data [required]
\n[object]
List of AWS Account Integration Configs.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
secret_access_key
\nstring
AWS Secret Access Key.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\n[object]
List of AWS Account Integration Configs.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\nobject
AWS Account response data.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
secret_access_key
\nstring
AWS Secret Access Key.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\nobject
AWS Account response data.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\nobject
AWS Account response data.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
secret_access_key
\nstring
AWS Secret Access Key.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\nobject
AWS Account response data.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\nobject
AWS Account response data.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
secret_access_key
\nstring
AWS Secret Access Key.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\nobject
AWS Account response data.
attributes
\nobject
AWS Account response attributes.
account_tags
\n[string]
Tags to apply to all hosts and metrics reporting for this account. Defaults to [].
auth_config
\n<oneOf>
AWS Authentication config.
Object 1
\nobject
AWS Authentication config to integrate your account using an access key pair.
access_key_id [required]
\nstring
AWS Access Key ID.
Object 2
\nobject
AWS Authentication config to integrate your account using an IAM role.
external_id
\nstring
AWS IAM External ID for associated role.
role_name [required]
\nstring
AWS IAM Role name.
aws_account_id [required]
\nstring
AWS Account ID.
aws_partition
\nenum
AWS partition your AWS account is scoped to. Defaults to aws.\nSee Partitions\nin the AWS documentation for more information. \nAllowed enum values: aws,aws-cn,aws-us-gov
aws_regions
\n<oneOf>
AWS Regions to collect data from. Defaults to include_all.
Object 1
\nobject
Include all regions. Defaults to true.
include_all [required]
\nboolean
Include all regions.
Object 2
\nobject
Include only these regions.
include_only [required]
\n[string]
Include only these regions.
created_at
\ndate-time
Timestamp of when the account integration was created.
logs_config
\nobject
AWS Logs Collection config.
lambda_forwarder
\nobject
Log Autosubscription configuration for Datadog Forwarder Lambda functions.\nAutomatically set up triggers for existing and new logs for some services,\nensuring no logs from new resources are missed and saving time spent on manual configuration.
lambdas
\n[string]
List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to [].
log_source_config
\nobject
Log source configuration.
tag_filters
\n[object]
List of AWS log source tag filters. Defaults to [].
source
\nstring
The AWS log source to which the tag filters defined in tags are applied.
tags
\n[string]
The AWS resource tags to filter on for the log source specified by source.
sources
\n[string]
List of service IDs set to enable automatic log collection.\nDiscover the list of available services with the\nGet list of AWS log ready\nservices\nendpoint.
metrics_config
\nobject
AWS Metrics Collection config.
automute_enabled
\nboolean
Enable EC2 automute for AWS metrics. Defaults to true.
collect_cloudwatch_alarms
\nboolean
Enable CloudWatch alarms collection. Defaults to false.
collect_custom_metrics
\nboolean
Enable custom metrics collection. Defaults to false.
enabled
\nboolean
Enable AWS metrics collection. Defaults to true.
metric_name_filters
\n[ <oneOf>]
AWS CloudWatch metric name filters. Each filter applies to a single namespace.\nExactly one of include_only or exclude_only must be set on each filter.
Object 1
\nobject
Include only metric names matching one of these patterns for a single namespace.
include_only [required]
\n[string]
Include only metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
Object 2
\nobject
Exclude metric names matching one of these patterns for a single namespace.
exclude_only [required]
\n[string]
Exclude metric names matching one of these patterns.
namespace [required]
\nstring
The AWS CloudWatch namespace to which this metric name filter applies.
namespace_filters
\n<oneOf>
AWS Metrics namespace filters. Defaults to exclude_only.
Object 1
\nobject
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
exclude_only [required]
\n[string]
Exclude only these namespaces from metrics collection.\nDefaults to ["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"].\nAWS/SQS, AWS/ElasticMapReduce, and AWS/Usage are excluded by default\nto reduce your AWS CloudWatch costs from GetMetricData API calls.
Object 2
\nobject
Include only these namespaces.
include_only [required]
\n[string]
Include only these namespaces.
tag_filters
\n[object]
AWS Metrics collection tag filters list. Defaults to [].
namespace
\nstring
The AWS service for which the tag filters defined in tags will be applied.
tags
\n[string]
The AWS resource tags to filter on for the service specified by namespace.
modified_at
\ndate-time
Timestamp of when the account integration was updated.
resources_config
\nobject
AWS Resources Collection config.
cloud_security_posture_management_collection
\nboolean
Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations,\nidentity risks, and compliance violations. Defaults to false.\nRequires extended_collection to be set to true.
extended_collection
\nboolean
Whether Datadog collects additional attributes and configuration information about the resources\nin your AWS account. Defaults to true. Required for cloud_security_posture_management_collection.
traces_config
\nobject
AWS Traces Collection config.
xray_services
\n<oneOf>
AWS X-Ray services to collect traces from. Defaults to include_only.
Object 1
\nobject
Include all services.
include_all [required]
\nboolean
Include all services.
Object 2
\nobject
Include only these services. Defaults to [].
include_only [required]
\n[string]
Include only these services.
id [required]
\nstring
Unique Datadog ID of the AWS Account Integration Config.\nTo get the config ID for an account, use the\nList all AWS integrations\nendpoint and query by AWS Account ID.
type [required]
\nenum
AWS Account resource type. \nAllowed enum values: account
default: account
data [required]
\n[object]
The list of unit costs.
attributes [required]
\nobject
The attributes of a unit cost.
created_at [required]
\ndate-time
The time the unit cost was created.
created_by [required]
\nuuid
The UUID of the user who created the unit cost.
denominator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
denominator_type [required]
\nstring
The data source of the denominator queries, or multisource when the denominator\nqueries span more than one data source.
description
\nstring
The description of the unit cost. Omitted when the unit cost has no description.
name [required]
\nstring
The name of the unit cost.
numerator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
org_id [required]
\nint64
The ID of the organization the unit cost belongs to.
unit_label [required]
\nstring
The label describing the denominator unit.
updated_at [required]
\ndate-time
The time the unit cost was last updated.
updated_by [required]
\nuuid
The UUID of the user who last updated the unit cost.
id [required]
\nuuid
The UUID of the unit cost.
type [required]
\nenum
The JSON:API resource type for a unit cost. \nAllowed enum values: unit_cost
default: unit_cost
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
The data object of a unit cost response.
attributes [required]
\nobject
The attributes of a unit cost.
created_at [required]
\ndate-time
The time the unit cost was created.
created_by [required]
\nuuid
The UUID of the user who created the unit cost.
denominator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
denominator_type [required]
\nstring
The data source of the denominator queries, or multisource when the denominator\nqueries span more than one data source.
description
\nstring
The description of the unit cost. Omitted when the unit cost has no description.
name [required]
\nstring
The name of the unit cost.
numerator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
org_id [required]
\nint64
The ID of the organization the unit cost belongs to.
unit_label [required]
\nstring
The label describing the denominator unit.
updated_at [required]
\ndate-time
The time the unit cost was last updated.
updated_by [required]
\nuuid
The UUID of the user who last updated the unit cost.
id [required]
\nuuid
The UUID of the unit cost.
type [required]
\nenum
The JSON:API resource type for a unit cost. \nAllowed enum values: unit_cost
default: unit_cost
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
The data object of a unit cost create request.
attributes [required]
\nobject
The attributes of a unit cost create or replace request.
denominator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
description
\nstring
An optional description of the unit cost. At most 2000 characters.
name [required]
\nstring
The name of the unit cost. At most 200 characters.
numerator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
unit_label [required]
\nstring
The label describing the denominator unit, for example user. At most 100 characters.
type [required]
\nenum
The JSON:API resource type for a unit cost. \nAllowed enum values: unit_cost
default: unit_cost
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
The data object of a unit cost response.
attributes [required]
\nobject
The attributes of a unit cost.
created_at [required]
\ndate-time
The time the unit cost was created.
created_by [required]
\nuuid
The UUID of the user who created the unit cost.
denominator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
denominator_type [required]
\nstring
The data source of the denominator queries, or multisource when the denominator\nqueries span more than one data source.
description
\nstring
The description of the unit cost. Omitted when the unit cost has no description.
name [required]
\nstring
The name of the unit cost.
numerator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
org_id [required]
\nint64
The ID of the organization the unit cost belongs to.
unit_label [required]
\nstring
The label describing the denominator unit.
updated_at [required]
\ndate-time
The time the unit cost was last updated.
updated_by [required]
\nuuid
The UUID of the user who last updated the unit cost.
id [required]
\nuuid
The UUID of the unit cost.
type [required]
\nenum
The JSON:API resource type for a unit cost. \nAllowed enum values: unit_cost
default: unit_cost
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
The data object of a unit cost response.
attributes [required]
\nobject
The attributes of a unit cost.
created_at [required]
\ndate-time
The time the unit cost was created.
created_by [required]
\nuuid
The UUID of the user who created the unit cost.
denominator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
denominator_type [required]
\nstring
The data source of the denominator queries, or multisource when the denominator\nqueries span more than one data source.
description
\nstring
The description of the unit cost. Omitted when the unit cost has no description.
name [required]
\nstring
The name of the unit cost.
numerator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
org_id [required]
\nint64
The ID of the organization the unit cost belongs to.
unit_label [required]
\nstring
The label describing the denominator unit.
updated_at [required]
\ndate-time
The time the unit cost was last updated.
updated_by [required]
\nuuid
The UUID of the user who last updated the unit cost.
id [required]
\nuuid
The UUID of the unit cost.
type [required]
\nenum
The JSON:API resource type for a unit cost. \nAllowed enum values: unit_cost
default: unit_cost
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
The data object of a unit cost replace request.
attributes [required]
\nobject
The attributes of a unit cost create or replace request.
denominator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
description
\nstring
An optional description of the unit cost. At most 2000 characters.
name [required]
\nstring
The name of the unit cost. At most 200 characters.
numerator_query [required]
\nobject
A timeseries object containing queries and formulas arrays.
formulas [required]
\n[object]
The list of formulas applied to the queries for this side of the ratio.
queries [required]
\n[object]
The list of queries evaluated for this side of the ratio.
unit_label [required]
\nstring
The label describing the denominator unit, for example user. At most 100 characters.
id [required]
\nuuid
The UUID of the unit cost being replaced. Must match the unit_cost_id path parameter.
type [required]
\nenum
The JSON:API resource type for a unit cost. \nAllowed enum values: unit_cost
default: unit_cost
data
\n[object]
A list of custom destinations.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
stream_name [required]
\nstring
Azure stream name.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\n[object]
A list of custom destinations.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\nobject
The definition of a custom destination.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
stream_name [required]
\nstring
Azure stream name.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\nobject
The definition of a custom destination.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\nobject
The definition of a custom destination.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
stream_name [required]
\nstring
Azure stream name.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\nobject
The definition of a custom destination.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\nobject
The definition of a custom destination.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
stream_name [required]
\nstring
Azure stream name.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\nobject
The definition of a custom destination.
attributes
\nobject
The attributes associated with the custom destination.
enabled
\nboolean
Whether logs matching this custom destination should be forwarded or not.
default: true
forward_tags
\nboolean
Whether tags from the forwarded logs should be forwarded or not.
default: true
forward_tags_restriction_list
\n[string]
List of keys of tags to be filtered.
