disable the rule.
CloudWorkloadSecurityAgentRuleUpdaterAttributes
object
The attributes of the user who last updated the Agent rule
2 properties
TimeRestrictions
object
Holds time zone information and a list of time restrictions for a routing rule.
2 properties
2 required
ApplicationSecurityWafCustomRuleData
object
Object for a single WAF custom rule.
3 properties
ApplicationSecurityWafCustomRuleCreateRequest
object
Request object that includes the custom rule to create.
1 property
1 required
TriggerSource
string
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "securitysignals", while not…
CloudWorkloadSecurityAgentRuleCreateRequest
object
Request object that includes the Agent rule to create
1 property
1 required
SensitiveDataScannerRuleCreateRequest
object
Create rule request.
2 properties
2 required
JSONAPIErrorItemSource
object
References to the source of the error.
3 properties
Targets
array
List of recipients to notify when a notification rule is triggered. Many different target types are supported, such as email addresses, Slack channels, and Pag…
NotificationRulesType
string
The rule type associated to notification rules.
MonitorNotificationRuleResponse
object
A monitor notification rule.
2 properties
SensitiveDataScannerRuleUpdateResponse
object
Update rule response.
1 property
SecurityMonitoringRuleOptions
object
Options.
10 properties
SecurityMonitoringSignalRuleQuery
object
Query for matching rule on signals.
6 properties
1 required
ApplicationSecurityWafCustomRuleCreateAttributes
object
Create a new WAF custom rule.
8 properties
5 required
SecurityMonitoringRuleTestPayload
Test a rule.
SecurityMonitoringRuleQueryPayload
object
Payload to test a rule query with the expected result.
3 properties
SecurityMonitoringThirdPartyRuleCaseCreate
object
Case when a signal is generated by a third party rule.
4 properties
1 required
RelationshipToRuleData
object
Relationship data for a rule.
1 property
SecurityMonitoringReferenceTable
object
Reference tables used in the queries.
5 properties
CreateRuleRequestData
object
Scorecard create rule request data.
2 properties
TeamRoutingRulesDataRelationshipsRulesDataItemsType
string
Indicates that the resource is of type 'teamroutingrules'.
SecurityMonitoringRuleKeepAlive
integer
Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, t…
MonitorNotificationRuleResourceType
string
Monitor notification rule resource type.
SecurityMonitoringSuppressionCreateRequest
object
Request object that includes the suppression rule that you would like to create.
1 property
1 required
OutcomesResponseIncludedRuleAttributes
object
Details of a rule.
2 properties
SecurityMonitoringSuppressionCreateAttributes
object
Object containing the attributes of the suppression rule to be created.
8 properties
3 required
UpdateRuleResponse
object
The response from a rule update request.
1 property
RuleTypes
array
Security rule types used as filters in security rules.
OrganizationsType
string
Organizations resource type.
NotificationRuleResponse
object
Response object which includes a notification rule.
1 property
CloudWorkloadSecurityAgentRuleCreatorAttributes
object
The attributes of the user who created the Agent rule
2 properties
ApplicationSecurityWafCustomRuleConditionOptions
object
Options for the operator of this condition.
2 properties
SecurityMonitoringRuleSeverity
string
Severity of the Security Signal.
MonitorNotificationRuleData
object
Monitor notification rule data.
4 properties
CreateRuleRequest
object
Scorecard create rule request.
1 property
RoutingRuleAction
Defines an action that is executed when a routing rule matches certain criteria.
MonitorNotificationRuleName
string
The name of the monitor notification rule.
ListRulesResponseData
array
Array of rule details.
SecurityMonitoringSignalRuleResponseQuery
object
Query for matching rule on signals.
9 properties
SensitiveDataScannerGroupData
object
A scanning group data.
1 property
SecurityMonitoringSuppression
object
The suppression rule's properties.
3 properties
SecurityMonitoringListRulesResponse
object
List of rules.
2 properties
SensitiveDataScannerRuleUpdate
object
Data related to the update of a rule.
4 properties
Weekday
string
A day of the week.
