diff --git a/hugo/config/_default/menus/api.en.yaml b/hugo/config/_default/menus/api.en.yaml index 00d6d42fd67..4a2388b4a8e 100644 --- a/hugo/config/_default/menus/api.en.yaml +++ b/hugo/config/_default/menus/api.en.yaml @@ -11913,6 +11913,75 @@ menu: - SearchIssues unstable: [] order: 1 + - name: Execution Policy + url: /api/latest/execution-policy/ + identifier: execution-policy + generated: true + - name: Update an execution policy + url: /api/latest/execution-policy/update-an-execution-policy/ + identifier: execution-policy-update-an-execution-policy + parent: execution-policy + generated: true + params: + versions: + - v2 + operationids: + - UpdateExecutionPolicy + unstable: + - v2 + order: 12 + - name: Get an execution policy + url: /api/latest/execution-policy/get-an-execution-policy/ + identifier: execution-policy-get-an-execution-policy + parent: execution-policy + generated: true + params: + versions: + - v2 + operationids: + - GetExecutionPolicy + unstable: + - v2 + order: 11 + - name: Delete an execution policy + url: /api/latest/execution-policy/delete-an-execution-policy/ + identifier: execution-policy-delete-an-execution-policy + parent: execution-policy + generated: true + params: + versions: + - v2 + operationids: + - DeleteExecutionPolicy + unstable: + - v2 + order: 13 + - name: Create an execution policy + url: /api/latest/execution-policy/create-an-execution-policy/ + identifier: execution-policy-create-an-execution-policy + parent: execution-policy + generated: true + params: + versions: + - v2 + operationids: + - CreateExecutionPolicy + unstable: + - v2 + order: 10 + - name: List execution policies + url: /api/latest/execution-policy/list-execution-policies/ + identifier: execution-policy-list-execution-policies + parent: execution-policy + generated: true + params: + versions: + - v2 + operationids: + - ListExecutionPolicies + unstable: + - v2 + order: 9 - name: Fastly Integration url: /api/latest/fastly-integration/ identifier: fastly-integration diff --git a/hugo/content/en/api/latest/execution-policy/_index.md b/hugo/content/en/api/latest/execution-policy/_index.md new file mode 100644 index 00000000000..1f64fdaba3b --- /dev/null +++ b/hugo/content/en/api/latest/execution-policy/_index.md @@ -0,0 +1,3 @@ +--- +title: Execution Policy +--- diff --git a/hugo/content/en/api/latest/execution-policy/create-an-execution-policy/index.md b/hugo/content/en/api/latest/execution-policy/create-an-execution-policy/index.md new file mode 100644 index 00000000000..8f596d48b3f --- /dev/null +++ b/hugo/content/en/api/latest/execution-policy/create-an-execution-policy/index.md @@ -0,0 +1,3 @@ +--- +title: Create an execution policy +--- diff --git a/hugo/content/en/api/latest/execution-policy/delete-an-execution-policy/index.md b/hugo/content/en/api/latest/execution-policy/delete-an-execution-policy/index.md new file mode 100644 index 00000000000..9af6357796b --- /dev/null +++ b/hugo/content/en/api/latest/execution-policy/delete-an-execution-policy/index.md @@ -0,0 +1,3 @@ +--- +title: Delete an execution policy +--- diff --git a/hugo/content/en/api/latest/execution-policy/get-an-execution-policy/index.md b/hugo/content/en/api/latest/execution-policy/get-an-execution-policy/index.md new file mode 100644 index 00000000000..e6263fc965b --- /dev/null +++ b/hugo/content/en/api/latest/execution-policy/get-an-execution-policy/index.md @@ -0,0 +1,3 @@ +--- +title: Get an execution policy +--- diff --git a/hugo/content/en/api/latest/execution-policy/list-execution-policies/index.md b/hugo/content/en/api/latest/execution-policy/list-execution-policies/index.md new file mode 100644 index 00000000000..97e570492e2 --- /dev/null +++ b/hugo/content/en/api/latest/execution-policy/list-execution-policies/index.md @@ -0,0 +1,3 @@ +--- +title: List execution policies +--- diff --git a/hugo/content/en/api/latest/execution-policy/update-an-execution-policy/index.md b/hugo/content/en/api/latest/execution-policy/update-an-execution-policy/index.md new file mode 100644 index 00000000000..1d0c6f21a34 --- /dev/null +++ b/hugo/content/en/api/latest/execution-policy/update-an-execution-policy/index.md @@ -0,0 +1,3 @@ +--- +title: Update an execution policy +--- diff --git a/hugo/content/en/api/v2/execution-policy/_index.md b/hugo/content/en/api/v2/execution-policy/_index.md new file mode 100644 index 00000000000..21ba88b5bfb --- /dev/null +++ b/hugo/content/en/api/v2/execution-policy/_index.md @@ -0,0 +1,4 @@ +--- +title: Execution Policy +headless: true +--- diff --git a/hugo/content/en/api/v2/execution-policy/examples.json b/hugo/content/en/api/v2/execution-policy/examples.json new file mode 100644 index 00000000000..a18f2bed199 --- /dev/null +++ b/hugo/content/en/api/v2/execution-policy/examples.json @@ -0,0 +1,748 @@ +{ + "ListExecutionPolicies": { + "responses": { + "200": { + "json": { + "data": [ + { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "created_at": "2026-01-15T10:00:00.000Z", + "created_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ], + "name": "Production hosts" + } + ], + "updated_at": "2026-01-15T10:00:00.000Z", + "updated_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "version": 1 + }, + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy" + } + ], + "meta": { + "page": { + "total": 1 + } + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