An empty list represents no restriction is in place and either all or no tags will be\nforwarded depending on forward_tags_restriction_list_type parameter.
default:
forward_tags_restriction_list_type
\nenum
How forward_tags_restriction_list parameter should be interpreted.\nIf ALLOW_LIST, then only tags whose keys on the forwarded logs match the ones on the restriction list\nare forwarded.
BLOCK_LIST works the opposite way. It does not forward the tags matching the ones on the list. \nAllowed enum values: ALLOW_LIST,BLOCK_LIST
default: ALLOW_LIST
forwarder_destination
\n<oneOf>
A custom destination's location to forward logs.
<type=http>
\nobject
The HTTP destination.
auth [required]
\n<oneOf>
Authentication method of the HTTP requests.
<type=basic>
\nobject
Basic access authentication.
type [required]
\nenum
Type of the basic access authentication. \nAllowed enum values: basic
default: basic
<type=custom_header>
\nobject
Custom header access authentication.
header_name [required]
\nstring
The header name of the authentication.
type [required]
\nenum
Type of the custom header access authentication. \nAllowed enum values: custom_header
default: custom_header
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
type [required]
\nenum
Type of the HTTP destination. \nAllowed enum values: http
default: http
<type=splunk_hec>
\nobject
The Splunk HTTP Event Collector (HEC) destination.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
sourcetype
\nstring
The Splunk sourcetype for the events sent to this Splunk destination.
If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype _json is used.\nOn update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.\nIf set to null, the sourcetype field is omitted from the forwarded event entirely.\nOtherwise, the provided string value is used as the sourcetype.
type [required]
\nenum
Type of the Splunk HTTP Event Collector (HEC) destination. \nAllowed enum values: splunk_hec
default: splunk_hec
<type=elasticsearch>
\nobject
The Elasticsearch destination.
auth [required]
\nobject
Basic access authentication.
<any-key>
\nBasic access authentication.
endpoint [required]
\nstring
The destination for which logs will be forwarded to.\nMust have HTTPS scheme and forwarding back to Datadog is not allowed.
index_name [required]
\nstring
Name of the Elasticsearch index (must follow Elasticsearch's criteria).
index_rotation
\nstring
Date pattern with US locale and UTC timezone to be appended to the index name after adding -\n(that is, ${index_name}-${indexPattern}).\nYou can customize the index rotation naming pattern by choosing one of these options:
yyyy-MM-dd-HH (as an example, it would render: 2022-10-19-09)yyyy-MM-dd (as an example, it would render: 2022-10-19)yyyy-'W'ww (as an example, it would render: 2022-W42)yyyy-MM (as an example, it would render: 2022-10)If this field is missing or is blank, it means that the index name will always be the same\n(that is, no rotation).
type [required]
\nenum
Type of the Elasticsearch destination. \nAllowed enum values: elasticsearch
default: elasticsearch
<type=microsoft_sentinel>
\nobject
The Microsoft Sentinel destination.
client_id [required]
\nstring
Client ID from the Datadog Azure integration.
data_collection_endpoint [required]
\nstring
Azure data collection endpoint.
data_collection_rule_id [required]
\nstring
Azure data collection rule ID.
tenant_id [required]
\nstring
Tenant ID from the Datadog Azure integration.
type [required]
\nenum
Type of the Microsoft Sentinel destination. \nAllowed enum values: microsoft_sentinel
default: microsoft_sentinel
name
\nstring
The custom destination name.
query
\nstring
The custom destination query filter. Logs matching this query are forwarded to the destination.
id
\nstring
The custom destination ID.
type
\nenum
The type of the resource. The value should always be custom_destination. \nAllowed enum values: custom_destination
default: custom_destination
data
\n[object]
List of Okta accounts.
attributes [required]
\nobject
Attributes object for an Okta account.
api_key
\nstring
The API key of the Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
client_secret
\nstring
The client secret of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id [required]
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\n[object]
List of Okta accounts.
attributes [required]
\nobject
Attributes object for an Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id [required]
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\nobject
Schema for an Okta account.
attributes [required]
\nobject
Attributes object for an Okta account.
api_key
\nstring
The API key of the Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
client_secret
\nstring
The client secret of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\nobject
Schema for an Okta account.
attributes [required]
\nobject
Attributes object for an Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\nobject
Schema for an Okta account.
attributes [required]
\nobject
Attributes object for an Okta account.
api_key
\nstring
The API key of the Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
client_secret
\nstring
The client secret of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\nobject
Schema for an Okta account.
attributes [required]
\nobject
Attributes object for an Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\nobject
Schema for an Okta account.
attributes [required]
\nobject
Attributes object for an Okta account.
api_key
\nstring
The API key of the Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
client_secret
\nstring
The client secret of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data
\nobject
Schema for an Okta account.
attributes [required]
\nobject
Attributes object for an Okta account.
auth_method [required]
\nstring
The authorization method for an Okta account.
client_id
\nstring
The Client ID of an Okta app integration.
domain [required]
\nstring
The domain of the Okta account.
name [required]
\nstring
The name of the Okta account.
id
\nstring
The ID of the Okta account, a UUID hash of the account name.
type [required]
\nenum
Account type for an Okta account. \nAllowed enum values: okta-accounts
default: okta-accounts
data [required]
\nobject
Data related to the workflow.
attributes [required]
\nobject
The definition of WorkflowDataAttributes object.
createdAt
\ndate-time
When the workflow was created.
description
\nstring
Description of the workflow.
name [required]
\nstring
Name of the workflow.
published
\nboolean
Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
runAs
\n<oneOf>
Identity used to run the workflow.
<type=owner>
\nobject
Run the workflow as its owner.
type [required]
\nenum
The owner run-as type. \nAllowed enum values: owner
<type=service_account>
\nobject
Run the workflow as a service account.
id [required]
\nstring
The service account identifier.
type [required]
\nenum
The service account run-as type. \nAllowed enum values: service_account
<type=initiator>
\nobject
Run the workflow as the user who initiates the execution.
type [required]
\nenum
The initiator run-as type. \nAllowed enum values: initiator
runAsUserMode
\nenum
The effective type of identity used to run the workflow. \nAllowed enum values: owner,service_account,initiator
spec [required]
\nobject
A complete Workflow Automation definition, including its triggers, steps, and connections.
annotations
\n[object]
Up to 100 text annotations displayed on the workflow canvas.
display [required]
\nobject
The annotation's position and size on the workflow canvas.
bounds
\nobject
Canvas coordinates and dimensions for an annotation on the workflow canvas.
height
\ndouble
The annotation's height on the canvas.
width
\ndouble
The annotation's width on the canvas.
x
\ndouble
The annotation's horizontal canvas coordinate.
y
\ndouble
The annotation's vertical canvas coordinate.
id [required]
\nstring
The unique identifier of this annotation within the workflow.
markdownTextAnnotation [required]
\nobject
Markdown content displayed in an annotation.
text
\nstring
The annotation's Markdown content.
connectionEnvs
\n[object]
A list of connections or connection groups used in the workflow.
connectionGroups
\n[object]
The ConnectionEnv connectionGroups.
connectionGroupId [required]
\nstring
The ConnectionGroup connectionGroupId.
label [required]
\nstring
The ConnectionGroup label.
tags [required]
\n[string]
The ConnectionGroup tags.
connections
\n[object]
The ConnectionEnv connections.
connectionId [required]
\nstring
The Connection connectionId.
label [required]
\nstring
The Connection label.
env [required]
\nenum
The definition of ConnectionEnvEnv object. \nAllowed enum values: default
handle
\nstring
Unique identifier used to trigger workflows automatically in Datadog.
inputSchema
\nobject
A list of input parameters for the workflow. Input parameters are available under the Trigger object and can be referenced in workflow steps using {{ Trigger.<parameter_name> }}.
parameters
\n[object]
The InputSchema parameters.
allowExtraValues
\nboolean
The InputSchemaParameters allowExtraValues.
allowedValues
\nThe InputSchemaParameters allowedValues.
defaultValue
\nThe InputSchemaParameters defaultValue.
description
\nstring
The InputSchemaParameters description.
label
\nstring
The InputSchemaParameters label.
name [required]
\nstring
The InputSchemaParameters name.
type [required]
\nenum
The definition of InputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
outputSchema
\nobject
A list of output parameters for the workflow.
parameters
\n[object]
The OutputSchema parameters.
defaultValue
\nThe OutputSchemaParameters defaultValue.
description
\nstring
The OutputSchemaParameters description.
label
\nstring
The OutputSchemaParameters label.
name [required]
\nstring
The OutputSchemaParameters name.
type [required]
\nenum
The definition of OutputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
value
\nThe OutputSchemaParameters value.