PatchNotificationRuleParametersData
object
Data of the notification rule patch request: the rule ID, the rule type, and the rule attributes. All fields are required.
3 properties
3 required
ApplicationSecurityWafCustomRuleMetadata
object
Metadata associated with the WAF Custom Rule.
6 properties
SecurityMonitoringSuppressionType
string
The type of the resource. The value should always be suppressions.
ScorecardType
string
The JSON:API type for scorecard.
TeamRoutingRulesRequestData
object
Holds the data necessary to create or update team routing rules, including attributes, ID, and resource type.
3 properties
1 required
TeamRoutingRulesDataRelationshipsRulesDataItems
object
Defines a relationship item to link a routing rule by its ID and type.
2 properties
2 required
SecurityMonitoringSuppressionAttributes
object
The attributes of the suppression rule.
14 properties
APIErrorResponse
object
API error response.
1 property
1 required
MonitorNotificationRuleCreateRequestData
object
Object to create a monitor notification rule.
2 properties
1 required
UserResponseRelationships
object
Relationships of the user object returned by the API.
4 properties
CloudWorkloadSecurityAgentRuleActionMetadata
object
The metadata action applied on the scope matching the rule
3 properties
SensitiveDataScannerRuleRelationships
object
Relationships of a scanning rule.
2 properties
SensitiveDataScannerRuleResponse
object
Response data related to the creation of a rule.
4 properties
CloudConfigurationRegoRule
object
Rule details.
2 properties
2 required
SecurityMonitoringSignalRulePayload
object
The payload of a signal correlation rule.
10 properties
6 required
TimeAggregation
integer
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation. Results are aggregated over a selected time frame us…
ApplicationSecurityWafCustomRuleTags
object
Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security activity field associated with the traces.
2 properties
2 required
CreateNotificationRuleParametersDataAttributes
object
Attributes of the notification rule create request.
5 properties
3 required
PatchNotificationRuleParametersDataAttributes
object
Attributes of the notification rule patch request. It is required to update the version of the rule when patching it.
6 properties
CloudWorkloadSecurityAgentRuleID
string
The ID of the Agent rule
Date
integer
Date as Unix timestamp in milliseconds.
RoutingRuleRelationshipsPolicyData
object
Represents the policy data reference, containing the policy's ID and resource type.
2 properties
2 required
SecurityMonitoringRuleCaseCreate
object
Case when signal is generated.
5 properties
1 required
MonitorNotificationRuleCreateRequest
object
Request for creating a monitor notification rule.
1 property
1 required
CloudConfigurationRuleComplianceSignalOptions
object
How to generate compliance signals. Useful for cloudconfiguration rules only.
4 properties
MonitorNotificationRuleFilterTags
object
Filter monitors by tags. Monitors must match all tags.
1 property
1 required
MonitorNotificationRuleListResponse
object
Response for retrieving all monitor notification rules.
2 properties
SecurityMonitoringStandardRulePayload
object
The payload of a rule.
13 properties
6 required
ApplicationSecurityWafCustomRuleConditionInput
object
Input from the request on which the condition should apply.
2 properties
1 required
OutcomesResponseLinks
object
Links attributes.
1 property
State
string
The state of the rule evaluation.
SecurityMonitoringSuppressionCreateData
object
Object for a single suppression rule.
2 properties
2 required
ApplicationSecurityWafCustomRuleUpdateRequest
object
Request object that includes the Custom Rule to update.
1 property
1 required
SecurityMonitoringSuppressionsResponse
object
Response object containing the available suppression rules.
1 property
RelationshipToRule
object
Scorecard create rule response relationship.
1 property
SecurityMonitoringRuleImpossibleTravelOptions
object
Options on impossible travel detection method.
1 property
RelationshipToRoleData
object
Relationship to role object.
2 properties
TeamRoutingRulesDataRelationships
object
Specifies relationships for team routing rules, including rule references.
1 property
UpdateRuleResponseData
object
The data for a rule update response.
4 properties
TeamRoutingRulesRequest
object
Represents a request to create or update team routing rules, including the data payload.