[object]

\n

The execution policies.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

An execution policy.

\n
\n
\n
\n
\n
\n

action_pattern [required]

\n
\n

object

\n

The set of actions this policy applies to.

\n
\n
\n
\n
\n
\n

action_fqns [required]

\n
\n

[string]

\n

The fully qualified action names this policy matches. Use * to match all actions\nof the integration, or a fully qualified name prefixed with the integration's action\nnamespace (for example com.datadoghq.script.* for the Script integration).

\n
\n \n
\n
\n
\n
\n
\n

integration [required]

\n
\n

enum

\n

The integration the action pattern applies to. \nAllowed enum values: INTEGRATION_KUBERNETES,INTEGRATION_SCRIPT,INTEGRATION_REMOTE_ACTION

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

date-time

\n

The date and time the execution policy was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

string

\n

The ID of the user who created the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

effect [required]

\n
\n

enum

\n

Whether the policy allows or denies matching actions. \nAllowed enum values: allow,deny

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

object

\n

Restricts where the policy applies. Exactly one of kubernetes, scripts,\nor remote_action_rshell can be set.

\n
\n
\n
\n
\n
\n

kubernetes

\n
\n

object

\n

Restricts the policy to specific Kubernetes namespaces.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The Kubernetes scope rules.

\n
\n
\n
\n
\n
\n

target_namespaces [required]

\n
\n

[string]

\n

The Kubernetes namespaces this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

remote_action_rshell

\n
\n

object

\n

Restricts the policy to specific remote shell paths.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The remote shell scope rules.

\n
\n
\n
\n
\n
\n

access [required]

\n
\n

enum

\n

The level of remote shell access granted for the target paths. \nAllowed enum values: read_only,read_write

\n
\n \n
\n
\n
\n
\n
\n

target_paths [required]

\n
\n

[string]

\n

The file system paths this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scripts

\n
\n

object

\n

Restricts the policy to specific scripts.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The script scope rules.

\n
\n
\n
\n
\n
\n

target_script_names [required]

\n
\n

[string]

\n

The script names this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

targets [required]

\n
\n

[object]

\n

The targets this policy applies to.

\n
\n
\n
\n
\n
\n

agent_tags [required]

\n
\n

[string]

\n

The Agent tags identifying the target.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

A human-readable name for the target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

updated_at [required]

\n
\n

date-time

\n

The date and time the execution policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

updated_by [required]

\n
\n

string

\n

The ID of the user who last updated the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

version [required]

\n
\n

int32

\n

The version of the execution policy. Incremented on every update.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The ID of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be execution_policy. \nAllowed enum values: execution_policy

default: execution_policy

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

meta [required]

\n
\n

object

\n

Pagination metadata for the list of execution policies.

\n
\n
\n
\n
\n
\n

page [required]

\n
\n

object

\n

Pagination details.

\n
\n
\n
\n
\n
\n

total [required]

\n
\n

int32

\n

The total number of execution policies matching the query.

\n
\n \n
\n
\n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "CreateExecutionPolicy": { + "responses": { + "201": { + "json": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "created_at": "2026-01-15T10:00:00.000Z", + "created_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ], + "name": "Production hosts" + } + ], + "updated_at": "2026-01-15T10:00:00.000Z", + "updated_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "version": 1 + }, + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single execution policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

An execution policy.

\n
\n
\n
\n
\n
\n

action_pattern [required]

\n
\n

object

\n

The set of actions this policy applies to.

\n
\n
\n
\n
\n
\n

action_fqns [required]

\n
\n

[string]

\n

The fully qualified action names this policy matches. Use * to match all actions\nof the integration, or a fully qualified name prefixed with the integration's action\nnamespace (for example com.datadoghq.script.* for the Script integration).

\n
\n \n
\n
\n
\n
\n
\n

integration [required]

\n
\n

enum

\n

The integration the action pattern applies to. \nAllowed enum values: INTEGRATION_KUBERNETES,INTEGRATION_SCRIPT,INTEGRATION_REMOTE_ACTION

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

date-time

\n

The date and time the execution policy was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

string

\n

The ID of the user who created the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

effect [required]

\n
\n

enum

\n

Whether the policy allows or denies matching actions. \nAllowed enum values: allow,deny

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

object

\n

Restricts where the policy applies. Exactly one of kubernetes, scripts,\nor remote_action_rshell can be set.