steps
\n[object]
A Step is a sub-component of a workflow. Each Step performs an action.
actionId [required]
\nstring
The unique identifier of an action.
completionGate
\nobject
Used to create conditions before running subsequent actions.
completionCondition [required]
\nobject
The definition of CompletionCondition object.
operand1 [required]
\nThe CompletionCondition operand1.
operand2
\nThe CompletionCondition operand2.
operator [required]
\nenum
The definition of CompletionConditionOperator object. \nAllowed enum values: OPERATOR_EQUAL,OPERATOR_NOT_EQUAL,OPERATOR_GREATER_THAN,OPERATOR_LESS_THAN,OPERATOR_GREATER_THAN_OR_EQUAL_TO,OPERATOR_LESS_THAN_OR_EQUAL_TO,OPERATOR_CONTAINS,OPERATOR_DOES_NOT_CONTAIN,OPERATOR_IS_NULL,OPERATOR_IS_NOT_NULLShow 2 more
,OPERATOR_IS_EMPTY,OPERATOR_IS_NOT_EMPTY
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
connectionLabel
\nstring
The unique identifier of a connection defined in the spec.
display
\nobject
The position of a step on the workflow canvas. Omit display from every step to use\nautomatic layout, or provide it for every step to preserve a manual layout.
bounds
\nobject
The definition of StepDisplayBounds object.
x
\ndouble
The bounds x.
y
\ndouble
The bounds y.
errorHandlers
\n[object]
The Step errorHandlers.
fallbackStepName [required]
\nstring
The ErrorHandler fallbackStepName.
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
name [required]
\nstring
Name of the step.
outboundEdges
\n[object]
A list of subsequent actions to run. This list is empty for a terminal step.
branchName [required]
\nstring
The OutboundEdge branchName.
nextStepName [required]
\nstring
The OutboundEdge nextStepName.
parameters
\n[object]
A list of inputs for an action.
name [required]
\nstring
The Parameter name.
value [required]
\nThe Parameter value.
readinessGate
\nobject
Used to merge multiple branches into a single branch.
thresholdType [required]
\nenum
The definition of ReadinessGateThresholdType object. \nAllowed enum values: ANY,ALL
triggers
\n[ <oneOf>]
The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
Object 1
\nobject
Schema for an agent-based trigger.
agentTrigger [required]
\nobject
Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 2
\nobject
Schema for an API-based trigger.
apiTrigger [required]
\nobject
Trigger a workflow from an API request. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 3
\nobject
Schema for an App-based trigger.
appTrigger [required]
\nobject
Trigger a workflow from an App.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 4
\nobject
Schema for a Case-based trigger.
caseTrigger [required]
\nobject
Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 5
\nobject
Schema for a Change Event-based trigger.
changeEventTrigger [required]
\nobject
Trigger a workflow from a Change Event.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 6
\nobject
Schema for a Database Monitoring-based trigger.
databaseMonitoringTrigger [required]
\nobject
Trigger a workflow from Database Monitoring.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 7
\nobject
Schema for a Datastore-based trigger.
datastoreTrigger [required]
\nobject
Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 8
\nobject
Schema for a Dashboard-based trigger.
dashboardTrigger [required]
\nobject
Trigger a workflow from a Dashboard.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 9
\nobject
Schema for a Form-based trigger.
formTrigger [required]
\nobject
Trigger a workflow from a Form.
formId
\nstring
The form UUID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 10
\nobject
Schema for a GitHub webhook-based trigger.
githubWebhookTrigger [required]
\nobject
Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a webhookSecret. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 11
\nobject
Schema for an incident declared trigger.
incidentCreatedTrigger [required]
\nobject
Trigger a workflow when an incident is declared.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 12
\nobject
Schema for an incident impact created trigger.
incidentImpactCreatedTrigger [required]
\nobject
Trigger a workflow when an impact is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 13
\nobject
Schema for an incident impact updated trigger.
incidentImpactUpdatedTrigger [required]
\nobject
Trigger a workflow when an impact is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 14
\nobject
Schema for an incident postmortem updated trigger.
incidentPostmortemUpdatedTrigger [required]
\nobject
Trigger a workflow when a postmortem is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 15
\nobject
Schema for an incident responder created trigger.
incidentResponderCreatedTrigger [required]
\nobject
Trigger a workflow when a responder is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 16
\nobject
Schema for an incident declared or updated trigger.
incidentSavedTrigger [required]
\nobject
Trigger a workflow when an incident is declared or updated.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
serialExecution
\nobject
Whether to execute the workflow serially for an incident.
enabled [required]
\nboolean
Whether serial execution is enabled.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 17
\nobject
Schema for an incident schedule trigger.
incidentScheduleTrigger [required]
\nobject
Trigger a workflow on a schedule for an incident.
incidentType
\nstring
The type of incident that triggers the workflow.
rrule [required]
\nstring
The recurrence rule for the schedule, expressed as an iCalendar RRULE string.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 18
\nobject
Schema for an incident-based trigger.
incidentTrigger [required]
\nobject
Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
version
\nstring
Version of the incident manual trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 19
\nobject
Schema for a Monitor-based trigger.
monitorTrigger [required]
\nobject
Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 20
\nobject
Schema for a Notebook-based trigger.
notebookTrigger [required]
\nobject
Trigger a workflow from a Notebook.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 21
\nobject
Schema for an On-Call-based trigger.
onCallTrigger [required]
\nobject
Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 22
\nobject
Schema for a Schedule-based trigger.
scheduleTrigger [required]
\nobject
Trigger a workflow from a Schedule. The workflow must be published.
overlapBehavior
\nenum
Controls whether a scheduled workflow run may start while another instance is still running. \nAllowed enum values: EXCLUSIVE_RUN,OVERLAP_ALLOWED
default: EXCLUSIVE_RUN
rruleExpression [required]
\nstring
Recurrence rule expression for scheduling.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 23
\nobject
Schema for a Security-based trigger.
securityTrigger [required]
\nobject
Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 24
\nobject
Schema for a Self Service-based trigger.
selfServiceTrigger [required]
\nobject
Trigger a workflow from Self Service.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 25
\nobject
Schema for a Slack-based trigger.
slackTrigger [required]
\nobject
Trigger a workflow from Slack. The workflow must be published.
reactionTriggers
\n[object]
Slack emoji reactions that trigger the workflow.
reactionEmoji [required]
\nstring
The Slack emoji reaction name.
teamId [required]
\nstring
The Slack workspace ID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 26
\nobject
Schema for a Software Catalog-based trigger.
softwareCatalogTrigger [required]
\nobject
Trigger a workflow from Software Catalog.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 27
\nobject
Schema for a Workflow-based trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
workflowTrigger [required]
\nobject
Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger.
tags
\n[string]
Tags of the workflow.
updatedAt
\ndate-time
When the workflow was last updated.
webhookSecret
\nstring
If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
id
\nstring
The workflow identifier
relationships
\nobject
The definition of WorkflowDataRelationships object.
creator
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
owner
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
runAs
\nobject
The service account used to run the workflow. Present when runAsUserMode is service_account.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
type [required]
\nenum
The definition of WorkflowDataType object. \nAllowed enum values: workflows
data [required]
\nobject
Data related to the workflow.
attributes [required]
\nobject
The definition of WorkflowDataAttributes object.
createdAt
\ndate-time
When the workflow was created.
description
\nstring
Description of the workflow.
name [required]
\nstring
Name of the workflow.
published
\nboolean
Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
runAsUserMode
\nenum
The effective type of identity used to run the workflow. \nAllowed enum values: owner,service_account,initiator
spec [required]
\nobject
A complete Workflow Automation definition, including its triggers, steps, and connections.
annotations
\n[object]
Up to 100 text annotations displayed on the workflow canvas.
display [required]
\nobject
The annotation's position and size on the workflow canvas.
bounds
\nobject
Canvas coordinates and dimensions for an annotation on the workflow canvas.
height
\ndouble
The annotation's height on the canvas.
width
\ndouble
The annotation's width on the canvas.
x
\ndouble
The annotation's horizontal canvas coordinate.
y
\ndouble
The annotation's vertical canvas coordinate.
id [required]
\nstring
The unique identifier of this annotation within the workflow.
markdownTextAnnotation [required]
\nobject
Markdown content displayed in an annotation.
text
\nstring
The annotation's Markdown content.
connectionEnvs
\n[object]
A list of connections or connection groups used in the workflow.
connectionGroups
\n[object]
The ConnectionEnv connectionGroups.
connectionGroupId [required]
\nstring
The ConnectionGroup connectionGroupId.
label [required]
\nstring
The ConnectionGroup label.
tags [required]
\n[string]
The ConnectionGroup tags.
connections
\n[object]
The ConnectionEnv connections.
connectionId [required]
\nstring
The Connection connectionId.
label [required]
\nstring
The Connection label.
env [required]
\nenum
The definition of ConnectionEnvEnv object. \nAllowed enum values: default
handle
\nstring
Unique identifier used to trigger workflows automatically in Datadog.
inputSchema
\nobject
A list of input parameters for the workflow. Input parameters are available under the Trigger object and can be referenced in workflow steps using {{ Trigger.<parameter_name> }}.
parameters
\n[object]
The InputSchema parameters.
allowExtraValues
\nboolean
The InputSchemaParameters allowExtraValues.
allowedValues
\nThe InputSchemaParameters allowedValues.
defaultValue
\nThe InputSchemaParameters defaultValue.
description
\nstring
The InputSchemaParameters description.
label
\nstring
The InputSchemaParameters label.
name [required]
\nstring
The InputSchemaParameters name.
type [required]
\nenum
The definition of InputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
outputSchema
\nobject
A list of output parameters for the workflow.
parameters
\n[object]
The OutputSchema parameters.
defaultValue
\nThe OutputSchemaParameters defaultValue.
description
\nstring
The OutputSchemaParameters description.
label
\nstring
The OutputSchemaParameters label.
name [required]
\nstring
The OutputSchemaParameters name.