1 property
ApplicationSecurityWafCustomRuleActionParameters
object
The definition of ApplicationSecurityWafCustomRuleActionParameters object.
2 properties
ListRulesResponse
object
Scorecard rules response.
2 properties
RelationshipToOrganizationData
object
Relationship to organization object.
2 properties
2 required
ApplicationSecurityWafCustomRuleAttributes
object
A WAF custom rule.
9 properties
5 required
SecurityMonitoringRuleConvertResponse
object
Result of the convert rule request containing Terraform content.
1 property
ApplicationSecurityWafCustomRuleScope
object
The scope of the WAF custom rule.
2 properties
2 required
Urgency
string
Specifies the level of urgency for a routing rule (low, high, or dynamic).
ApplicationSecurityWafCustomRuleType
string
The type of the resource. The value should always be customrule.
CloudConfigurationComplianceRuleOptions
object
Options for cloudconfiguration rules. Fields resourceType and regoRule are mandatory when managing custom cloudconfiguration rules.
3 properties
MonitorNotificationRuleResponseIncludedItem
An object related to a monitor notification rule.
SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations
boolean
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise a…
SecurityMonitoringRuleQuery
Query for matching rule.
SensitiveDataScannerRuleType
string
Sensitive Data Scanner rule type.
SendTeamsMessageAction
object
Sends a message to a Microsoft Teams channel.
4 properties
4 required
RelationshipToUsers
object
Relationship to users.
1 property
1 required
SecurityMonitoringThirdPartyRuleCase
object
Case when signal is generated by a third party rule.
4 properties
SecurityMonitoringRuleValidatePayload
Validate a rule.
CloudWorkloadSecurityAgentRuleAttributes
object
A Cloud Workload Security Agent rule returned by the API
21 properties
TeamRoutingRulesRequestDataType
string
Team routing rules resource type.
OutcomeType
string
The JSON:API type for an outcome.
RuleUser
object
User creating or modifying a rule.
2 properties
OutcomesResponse
object
Scorecard outcomes - the result of a rule for a service.
3 properties
CloudWorkloadSecurityAgentRuleResponse
object
Response object that includes an Agent rule
1 property
RoutingRuleRelationshipsPolicyDataType
string
Indicates that the resource is of type 'policies'.
CloudWorkloadSecurityAgentRuleCreateData
object
Object for a single Agent rule
2 properties
2 required
OutcomesResponseDataItem
object
A single rule outcome.
4 properties
SecurityMonitoringSignalRuleType
string
The rule type.
MonitorNotificationRuleRecipients
array
A list of recipients to notify. Uses the same format as the monitor message field. Must not start with an '@'.
CloudWorkloadSecurityAgentRuleUpdateRequest
object
Request object that includes the Agent rule with the attributes to update
1 property
1 required
RuleId
string
The unique ID for a scorecard rule.
RelationshipToRoles
object
Relationship to roles.
1 property
SecurityMonitoringSuppressionUpdateAttributes
object
The suppression rule properties to be updated.
9 properties
TeamRoutingRulesIncluded
Represents additional included resources for team routing rules, such as associated routing rules.
RelationshipToOrganizations
object
Relationship to organizations.
1 property
1 required
MonitorNotificationRuleUpdateRequest
object
Request for updating a monitor notification rule.
1 property
1 required
ID
string
The ID of a notification rule.
SensitiveDataScannerStandardPatternType
string
Sensitive Data Scanner standard pattern type.
SecurityMonitoringThirdPartyRootQuery
object
A query to be combined with the third party case query.
2 properties
SensitiveDataScannerGroupType
string
Sensitive Data Scanner group type.
SecurityMonitoringRuleNewValueOptionsLearningMethod
string
The learning method used to determine when signals should be generated for values that weren't learned.
MonitorNotificationRuleAttributes
object
Attributes of the monitor notification rule.
3 properties
2 required
Pagination
object
Pagination object.
2 properties
SecurityMonitoringRuleCaseAction
object
Action to perform when a signal is triggered. Only available for Application Security rule type.
