Update ListAssetsSBOMs spec - require asset_type on first page, add ServerlessFunction asset type

.generator/schemas/v2/openapi.yaml

@@ -10502,6 +10502,7 @@ components:
         - Host
         - HostImage
         - Image
+        - ServerlessFunction
       example: Repository
       type: string
       x-enum-varnames:
@@ -10510,6 +10511,7 @@ components:
         - HOST
         - HOSTIMAGE
         - IMAGE
+        - SERVERLESSFUNCTION
     AssetVersion:
       description: Asset version.
       properties:
@@ -175616,6 +175618,11 @@ paths:
       description: |-
         Get a list of assets SBOMs for an organization.
 
+        The `filter[asset_type]` parameter is required for initial requests (when no `page[token]` is provided).
+        Subsequent pages encode the asset type in the pagination token, so `filter[asset_type]` is not required
+        for paginated requests. Mixing infrastructure asset types (`Host`, `HostImage`, `Image`, `ServerlessFunction`)
+        with code asset types (`Repository`, `Service`) in the same request is not supported and returns a 400 error.
+
         ### Pagination
 
         Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint.
@@ -175645,7 +175652,8 @@ paths:
             format: int64
             minimum: 1
             type: integer
-        - description: The type of the assets for the SBOM request.
+        - description: >-
+            The type of the assets for the SBOM request. Required for initial requests (when no `page[token]` is provided). Infrastructure types (`Host`, `HostImage`, `Image`, `ServerlessFunction`) and code types (`Repository`, `Service`) cannot be mixed in the same request.
           example: Repository
           in: query
           name: filter[asset_type]

cassettes/features/v2/security_monitoring/List-assets-SBOMs-returns-Bad-request-Invalid-pagination-token-response.frozen

@@ -1 +1 @@
-2026-07-06T19:25:16.964Z
+2026-07-07T14:35:06.517Z

cassettes/features/v2/security_monitoring/List-assets-SBOMs-returns-OK-response.frozen

@@ -1 +1 @@
-2026-01-20T08:27:19.760Z
+2026-07-07T14:35:10.638Z

features/v2/security_monitoring.feature

@@ -2369,7 +2369,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-vm
   Scenario: List assets SBOMs returns "Bad request: Invalid pagination token." response
     Given new "ListAssetsSBOMs" request
-    And request contains "page[token]" parameter with value "unknown"
+    And request contains "page[token]" parameter with value "SERVICE:unknown"
     And request contains "page[number]" parameter with value 1
     When the request is sent
     Then the response status is 400 Bad request: Invalid pagination token.

lib/datadog_api_client/v2/api/security_monitoring_api.rb

@@ -5050,7 +5050,7 @@ def get_sbom_with_http_info(asset_type, filter_asset_name, opts = {})
         fail ArgumentError, "Missing the required parameter 'asset_type' when calling SecurityMonitoringAPI.get_sbom"
       end
       # verify enum value
-      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image']
+      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image', 'ServerlessFunction']
       if @api_client.config.client_side_validation && !allowable_values.include?(asset_type)
         fail ArgumentError, "invalid value for \"asset_type\", must be one of #{allowable_values}"
       end
@@ -7227,6 +7227,11 @@ def list_assets_sbo_ms(opts = {})
     #
     # Get a list of assets SBOMs for an organization.
     #
+    # The `filter[asset_type]` parameter is required for initial requests (when no `page[token]` is provided).
+    # Subsequent pages encode the asset type in the pagination token, so `filter[asset_type]` is not required
+    # for paginated requests. Mixing infrastructure asset types (`Host`, `HostImage`, `Image`, `ServerlessFunction`)
+    # with code asset types (`Repository`, `Service`) in the same request is not supported and returns a 400 error.
+    #
     # ### Pagination
     #
     # Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint.
@@ -7242,7 +7247,7 @@ def list_assets_sbo_ms(opts = {})
     # @param opts [Hash] the optional parameters
     # @option opts [String] :page_token Its value must come from the `links` section of the response of the first request. Do not manually edit it.
     # @option opts [Integer] :page_number The page number to be retrieved. It should be equal to or greater than 1.
-    # @option opts [AssetType] :filter_asset_type The type of the assets for the SBOM request.
+    # @option opts [AssetType] :filter_asset_type The type of the assets for the SBOM request. Required for initial requests (when no `page[token]` is provided). Infrastructure types (`Host`, `HostImage`, `Image`, `ServerlessFunction`) and code types (`Repository`, `Service`) cannot be mixed in the same request.
     # @option opts [String] :filter_asset_name The name of the asset for the SBOM request.
     # @option opts [String] :filter_package_name The name of the component that is a dependency of an asset.
     # @option opts [String] :filter_package_version The version of the component that is a dependency of an asset.
@@ -7257,7 +7262,7 @@ def list_assets_sbo_ms_with_http_info(opts = {})
       if @api_client.config.client_side_validation && !opts[:'page_number'].nil? && opts[:'page_number'] < 1
         fail ArgumentError, 'invalid value for "opts[:"page_number"]" when calling SecurityMonitoringAPI.list_assets_sbo_ms, must be greater than or equal to 1.'
       end
-      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image']
+      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image', 'ServerlessFunction']
       if @api_client.config.client_side_validation && opts[:'filter_asset_type'] && !allowable_values.include?(opts[:'filter_asset_type'])
         fail ArgumentError, "invalid value for \"filter_asset_type\", must be one of #{allowable_values}"
       end
@@ -9219,7 +9224,7 @@ def list_vulnerabilities_with_http_info(opts = {})
       if @api_client.config.client_side_validation && opts[:'filter_ecosystem'] && !allowable_values.include?(opts[:'filter_ecosystem'])
         fail ArgumentError, "invalid value for \"filter_ecosystem\", must be one of #{allowable_values}"
       end
-      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image']
+      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image', 'ServerlessFunction']
       if @api_client.config.client_side_validation && opts[:'filter_asset_type'] && !allowable_values.include?(opts[:'filter_asset_type'])
         fail ArgumentError, "invalid value for \"filter_asset_type\", must be one of #{allowable_values}"
       end
@@ -9364,7 +9369,7 @@ def list_vulnerable_assets_with_http_info(opts = {})
       if @api_client.config.client_side_validation && !opts[:'page_number'].nil? && opts[:'page_number'] < 1
         fail ArgumentError, 'invalid value for "opts[:"page_number"]" when calling SecurityMonitoringAPI.list_vulnerable_assets, must be greater than or equal to 1.'
       end
-      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image']
+      allowable_values = ['Repository', 'Service', 'Host', 'HostImage', 'Image', 'ServerlessFunction']
       if @api_client.config.client_side_validation && opts[:'filter_type'] && !allowable_values.include?(opts[:'filter_type'])
         fail ArgumentError, "invalid value for \"filter_type\", must be one of #{allowable_values}"
       end

lib/datadog_api_client/v2/models/asset_type.rb

@@ -26,5 +26,6 @@ class AssetType
     HOST = "Host".freeze
     HOSTIMAGE = "HostImage".freeze
     IMAGE = "Image".freeze
+    SERVERLESSFUNCTION = "ServerlessFunction".freeze
   end
 end