type [required]
\nenum
The definition of OutputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
value
\nThe OutputSchemaParameters value.
steps
\n[object]
A Step is a sub-component of a workflow. Each Step performs an action.
actionId [required]
\nstring
The unique identifier of an action.
completionGate
\nobject
Used to create conditions before running subsequent actions.
completionCondition [required]
\nobject
The definition of CompletionCondition object.
operand1 [required]
\nThe CompletionCondition operand1.
operand2
\nThe CompletionCondition operand2.
operator [required]
\nenum
The definition of CompletionConditionOperator object. \nAllowed enum values: OPERATOR_EQUAL,OPERATOR_NOT_EQUAL,OPERATOR_GREATER_THAN,OPERATOR_LESS_THAN,OPERATOR_GREATER_THAN_OR_EQUAL_TO,OPERATOR_LESS_THAN_OR_EQUAL_TO,OPERATOR_CONTAINS,OPERATOR_DOES_NOT_CONTAIN,OPERATOR_IS_NULL,OPERATOR_IS_NOT_NULLShow 2 more
,OPERATOR_IS_EMPTY,OPERATOR_IS_NOT_EMPTY
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
connectionLabel
\nstring
The unique identifier of a connection defined in the spec.
display
\nobject
The position of a step on the workflow canvas. Omit display from every step to use\nautomatic layout, or provide it for every step to preserve a manual layout.
bounds
\nobject
The definition of StepDisplayBounds object.
x
\ndouble
The bounds x.
y
\ndouble
The bounds y.
errorHandlers
\n[object]
The Step errorHandlers.
fallbackStepName [required]
\nstring
The ErrorHandler fallbackStepName.
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
name [required]
\nstring
Name of the step.
outboundEdges
\n[object]
A list of subsequent actions to run. This list is empty for a terminal step.
branchName [required]
\nstring
The OutboundEdge branchName.
nextStepName [required]
\nstring
The OutboundEdge nextStepName.
parameters
\n[object]
A list of inputs for an action.
name [required]
\nstring
The Parameter name.
value [required]
\nThe Parameter value.
readinessGate
\nobject
Used to merge multiple branches into a single branch.
thresholdType [required]
\nenum
The definition of ReadinessGateThresholdType object. \nAllowed enum values: ANY,ALL
triggers
\n[ <oneOf>]
The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
Object 1
\nobject
Schema for an agent-based trigger.
agentTrigger [required]
\nobject
Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 2
\nobject
Schema for an API-based trigger.
apiTrigger [required]
\nobject
Trigger a workflow from an API request. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 3
\nobject
Schema for an App-based trigger.
appTrigger [required]
\nobject
Trigger a workflow from an App.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 4
\nobject
Schema for a Case-based trigger.
caseTrigger [required]
\nobject
Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 5
\nobject
Schema for a Change Event-based trigger.
changeEventTrigger [required]
\nobject
Trigger a workflow from a Change Event.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 6
\nobject
Schema for a Database Monitoring-based trigger.
databaseMonitoringTrigger [required]
\nobject
Trigger a workflow from Database Monitoring.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 7
\nobject
Schema for a Datastore-based trigger.
datastoreTrigger [required]
\nobject
Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 8
\nobject
Schema for a Dashboard-based trigger.
dashboardTrigger [required]
\nobject
Trigger a workflow from a Dashboard.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 9
\nobject
Schema for a Form-based trigger.
formTrigger [required]
\nobject
Trigger a workflow from a Form.
formId
\nstring
The form UUID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 10
\nobject
Schema for a GitHub webhook-based trigger.
githubWebhookTrigger [required]
\nobject
Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a webhookSecret. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 11
\nobject
Schema for an incident declared trigger.
incidentCreatedTrigger [required]
\nobject
Trigger a workflow when an incident is declared.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 12
\nobject
Schema for an incident impact created trigger.
incidentImpactCreatedTrigger [required]
\nobject
Trigger a workflow when an impact is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 13
\nobject
Schema for an incident impact updated trigger.
incidentImpactUpdatedTrigger [required]
\nobject
Trigger a workflow when an impact is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 14
\nobject
Schema for an incident postmortem updated trigger.
incidentPostmortemUpdatedTrigger [required]
\nobject
Trigger a workflow when a postmortem is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 15
\nobject
Schema for an incident responder created trigger.
incidentResponderCreatedTrigger [required]
\nobject
Trigger a workflow when a responder is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 16
\nobject
Schema for an incident declared or updated trigger.
incidentSavedTrigger [required]
\nobject
Trigger a workflow when an incident is declared or updated.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
serialExecution
\nobject
Whether to execute the workflow serially for an incident.
enabled [required]
\nboolean
Whether serial execution is enabled.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 17
\nobject
Schema for an incident schedule trigger.
incidentScheduleTrigger [required]
\nobject
Trigger a workflow on a schedule for an incident.
incidentType
\nstring
The type of incident that triggers the workflow.
rrule [required]
\nstring
The recurrence rule for the schedule, expressed as an iCalendar RRULE string.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 18
\nobject
Schema for an incident-based trigger.
incidentTrigger [required]
\nobject
Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
version
\nstring
Version of the incident manual trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 19
\nobject
Schema for a Monitor-based trigger.
monitorTrigger [required]
\nobject
Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 20
\nobject
Schema for a Notebook-based trigger.
notebookTrigger [required]
\nobject
Trigger a workflow from a Notebook.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 21
\nobject
Schema for an On-Call-based trigger.
onCallTrigger [required]
\nobject
Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 22
\nobject
Schema for a Schedule-based trigger.
scheduleTrigger [required]
\nobject
Trigger a workflow from a Schedule. The workflow must be published.
overlapBehavior
\nenum
Controls whether a scheduled workflow run may start while another instance is still running. \nAllowed enum values: EXCLUSIVE_RUN,OVERLAP_ALLOWED
default: EXCLUSIVE_RUN
rruleExpression [required]
\nstring
Recurrence rule expression for scheduling.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 23
\nobject
Schema for a Security-based trigger.
securityTrigger [required]
\nobject
Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 24
\nobject
Schema for a Self Service-based trigger.
selfServiceTrigger [required]
\nobject
Trigger a workflow from Self Service.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 25
\nobject
Schema for a Slack-based trigger.
slackTrigger [required]
\nobject
Trigger a workflow from Slack. The workflow must be published.
reactionTriggers
\n[object]
Slack emoji reactions that trigger the workflow.
reactionEmoji [required]
\nstring
The Slack emoji reaction name.
teamId [required]
\nstring
The Slack workspace ID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 26
\nobject
Schema for a Software Catalog-based trigger.
softwareCatalogTrigger [required]
\nobject
Trigger a workflow from Software Catalog.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 27
\nobject
Schema for a Workflow-based trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
workflowTrigger [required]
\nobject
Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger.
tags
\n[string]
Tags of the workflow.
updatedAt
\ndate-time
When the workflow was last updated.
id
\nstring
The workflow identifier
relationships
\nobject
The definition of WorkflowDataRelationships object.
creator
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
owner
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
runAs
\nobject
The service account used to run the workflow. Present when runAsUserMode is service_account.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
type [required]
\nenum
The definition of WorkflowDataType object. \nAllowed enum values: workflows
data
\nobject
Data related to the workflow.
attributes [required]
\nobject
The definition of WorkflowDataAttributes object.
createdAt
\ndate-time
When the workflow was created.
description
\nstring
Description of the workflow.
name [required]
\nstring
Name of the workflow.
published
\nboolean
Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
runAs
\n<oneOf>
Identity used to run the workflow.
<type=owner>
\nobject
Run the workflow as its owner.
type [required]
\nenum
The owner run-as type. \nAllowed enum values: owner
<type=service_account>
\nobject
Run the workflow as a service account.
id [required]
\nstring
The service account identifier.
type [required]
\nenum
The service account run-as type. \nAllowed enum values: service_account
<type=initiator>
\nobject
Run the workflow as the user who initiates the execution.
type [required]
\nenum
The initiator run-as type. \nAllowed enum values: initiator
runAsUserMode
\nenum
The effective type of identity used to run the workflow. \nAllowed enum values: owner,service_account,initiator
spec [required]
\nobject
A complete Workflow Automation definition, including its triggers, steps, and connections.
annotations
\n[object]
Up to 100 text annotations displayed on the workflow canvas.
display [required]
\nobject
The annotation's position and size on the workflow canvas.
bounds
\nobject
Canvas coordinates and dimensions for an annotation on the workflow canvas.
height
\ndouble
The annotation's height on the canvas.
width
\ndouble
The annotation's width on the canvas.
x
\ndouble
The annotation's horizontal canvas coordinate.
y
\ndouble
The annotation's vertical canvas coordinate.
id [required]
\nstring
The unique identifier of this annotation within the workflow.
markdownTextAnnotation [required]
\nobject
Markdown content displayed in an annotation.
text
\nstring
The annotation's Markdown content.
connectionEnvs
\n[object]
A list of connections or connection groups used in the workflow.
connectionGroups
\n[object]
The ConnectionEnv connectionGroups.
connectionGroupId [required]
\nstring
The ConnectionGroup connectionGroupId.
label [required]
\nstring
The ConnectionGroup label.
tags [required]
\n[string]
The ConnectionGroup tags.
connections
\n[object]
The ConnectionEnv connections.
connectionId [required]
\nstring
The Connection connectionId.
label [required]
\nstring
The Connection label.
env [required]
\nenum
The definition of ConnectionEnvEnv object. \nAllowed enum values: default
handle
\nstring
Unique identifier used to trigger workflows automatically in Datadog.
inputSchema
\nobject
A list of input parameters for the workflow. Input parameters are available under the Trigger object and can be referenced in workflow steps using {{ Trigger.<parameter_name> }}.
parameters
\n[object]
The InputSchema parameters.
allowExtraValues
\nboolean
The InputSchemaParameters allowExtraValues.
allowedValues
\nThe InputSchemaParameters allowedValues.
defaultValue
\nThe InputSchemaParameters defaultValue.
description
\nstring
The InputSchemaParameters description.