2 properties
SensitiveDataScannerCreateRuleResponse
object
Create rule response.
2 properties
RoutingRuleRelationshipsPolicy
object
Defines the relationship that links a routing rule to a policy.
1 property
SecurityMonitoringRuleNewValueOptionsLearningDuration
integer
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be…
RuleAttributes
object
Details of a rule.
9 properties
SecurityMonitoringRuleUpdatePayload
object
Update an existing rule.
14 properties
TeamRoutingRulesRequestRule
object
Defines an individual routing rule item that contains the rule data for the request.
5 properties
ListRulesResponseDataItem
object
Rule details.
4 properties
RelationshipToOutcomeData
object
The JSON:API relationship to an outcome, which returns the related rule id.
2 properties
SecurityMonitoringRuleCase
object
Case when signal is generated.
5 properties
Selectors
object
Selectors are used to filter security issues for which notifications should be generated. Users can specify rule severities, rule types, a query to filter secu…
4 properties
1 required
CloudWorkloadSecurityAgentRuleType
string
The type of the resource, must always be agentrule
MonitorNotificationRuleFilter
Filter used to associate the notification rule with monitors.
SecurityMonitoringRuleNewValueOptions
object
Options on new value detection method.
4 properties
SecurityMonitoringStandardRuleCreatePayload
object
Create a new rule.
13 properties
6 required
RoutingRuleType
string
Team routing rules resource type.
SecurityMonitoringFilter
object
The rule's suppression filter.
2 properties
CloudConfigurationRuleCaseCreate
object
Description of signals.
2 properties
1 required
SecurityMonitoringStandardRuleTestPayload
object
The payload of a rule to test
13 properties
6 required
SensitiveDataScannerGroup
object
A scanning group.
2 properties
CreateNotificationRuleParameters
object
Body of the notification rule create request.
1 property
ResponseMetaAttributes
object
Object describing meta attributes of response.
1 property
TeamRoutingRulesDataRelationshipsRules
object
Holds references to a set of routing rules in a relationship.
1 property
CloudConfigurationRulePayload
object
The payload of a cloud configuration rule.
9 properties
6 required
CloudWorkloadSecurityAgentRulesListResponse
object
Response object that includes a list of Agent rule
1 property
CloudWorkloadSecurityAgentRuleCreateAttributes
object
Create a new Cloud Workload Security Agent rule.
11 properties
2 required
CloudConfigurationRuleOptions
object
Options on cloud configuration rules.
1 property
1 required
MonitorNotificationRuleRelationshipsCreatedByData
object
Data for the user who created the monitor notification rule.
2 properties
SecurityMonitoringSuppressionUpdateRequest
object
Request object containing the fields to update on the suppression rule.
1 property
1 required
RolesType
string
Roles type.
SecurityMonitoringStandardRuleResponse
object
Rule.
24 properties
OutcomesResponseIncludedItem
object
Attributes of the included rule.
3 properties
SecurityMonitoringRuleDetectionMethod
string
The detection method.
SecurityMonitoringSuppressionUpdateData
object
The new suppression properties; partial updates are supported.
2 properties
2 required
NotificationRuleQuery
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
SecurityMonitoringRuleTestRequest
object
Test the rule queries of a rule (rule property is ignored when applied to an existing rule)
2 properties
CloudWorkloadSecurityAgentRuleActionSet
object
The set action applied on the scope matching the rule
7 properties
ApplicationSecurityWafCustomRuleCreateData
object
Object for a single WAF custom rule.
2 properties
2 required
SendSlackMessageAction
object
Sends a message to a Slack channel.
3 properties
3 required
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Datadog 12
Other APIs Datadog publishes across the network.
Datadog Dashboards API
Datadog Synthetics API
Datadog Service Level Objectives API
Datadog Security Monitoring API
Datadog Service Definition API
Datadog Software Catalog API
Datadog Users API
Datadog Roles API
Datadog Key Management API
Datadog Organizations API
Datadog Downtimes API
Datadog RUM API
#Rules
Where this information came from
This is an independent, third-party profile of Datadog Rules API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.