label
\nstring
The InputSchemaParameters label.
name [required]
\nstring
The InputSchemaParameters name.
type [required]
\nenum
The definition of InputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
outputSchema
\nobject
A list of output parameters for the workflow.
parameters
\n[object]
The OutputSchema parameters.
defaultValue
\nThe OutputSchemaParameters defaultValue.
description
\nstring
The OutputSchemaParameters description.
label
\nstring
The OutputSchemaParameters label.
name [required]
\nstring
The OutputSchemaParameters name.
type [required]
\nenum
The definition of OutputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
value
\nThe OutputSchemaParameters value.
steps
\n[object]
A Step is a sub-component of a workflow. Each Step performs an action.
actionId [required]
\nstring
The unique identifier of an action.
completionGate
\nobject
Used to create conditions before running subsequent actions.
completionCondition [required]
\nobject
The definition of CompletionCondition object.
operand1 [required]
\nThe CompletionCondition operand1.
operand2
\nThe CompletionCondition operand2.
operator [required]
\nenum
The definition of CompletionConditionOperator object. \nAllowed enum values: OPERATOR_EQUAL,OPERATOR_NOT_EQUAL,OPERATOR_GREATER_THAN,OPERATOR_LESS_THAN,OPERATOR_GREATER_THAN_OR_EQUAL_TO,OPERATOR_LESS_THAN_OR_EQUAL_TO,OPERATOR_CONTAINS,OPERATOR_DOES_NOT_CONTAIN,OPERATOR_IS_NULL,OPERATOR_IS_NOT_NULLShow 2 more
,OPERATOR_IS_EMPTY,OPERATOR_IS_NOT_EMPTY
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
connectionLabel
\nstring
The unique identifier of a connection defined in the spec.
display
\nobject
The position of a step on the workflow canvas. Omit display from every step to use\nautomatic layout, or provide it for every step to preserve a manual layout.
bounds
\nobject
The definition of StepDisplayBounds object.
x
\ndouble
The bounds x.
y
\ndouble
The bounds y.
errorHandlers
\n[object]
The Step errorHandlers.
fallbackStepName [required]
\nstring
The ErrorHandler fallbackStepName.
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
name [required]
\nstring
Name of the step.
outboundEdges
\n[object]
A list of subsequent actions to run. This list is empty for a terminal step.
branchName [required]
\nstring
The OutboundEdge branchName.
nextStepName [required]
\nstring
The OutboundEdge nextStepName.
parameters
\n[object]
A list of inputs for an action.
name [required]
\nstring
The Parameter name.
value [required]
\nThe Parameter value.
readinessGate
\nobject
Used to merge multiple branches into a single branch.
thresholdType [required]
\nenum
The definition of ReadinessGateThresholdType object. \nAllowed enum values: ANY,ALL
triggers
\n[ <oneOf>]
The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
Object 1
\nobject
Schema for an agent-based trigger.
agentTrigger [required]
\nobject
Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 2
\nobject
Schema for an API-based trigger.
apiTrigger [required]
\nobject
Trigger a workflow from an API request. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 3
\nobject
Schema for an App-based trigger.
appTrigger [required]
\nobject
Trigger a workflow from an App.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 4
\nobject
Schema for a Case-based trigger.
caseTrigger [required]
\nobject
Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 5
\nobject
Schema for a Change Event-based trigger.
changeEventTrigger [required]
\nobject
Trigger a workflow from a Change Event.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 6
\nobject
Schema for a Database Monitoring-based trigger.
databaseMonitoringTrigger [required]
\nobject
Trigger a workflow from Database Monitoring.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 7
\nobject
Schema for a Datastore-based trigger.
datastoreTrigger [required]
\nobject
Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 8
\nobject
Schema for a Dashboard-based trigger.
dashboardTrigger [required]
\nobject
Trigger a workflow from a Dashboard.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 9
\nobject
Schema for a Form-based trigger.
formTrigger [required]
\nobject
Trigger a workflow from a Form.
formId
\nstring
The form UUID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 10
\nobject
Schema for a GitHub webhook-based trigger.
githubWebhookTrigger [required]
\nobject
Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a webhookSecret. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 11
\nobject
Schema for an incident declared trigger.
incidentCreatedTrigger [required]
\nobject
Trigger a workflow when an incident is declared.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 12
\nobject
Schema for an incident impact created trigger.
incidentImpactCreatedTrigger [required]
\nobject
Trigger a workflow when an impact is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 13
\nobject
Schema for an incident impact updated trigger.
incidentImpactUpdatedTrigger [required]
\nobject
Trigger a workflow when an impact is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 14
\nobject
Schema for an incident postmortem updated trigger.
incidentPostmortemUpdatedTrigger [required]
\nobject
Trigger a workflow when a postmortem is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 15
\nobject
Schema for an incident responder created trigger.
incidentResponderCreatedTrigger [required]
\nobject
Trigger a workflow when a responder is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 16
\nobject
Schema for an incident declared or updated trigger.
incidentSavedTrigger [required]
\nobject
Trigger a workflow when an incident is declared or updated.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
serialExecution
\nobject
Whether to execute the workflow serially for an incident.
enabled [required]
\nboolean
Whether serial execution is enabled.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 17
\nobject
Schema for an incident schedule trigger.
incidentScheduleTrigger [required]
\nobject
Trigger a workflow on a schedule for an incident.
incidentType
\nstring
The type of incident that triggers the workflow.
rrule [required]
\nstring
The recurrence rule for the schedule, expressed as an iCalendar RRULE string.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 18
\nobject
Schema for an incident-based trigger.
incidentTrigger [required]
\nobject
Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
version
\nstring
Version of the incident manual trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 19
\nobject
Schema for a Monitor-based trigger.
monitorTrigger [required]
\nobject
Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 20
\nobject
Schema for a Notebook-based trigger.
notebookTrigger [required]
\nobject
Trigger a workflow from a Notebook.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 21
\nobject
Schema for an On-Call-based trigger.
onCallTrigger [required]
\nobject
Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 22
\nobject
Schema for a Schedule-based trigger.
scheduleTrigger [required]
\nobject
Trigger a workflow from a Schedule. The workflow must be published.
overlapBehavior
\nenum
Controls whether a scheduled workflow run may start while another instance is still running. \nAllowed enum values: EXCLUSIVE_RUN,OVERLAP_ALLOWED
default: EXCLUSIVE_RUN
rruleExpression [required]
\nstring
Recurrence rule expression for scheduling.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 23
\nobject
Schema for a Security-based trigger.
securityTrigger [required]
\nobject
Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 24
\nobject
Schema for a Self Service-based trigger.
selfServiceTrigger [required]
\nobject
Trigger a workflow from Self Service.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 25
\nobject
Schema for a Slack-based trigger.
slackTrigger [required]
\nobject
Trigger a workflow from Slack. The workflow must be published.
reactionTriggers
\n[object]
Slack emoji reactions that trigger the workflow.
reactionEmoji [required]
\nstring
The Slack emoji reaction name.
teamId [required]
\nstring
The Slack workspace ID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 26
\nobject
Schema for a Software Catalog-based trigger.
softwareCatalogTrigger [required]
\nobject
Trigger a workflow from Software Catalog.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 27
\nobject
Schema for a Workflow-based trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
workflowTrigger [required]
\nobject
Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger.
tags
\n[string]
Tags of the workflow.
updatedAt
\ndate-time
When the workflow was last updated.
webhookSecret
\nstring
If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
id
\nstring
The workflow identifier
relationships
\nobject
The definition of WorkflowDataRelationships object.
creator
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
owner
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
runAs
\nobject
The service account used to run the workflow. Present when runAsUserMode is service_account.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
type [required]
\nenum
The definition of WorkflowDataType object. \nAllowed enum values: workflows
data
\nobject
Data related to the workflow.
attributes [required]
\nobject
The definition of WorkflowDataAttributes object.
createdAt
\ndate-time
When the workflow was created.
description
\nstring
Description of the workflow.
name [required]
\nstring
Name of the workflow.
published
\nboolean
Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
runAsUserMode
\nenum
The effective type of identity used to run the workflow. \nAllowed enum values: owner,service_account,initiator
spec [required]
\nobject
A complete Workflow Automation definition, including its triggers, steps, and connections.
annotations
\n[object]
Up to 100 text annotations displayed on the workflow canvas.
display [required]
\nobject
The annotation's position and size on the workflow canvas.
bounds
\nobject
Canvas coordinates and dimensions for an annotation on the workflow canvas.
height
\ndouble
The annotation's height on the canvas.
width
\ndouble
The annotation's width on the canvas.
x
\ndouble
The annotation's horizontal canvas coordinate.
y
\ndouble
The annotation's vertical canvas coordinate.
id [required]
\nstring
The unique identifier of this annotation within the workflow.
markdownTextAnnotation [required]
\nobject
Markdown content displayed in an annotation.
text
\nstring
The annotation's Markdown content.
connectionEnvs
\n[object]
A list of connections or connection groups used in the workflow.
connectionGroups
\n[object]
The ConnectionEnv connectionGroups.
connectionGroupId [required]
\nstring
The ConnectionGroup connectionGroupId.
label [required]
\nstring
The ConnectionGroup label.
tags [required]
\n[string]
The ConnectionGroup tags.
connections
\n[object]
The ConnectionEnv connections.
connectionId [required]
\nstring
The Connection connectionId.
label [required]
\nstring
The Connection label.
env [required]
\nenum
The definition of ConnectionEnvEnv object. \nAllowed enum values: default
handle
\nstring
Unique identifier used to trigger workflows automatically in Datadog.
inputSchema
\nobject
A list of input parameters for the workflow. Input parameters are available under the Trigger object and can be referenced in workflow steps using {{ Trigger.<parameter_name> }}.
parameters
\n[object]
The InputSchema parameters.
allowExtraValues
\nboolean
The InputSchemaParameters allowExtraValues.
allowedValues
\nThe InputSchemaParameters allowedValues.
defaultValue
\nThe InputSchemaParameters defaultValue.
description
\nstring
The InputSchemaParameters description.
label
\nstring
The InputSchemaParameters label.
name [required]
\nstring
The InputSchemaParameters name.
type [required]
\nenum
The definition of InputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
outputSchema
\nobject
A list of output parameters for the workflow.
parameters
\n[object]
The OutputSchema parameters.
defaultValue
\nThe OutputSchemaParameters defaultValue.
description
\nstring
The OutputSchemaParameters description.
label
\nstring
The OutputSchemaParameters label.
name [required]
\nstring
The OutputSchemaParameters name.
type [required]
\nenum
The definition of OutputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
value
\nThe OutputSchemaParameters value.
steps
\n[object]
A Step is a sub-component of a workflow. Each Step performs an action.
actionId [required]
\nstring
The unique identifier of an action.
completionGate
\nobject
Used to create conditions before running subsequent actions.
completionCondition [required]
\nobject
The definition of CompletionCondition object.
operand1 [required]
\nThe CompletionCondition operand1.
operand2
\nThe CompletionCondition operand2.
operator [required]
\nenum
The definition of CompletionConditionOperator object. \nAllowed enum values: OPERATOR_EQUAL,OPERATOR_NOT_EQUAL,OPERATOR_GREATER_THAN,OPERATOR_LESS_THAN,OPERATOR_GREATER_THAN_OR_EQUAL_TO,OPERATOR_LESS_THAN_OR_EQUAL_TO,OPERATOR_CONTAINS,OPERATOR_DOES_NOT_CONTAIN,OPERATOR_IS_NULL,OPERATOR_IS_NOT_NULLShow 2 more
,OPERATOR_IS_EMPTY,OPERATOR_IS_NOT_EMPTY
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
connectionLabel
\nstring
The unique identifier of a connection defined in the spec.
display
\nobject
The position of a step on the workflow canvas. Omit display from every step to use\nautomatic layout, or provide it for every step to preserve a manual layout.
bounds
\nobject
The definition of StepDisplayBounds object.
x
\ndouble
The bounds x.
y
\ndouble
The bounds y.
errorHandlers
\n[object]
The Step errorHandlers.
fallbackStepName [required]
\nstring
The ErrorHandler fallbackStepName.
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
name [required]
\nstring
Name of the step.
outboundEdges
\n[object]
A list of subsequent actions to run. This list is empty for a terminal step.
branchName [required]
\nstring
The OutboundEdge branchName.
nextStepName [required]
\nstring
The OutboundEdge nextStepName.
parameters
\n[object]
A list of inputs for an action.
name [required]
\nstring
The Parameter name.
value [required]
\nThe Parameter value.
readinessGate
\nobject
Used to merge multiple branches into a single branch.
thresholdType [required]
\nenum
The definition of ReadinessGateThresholdType object. \nAllowed enum values: ANY,ALL
triggers
\n[ <oneOf>]
The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
Object 1
\nobject
Schema for an agent-based trigger.
agentTrigger [required]
\nobject
Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 2
\nobject
Schema for an API-based trigger.
apiTrigger [required]
\nobject
Trigger a workflow from an API request. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 3
\nobject
Schema for an App-based trigger.
appTrigger [required]
\nobject
Trigger a workflow from an App.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 4
\nobject
Schema for a Case-based trigger.
caseTrigger [required]
\nobject
Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 5
\nobject
Schema for a Change Event-based trigger.
changeEventTrigger [required]
\nobject
Trigger a workflow from a Change Event.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 6
\nobject
Schema for a Database Monitoring-based trigger.
databaseMonitoringTrigger [required]
\nobject
Trigger a workflow from Database Monitoring.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 7
\nobject
Schema for a Datastore-based trigger.
datastoreTrigger [required]
\nobject
Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 8
\nobject
Schema for a Dashboard-based trigger.
dashboardTrigger [required]
\nobject
Trigger a workflow from a Dashboard.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 9
\nobject
Schema for a Form-based trigger.
formTrigger [required]
\nobject
Trigger a workflow from a Form.
formId
\nstring
The form UUID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 10
\nobject
Schema for a GitHub webhook-based trigger.
githubWebhookTrigger [required]
\nobject
Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a webhookSecret. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 11
\nobject
Schema for an incident declared trigger.
incidentCreatedTrigger [required]
\nobject
Trigger a workflow when an incident is declared.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 12
\nobject
Schema for an incident impact created trigger.
incidentImpactCreatedTrigger [required]
\nobject
Trigger a workflow when an impact is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 13
\nobject
Schema for an incident impact updated trigger.
incidentImpactUpdatedTrigger [required]
\nobject
Trigger a workflow when an impact is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 14
\nobject
Schema for an incident postmortem updated trigger.
incidentPostmortemUpdatedTrigger [required]
\nobject
Trigger a workflow when a postmortem is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 15
\nobject
Schema for an incident responder created trigger.
incidentResponderCreatedTrigger [required]
\nobject
Trigger a workflow when a responder is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 16
\nobject
Schema for an incident declared or updated trigger.
incidentSavedTrigger [required]
\nobject
Trigger a workflow when an incident is declared or updated.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
serialExecution
\nobject
Whether to execute the workflow serially for an incident.
enabled [required]
\nboolean
Whether serial execution is enabled.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 17
\nobject
Schema for an incident schedule trigger.
incidentScheduleTrigger [required]
\nobject
Trigger a workflow on a schedule for an incident.
incidentType
\nstring
The type of incident that triggers the workflow.
rrule [required]
\nstring
The recurrence rule for the schedule, expressed as an iCalendar RRULE string.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 18
\nobject
Schema for an incident-based trigger.
incidentTrigger [required]
\nobject
Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
version
\nstring
Version of the incident manual trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 19
\nobject
Schema for a Monitor-based trigger.
monitorTrigger [required]
\nobject
Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 20
\nobject
Schema for a Notebook-based trigger.
notebookTrigger [required]
\nobject
Trigger a workflow from a Notebook.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 21
\nobject
Schema for an On-Call-based trigger.
onCallTrigger [required]
\nobject
Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 22
\nobject
Schema for a Schedule-based trigger.
scheduleTrigger [required]
\nobject
Trigger a workflow from a Schedule. The workflow must be published.
overlapBehavior
\nenum
Controls whether a scheduled workflow run may start while another instance is still running. \nAllowed enum values: EXCLUSIVE_RUN,OVERLAP_ALLOWED
default: EXCLUSIVE_RUN
rruleExpression [required]
\nstring
Recurrence rule expression for scheduling.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 23
\nobject
Schema for a Security-based trigger.
securityTrigger [required]
\nobject
Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 24
\nobject
Schema for a Self Service-based trigger.
selfServiceTrigger [required]
\nobject
Trigger a workflow from Self Service.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 25
\nobject
Schema for a Slack-based trigger.
slackTrigger [required]
\nobject
Trigger a workflow from Slack. The workflow must be published.
reactionTriggers
\n[object]
Slack emoji reactions that trigger the workflow.
reactionEmoji [required]
\nstring
The Slack emoji reaction name.
teamId [required]
\nstring
The Slack workspace ID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 26
\nobject
Schema for a Software Catalog-based trigger.
softwareCatalogTrigger [required]
\nobject
Trigger a workflow from Software Catalog.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 27
\nobject
Schema for a Workflow-based trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
workflowTrigger [required]
\nobject
Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger.
tags
\n[string]
Tags of the workflow.
updatedAt
\ndate-time
When the workflow was last updated.
id
\nstring
The workflow identifier
relationships
\nobject
The definition of WorkflowDataRelationships object.
creator
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
owner
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
runAs
\nobject
The service account used to run the workflow. Present when runAsUserMode is service_account.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
type [required]
\nenum
The definition of WorkflowDataType object. \nAllowed enum values: workflows
data
\nobject
Data related to the workflow being updated.
attributes [required]
\nobject
The definition of WorkflowDataUpdateAttributes object.
createdAt
\ndate-time
When the workflow was created.
description
\nstring
Description of the workflow.
name
\nstring
Name of the workflow.
published
\nboolean
Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
runAs
\n<oneOf>
Identity used to run the workflow.
<type=owner>
\nobject
Run the workflow as its owner.
type [required]
\nenum
The owner run-as type. \nAllowed enum values: owner
<type=service_account>
\nobject
Run the workflow as a service account.
id [required]
\nstring
The service account identifier.
type [required]
\nenum
The service account run-as type. \nAllowed enum values: service_account
<type=initiator>
\nobject
Run the workflow as the user who initiates the execution.
type [required]
\nenum
The initiator run-as type. \nAllowed enum values: initiator
runAsUserMode
\nenum
The effective type of identity used to run the workflow. \nAllowed enum values: owner,service_account,initiator
spec
\nobject
A complete Workflow Automation definition, including its triggers, steps, and connections.
annotations
\n[object]
Up to 100 text annotations displayed on the workflow canvas.
display [required]
\nobject
The annotation's position and size on the workflow canvas.
bounds
\nobject
Canvas coordinates and dimensions for an annotation on the workflow canvas.
height
\ndouble
The annotation's height on the canvas.
width
\ndouble
The annotation's width on the canvas.
x
\ndouble
The annotation's horizontal canvas coordinate.
y
\ndouble
The annotation's vertical canvas coordinate.
id [required]
\nstring
The unique identifier of this annotation within the workflow.
markdownTextAnnotation [required]
\nobject
Markdown content displayed in an annotation.
text
\nstring
The annotation's Markdown content.
connectionEnvs
\n[object]
A list of connections or connection groups used in the workflow.
connectionGroups
\n[object]
The ConnectionEnv connectionGroups.
connectionGroupId [required]
\nstring
The ConnectionGroup connectionGroupId.
label [required]
\nstring
The ConnectionGroup label.
tags [required]
\n[string]
The ConnectionGroup tags.
connections
\n[object]
The ConnectionEnv connections.
connectionId [required]
\nstring
The Connection connectionId.
label [required]
\nstring
The Connection label.
env [required]
\nenum
The definition of ConnectionEnvEnv object. \nAllowed enum values: default
handle
\nstring
Unique identifier used to trigger workflows automatically in Datadog.
inputSchema
\nobject
A list of input parameters for the workflow. Input parameters are available under the Trigger object and can be referenced in workflow steps using {{ Trigger.<parameter_name> }}.
parameters
\n[object]
The InputSchema parameters.
allowExtraValues
\nboolean
The InputSchemaParameters allowExtraValues.
allowedValues
\nThe InputSchemaParameters allowedValues.
defaultValue
\nThe InputSchemaParameters defaultValue.
description
\nstring
The InputSchemaParameters description.
label
\nstring
The InputSchemaParameters label.
name [required]
\nstring
The InputSchemaParameters name.
type [required]
\nenum
The definition of InputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
outputSchema
\nobject
A list of output parameters for the workflow.
parameters
\n[object]
The OutputSchema parameters.
defaultValue
\nThe OutputSchemaParameters defaultValue.
description
\nstring
The OutputSchemaParameters description.
label
\nstring
The OutputSchemaParameters label.
name [required]
\nstring
The OutputSchemaParameters name.
type [required]
\nenum
The definition of OutputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
value
\nThe OutputSchemaParameters value.
steps
\n[object]
A Step is a sub-component of a workflow. Each Step performs an action.
actionId [required]
\nstring
The unique identifier of an action.
completionGate
\nobject
Used to create conditions before running subsequent actions.
completionCondition [required]
\nobject
The definition of CompletionCondition object.
operand1 [required]
\nThe CompletionCondition operand1.
operand2
\nThe CompletionCondition operand2.
operator [required]
\nenum
The definition of CompletionConditionOperator object. \nAllowed enum values: OPERATOR_EQUAL,OPERATOR_NOT_EQUAL,OPERATOR_GREATER_THAN,OPERATOR_LESS_THAN,OPERATOR_GREATER_THAN_OR_EQUAL_TO,OPERATOR_LESS_THAN_OR_EQUAL_TO,OPERATOR_CONTAINS,OPERATOR_DOES_NOT_CONTAIN,OPERATOR_IS_NULL,OPERATOR_IS_NOT_NULLShow 2 more
,OPERATOR_IS_EMPTY,OPERATOR_IS_NOT_EMPTY
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
connectionLabel
\nstring
The unique identifier of a connection defined in the spec.
display
\nobject
The position of a step on the workflow canvas. Omit display from every step to use\nautomatic layout, or provide it for every step to preserve a manual layout.
bounds
\nobject
The definition of StepDisplayBounds object.
x
\ndouble
The bounds x.
y
\ndouble
The bounds y.
errorHandlers
\n[object]
The Step errorHandlers.
fallbackStepName [required]
\nstring
The ErrorHandler fallbackStepName.
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
name [required]
\nstring
Name of the step.
outboundEdges
\n[object]
A list of subsequent actions to run. This list is empty for a terminal step.
branchName [required]
\nstring
The OutboundEdge branchName.
nextStepName [required]
\nstring
The OutboundEdge nextStepName.
parameters
\n[object]
A list of inputs for an action.
name [required]
\nstring
The Parameter name.
value [required]
\nThe Parameter value.
readinessGate
\nobject
Used to merge multiple branches into a single branch.
thresholdType [required]
\nenum
The definition of ReadinessGateThresholdType object. \nAllowed enum values: ANY,ALL
triggers
\n[ <oneOf>]
The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
Object 1
\nobject
Schema for an agent-based trigger.
agentTrigger [required]
\nobject
Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 2
\nobject
Schema for an API-based trigger.
apiTrigger [required]
\nobject
Trigger a workflow from an API request. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 3
\nobject
Schema for an App-based trigger.
appTrigger [required]
\nobject
Trigger a workflow from an App.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 4
\nobject
Schema for a Case-based trigger.
caseTrigger [required]
\nobject
Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 5
\nobject
Schema for a Change Event-based trigger.
changeEventTrigger [required]
\nobject
Trigger a workflow from a Change Event.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 6
\nobject
Schema for a Database Monitoring-based trigger.
databaseMonitoringTrigger [required]
\nobject
Trigger a workflow from Database Monitoring.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 7
\nobject
Schema for a Datastore-based trigger.
datastoreTrigger [required]
\nobject
Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 8
\nobject
Schema for a Dashboard-based trigger.
dashboardTrigger [required]
\nobject
Trigger a workflow from a Dashboard.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 9
\nobject
Schema for a Form-based trigger.
formTrigger [required]
\nobject
Trigger a workflow from a Form.
formId
\nstring
The form UUID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 10
\nobject
Schema for a GitHub webhook-based trigger.
githubWebhookTrigger [required]
\nobject
Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a webhookSecret. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 11
\nobject
Schema for an incident declared trigger.
incidentCreatedTrigger [required]
\nobject
Trigger a workflow when an incident is declared.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 12
\nobject
Schema for an incident impact created trigger.
incidentImpactCreatedTrigger [required]
\nobject
Trigger a workflow when an impact is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 13
\nobject
Schema for an incident impact updated trigger.
incidentImpactUpdatedTrigger [required]
\nobject
Trigger a workflow when an impact is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 14
\nobject
Schema for an incident postmortem updated trigger.
incidentPostmortemUpdatedTrigger [required]
\nobject
Trigger a workflow when a postmortem is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 15
\nobject
Schema for an incident responder created trigger.
incidentResponderCreatedTrigger [required]
\nobject
Trigger a workflow when a responder is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 16
\nobject
Schema for an incident declared or updated trigger.
incidentSavedTrigger [required]
\nobject
Trigger a workflow when an incident is declared or updated.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
serialExecution
\nobject
Whether to execute the workflow serially for an incident.
enabled [required]
\nboolean
Whether serial execution is enabled.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 17
\nobject
Schema for an incident schedule trigger.
incidentScheduleTrigger [required]
\nobject
Trigger a workflow on a schedule for an incident.
incidentType
\nstring
The type of incident that triggers the workflow.
rrule [required]
\nstring
The recurrence rule for the schedule, expressed as an iCalendar RRULE string.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 18
\nobject
Schema for an incident-based trigger.
incidentTrigger [required]
\nobject
Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
version
\nstring
Version of the incident manual trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 19
\nobject
Schema for a Monitor-based trigger.
monitorTrigger [required]
\nobject
Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 20
\nobject
Schema for a Notebook-based trigger.
notebookTrigger [required]
\nobject
Trigger a workflow from a Notebook.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 21
\nobject
Schema for an On-Call-based trigger.
onCallTrigger [required]
\nobject
Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 22
\nobject
Schema for a Schedule-based trigger.
scheduleTrigger [required]
\nobject
Trigger a workflow from a Schedule. The workflow must be published.
overlapBehavior
\nenum
Controls whether a scheduled workflow run may start while another instance is still running. \nAllowed enum values: EXCLUSIVE_RUN,OVERLAP_ALLOWED
default: EXCLUSIVE_RUN
rruleExpression [required]
\nstring
Recurrence rule expression for scheduling.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 23
\nobject
Schema for a Security-based trigger.
securityTrigger [required]
\nobject
Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 24
\nobject
Schema for a Self Service-based trigger.
selfServiceTrigger [required]
\nobject
Trigger a workflow from Self Service.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 25
\nobject
Schema for a Slack-based trigger.
slackTrigger [required]
\nobject
Trigger a workflow from Slack. The workflow must be published.
reactionTriggers
\n[object]
Slack emoji reactions that trigger the workflow.
reactionEmoji [required]
\nstring
The Slack emoji reaction name.
teamId [required]
\nstring
The Slack workspace ID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 26
\nobject
Schema for a Software Catalog-based trigger.
softwareCatalogTrigger [required]
\nobject
Trigger a workflow from Software Catalog.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 27
\nobject
Schema for a Workflow-based trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
workflowTrigger [required]
\nobject
Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger.
tags
\n[string]
Tags of the workflow.
updatedAt
\ndate-time
When the workflow was last updated.
webhookSecret
\nstring
If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here.
id
\nstring
The workflow identifier
relationships
\nobject
The definition of WorkflowDataRelationships object.
creator
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
owner
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
runAs
\nobject
The service account used to run the workflow. Present when runAsUserMode is service_account.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
type [required]
\nenum
The definition of WorkflowDataType object. \nAllowed enum values: workflows
data
\nobject
Data related to the workflow being updated.
attributes [required]
\nobject
The definition of WorkflowDataUpdateAttributes object.
createdAt
\ndate-time
When the workflow was created.
description
\nstring
Description of the workflow.
name
\nstring
Name of the workflow.
published
\nboolean
Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published.
runAsUserMode
\nenum
The effective type of identity used to run the workflow. \nAllowed enum values: owner,service_account,initiator
spec
\nobject
A complete Workflow Automation definition, including its triggers, steps, and connections.
annotations
\n[object]
Up to 100 text annotations displayed on the workflow canvas.
display [required]
\nobject
The annotation's position and size on the workflow canvas.
bounds
\nobject
Canvas coordinates and dimensions for an annotation on the workflow canvas.
height
\ndouble
The annotation's height on the canvas.
width
\ndouble
The annotation's width on the canvas.
x
\ndouble
The annotation's horizontal canvas coordinate.
y
\ndouble
The annotation's vertical canvas coordinate.
id [required]
\nstring
The unique identifier of this annotation within the workflow.
markdownTextAnnotation [required]
\nobject
Markdown content displayed in an annotation.
text
\nstring
The annotation's Markdown content.
connectionEnvs
\n[object]
A list of connections or connection groups used in the workflow.
connectionGroups
\n[object]
The ConnectionEnv connectionGroups.
connectionGroupId [required]
\nstring
The ConnectionGroup connectionGroupId.
label [required]
\nstring
The ConnectionGroup label.
tags [required]
\n[string]
The ConnectionGroup tags.
connections
\n[object]
The ConnectionEnv connections.
connectionId [required]
\nstring
The Connection connectionId.
label [required]
\nstring
The Connection label.
env [required]
\nenum
The definition of ConnectionEnvEnv object. \nAllowed enum values: default
handle
\nstring
Unique identifier used to trigger workflows automatically in Datadog.
inputSchema
\nobject
A list of input parameters for the workflow. Input parameters are available under the Trigger object and can be referenced in workflow steps using {{ Trigger.<parameter_name> }}.
parameters
\n[object]
The InputSchema parameters.
allowExtraValues
\nboolean
The InputSchemaParameters allowExtraValues.
allowedValues
\nThe InputSchemaParameters allowedValues.
defaultValue
\nThe InputSchemaParameters defaultValue.
description
\nstring
The InputSchemaParameters description.
label
\nstring
The InputSchemaParameters label.
name [required]
\nstring
The InputSchemaParameters name.
type [required]
\nenum
The definition of InputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
outputSchema
\nobject
A list of output parameters for the workflow.
parameters
\n[object]
The OutputSchema parameters.
defaultValue
\nThe OutputSchemaParameters defaultValue.
description
\nstring
The OutputSchemaParameters description.
label
\nstring
The OutputSchemaParameters label.
name [required]
\nstring
The OutputSchemaParameters name.
type [required]
\nenum
The definition of OutputSchemaParametersType object. \nAllowed enum values: STRING,NUMBER,BOOLEAN,OBJECT,ARRAY_STRING,ARRAY_NUMBER,ARRAY_BOOLEAN,ARRAY_OBJECT
value
\nThe OutputSchemaParameters value.
steps
\n[object]
A Step is a sub-component of a workflow. Each Step performs an action.
actionId [required]
\nstring
The unique identifier of an action.
completionGate
\nobject
Used to create conditions before running subsequent actions.
completionCondition [required]
\nobject
The definition of CompletionCondition object.
operand1 [required]
\nThe CompletionCondition operand1.
operand2
\nThe CompletionCondition operand2.
operator [required]
\nenum
The definition of CompletionConditionOperator object. \nAllowed enum values: OPERATOR_EQUAL,OPERATOR_NOT_EQUAL,OPERATOR_GREATER_THAN,OPERATOR_LESS_THAN,OPERATOR_GREATER_THAN_OR_EQUAL_TO,OPERATOR_LESS_THAN_OR_EQUAL_TO,OPERATOR_CONTAINS,OPERATOR_DOES_NOT_CONTAIN,OPERATOR_IS_NULL,OPERATOR_IS_NOT_NULLShow 2 more
,OPERATOR_IS_EMPTY,OPERATOR_IS_NOT_EMPTY
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
connectionLabel
\nstring
The unique identifier of a connection defined in the spec.
display
\nobject
The position of a step on the workflow canvas. Omit display from every step to use\nautomatic layout, or provide it for every step to preserve a manual layout.
bounds
\nobject
The definition of StepDisplayBounds object.
x
\ndouble
The bounds x.
y
\ndouble
The bounds y.
errorHandlers
\n[object]
The Step errorHandlers.
fallbackStepName [required]
\nstring
The ErrorHandler fallbackStepName.
retryStrategy [required]
\nobject
The definition of RetryStrategy object.
kind [required]
\nenum
The definition of RetryStrategyKind object. \nAllowed enum values: RETRY_STRATEGY_LINEAR
linear [required]
\nobject
The definition of RetryStrategyLinear object.
interval [required]
\nstring
The RetryStrategyLinear interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
maxRetries [required]
\nint32
The RetryStrategyLinear maxRetries.
name [required]
\nstring
Name of the step.
outboundEdges
\n[object]
A list of subsequent actions to run. This list is empty for a terminal step.
branchName [required]
\nstring
The OutboundEdge branchName.
nextStepName [required]
\nstring
The OutboundEdge nextStepName.
parameters
\n[object]
A list of inputs for an action.
name [required]
\nstring
The Parameter name.
value [required]
\nThe Parameter value.
readinessGate
\nobject
Used to merge multiple branches into a single branch.
thresholdType [required]
\nenum
The definition of ReadinessGateThresholdType object. \nAllowed enum values: ANY,ALL
triggers
\n[ <oneOf>]
The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once.
Object 1
\nobject
Schema for an agent-based trigger.
agentTrigger [required]
\nobject
Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 2
\nobject
Schema for an API-based trigger.
apiTrigger [required]
\nobject
Trigger a workflow from an API request. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 3
\nobject
Schema for an App-based trigger.
appTrigger [required]
\nobject
Trigger a workflow from an App.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 4
\nobject
Schema for a Case-based trigger.
caseTrigger [required]
\nobject
Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 5
\nobject
Schema for a Change Event-based trigger.
changeEventTrigger [required]
\nobject
Trigger a workflow from a Change Event.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 6
\nobject
Schema for a Database Monitoring-based trigger.
databaseMonitoringTrigger [required]
\nobject
Trigger a workflow from Database Monitoring.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 7
\nobject
Schema for a Datastore-based trigger.
datastoreTrigger [required]
\nobject
Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 8
\nobject
Schema for a Dashboard-based trigger.
dashboardTrigger [required]
\nobject
Trigger a workflow from a Dashboard.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 9
\nobject
Schema for a Form-based trigger.
formTrigger [required]
\nobject
Trigger a workflow from a Form.
formId
\nstring
The form UUID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 10
\nobject
Schema for a GitHub webhook-based trigger.
githubWebhookTrigger [required]
\nobject
Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a webhookSecret. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 11
\nobject
Schema for an incident declared trigger.
incidentCreatedTrigger [required]
\nobject
Trigger a workflow when an incident is declared.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 12
\nobject
Schema for an incident impact created trigger.
incidentImpactCreatedTrigger [required]
\nobject
Trigger a workflow when an impact is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 13
\nobject
Schema for an incident impact updated trigger.
incidentImpactUpdatedTrigger [required]
\nobject
Trigger a workflow when an impact is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 14
\nobject
Schema for an incident postmortem updated trigger.
incidentPostmortemUpdatedTrigger [required]
\nobject
Trigger a workflow when a postmortem is updated for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 15
\nobject
Schema for an incident responder created trigger.
incidentResponderCreatedTrigger [required]
\nobject
Trigger a workflow when a responder is created for an incident.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 16
\nobject
Schema for an incident declared or updated trigger.
incidentSavedTrigger [required]
\nobject
Trigger a workflow when an incident is declared or updated.
executionLimit
\nobject
The maximum number of times to execute a workflow for an incident.
count [required]
\nint32
The maximum number of workflow executions.
incidentType
\nstring
The type of incident that triggers the workflow.
serialExecution
\nobject
Whether to execute the workflow serially for an incident.
enabled [required]
\nboolean
Whether serial execution is enabled.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 17
\nobject
Schema for an incident schedule trigger.
incidentScheduleTrigger [required]
\nobject
Trigger a workflow on a schedule for an incident.
incidentType
\nstring
The type of incident that triggers the workflow.
rrule [required]
\nstring
The recurrence rule for the schedule, expressed as an iCalendar RRULE string.
tagCondition
\nobject
Conditions that determine which incidents trigger the workflow.
tagValues
\n[object]
Incident tags and values used to filter matching incidents.
tag [required]
\nstring
The incident tag to match.
values [required]
\n[string]
The accepted values for the incident tag.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 18
\nobject
Schema for an incident-based trigger.
incidentTrigger [required]
\nobject
Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
version
\nstring
Version of the incident manual trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 19
\nobject
Schema for a Monitor-based trigger.
monitorTrigger [required]
\nobject
Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 20
\nobject
Schema for a Notebook-based trigger.
notebookTrigger [required]
\nobject
Trigger a workflow from a Notebook.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 21
\nobject
Schema for an On-Call-based trigger.
onCallTrigger [required]
\nobject
Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 22
\nobject
Schema for a Schedule-based trigger.
scheduleTrigger [required]
\nobject
Trigger a workflow from a Schedule. The workflow must be published.
overlapBehavior
\nenum
Controls whether a scheduled workflow run may start while another instance is still running. \nAllowed enum values: EXCLUSIVE_RUN,OVERLAP_ALLOWED
default: EXCLUSIVE_RUN
rruleExpression [required]
\nstring
Recurrence rule expression for scheduling.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 23
\nobject
Schema for a Security-based trigger.
securityTrigger [required]
\nobject
Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published.
rateLimit
\nobject
Defines a rate limit for a trigger.
count
\nint64
The TriggerRateLimit count.
interval
\nstring
The TriggerRateLimit interval. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 24
\nobject
Schema for a Self Service-based trigger.
selfServiceTrigger [required]
\nobject
Trigger a workflow from Self Service.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 25
\nobject
Schema for a Slack-based trigger.
slackTrigger [required]
\nobject
Trigger a workflow from Slack. The workflow must be published.
reactionTriggers
\n[object]
Slack emoji reactions that trigger the workflow.
reactionEmoji [required]
\nstring
The Slack emoji reaction name.
teamId [required]
\nstring
The Slack workspace ID.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 26
\nobject
Schema for a Software Catalog-based trigger.
softwareCatalogTrigger [required]
\nobject
Trigger a workflow from Software Catalog.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
Object 27
\nobject
Schema for a Workflow-based trigger.
startStepNames
\n[string]
Names of existing workflow steps that run first after a trigger fires.
workflowTrigger [required]
\nobject
Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger.
tags
\n[string]
Tags of the workflow.
updatedAt
\ndate-time
When the workflow was last updated.
id
\nstring
The workflow identifier
relationships
\nobject
The definition of WorkflowDataRelationships object.
creator
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
owner
\nobject
The definition of WorkflowUserRelationship object.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
runAs
\nobject
The service account used to run the workflow. Present when runAsUserMode is service_account.
data
\nobject
The definition of WorkflowUserRelationshipData object.
id [required]
\nstring
The user identifier
type [required]
\nenum
The definition of WorkflowUserRelationshipType object. \nAllowed enum values: users
type [required]
\nenum
The definition of WorkflowDataType object. \nAllowed enum values: workflows