\n
\n
\n
\n
\n
\n

kubernetes

\n
\n

object

\n

Restricts the policy to specific Kubernetes namespaces.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The Kubernetes scope rules.

\n
\n
\n
\n
\n
\n

target_namespaces [required]

\n
\n

[string]

\n

The Kubernetes namespaces this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

remote_action_rshell

\n
\n

object

\n

Restricts the policy to specific remote shell paths.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The remote shell scope rules.

\n
\n
\n
\n
\n
\n

access [required]

\n
\n

enum

\n

The level of remote shell access granted for the target paths. \nAllowed enum values: read_only,read_write

\n
\n \n
\n
\n
\n
\n
\n

target_paths [required]

\n
\n

[string]

\n

The file system paths this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scripts

\n
\n

object

\n

Restricts the policy to specific scripts.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The script scope rules.

\n
\n
\n
\n
\n
\n

target_script_names [required]

\n
\n

[string]

\n

The script names this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

targets [required]

\n
\n

[object]

\n

The targets this policy applies to.

\n
\n
\n
\n
\n
\n

agent_tags [required]

\n
\n

[string]

\n

The Agent tags identifying the target.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

A human-readable name for the target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

updated_at [required]

\n
\n

date-time

\n

The date and time the execution policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

updated_by [required]

\n
\n

string

\n

The ID of the user who last updated the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

version [required]

\n
\n

int32

\n

The version of the execution policy. Incremented on every update.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The ID of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be execution_policy. \nAllowed enum values: execution_policy

default: execution_policy

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ] + } + ] + }, + "type": "execution_policy" + } + }, + "json": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ], + "name": "Production hosts" + } + ] + }, + "type": "execution_policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single execution policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes used to create or update an execution policy.

\n
\n
\n
\n
\n
\n

action_pattern [required]

\n
\n

object

\n

The set of actions this policy applies to.

\n
\n
\n
\n
\n
\n

action_fqns [required]

\n
\n

[string]

\n

The fully qualified action names this policy matches. Use * to match all actions\nof the integration, or a fully qualified name prefixed with the integration's action\nnamespace (for example com.datadoghq.script.* for the Script integration).

\n
\n \n
\n
\n
\n
\n
\n

integration [required]

\n
\n

enum

\n

The integration the action pattern applies to. \nAllowed enum values: INTEGRATION_KUBERNETES,INTEGRATION_SCRIPT,INTEGRATION_REMOTE_ACTION

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

effect [required]

\n
\n

enum

\n

Whether the policy allows or denies matching actions. \nAllowed enum values: allow,deny

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

object

\n

Restricts where the policy applies. Exactly one of kubernetes, scripts,\nor remote_action_rshell can be set.

\n
\n
\n
\n
\n
\n

kubernetes

\n
\n

object

\n

Restricts the policy to specific Kubernetes namespaces.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The Kubernetes scope rules.

\n
\n
\n
\n
\n
\n

target_namespaces [required]

\n
\n

[string]

\n

The Kubernetes namespaces this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

remote_action_rshell

\n
\n

object

\n

Restricts the policy to specific remote shell paths.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The remote shell scope rules.

\n
\n
\n
\n
\n
\n

access [required]

\n
\n

enum

\n

The level of remote shell access granted for the target paths. \nAllowed enum values: read_only,read_write

\n
\n \n
\n
\n
\n
\n
\n

target_paths [required]

\n
\n

[string]

\n

The file system paths this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scripts

\n
\n

object

\n

Restricts the policy to specific scripts.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The script scope rules.

\n
\n
\n
\n
\n
\n

target_script_names [required]

\n
\n

[string]

\n

The script names this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

targets

\n
\n

[object]

\n

The targets this policy applies to.

\n
\n
\n
\n
\n
\n

agent_tags [required]

\n
\n

[string]

\n

The Agent tags identifying the target.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

A human-readable name for the target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be execution_policy. \nAllowed enum values: execution_policy

default: execution_policy

\n
\n \n
\n
\n
\n
" + } + }, + "DeleteExecutionPolicy": { + "responses": { + "403": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "404": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "GetExecutionPolicy": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "created_at": "2026-01-15T10:00:00.000Z", + "created_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ], + "name": "Production hosts" + } + ], + "updated_at": "2026-01-15T10:00:00.000Z", + "updated_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "version": 1 + }, + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single execution policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

An execution policy.

\n
\n
\n
\n
\n
\n

action_pattern [required]

\n
\n

object

\n

The set of actions this policy applies to.

\n
\n
\n
\n
\n
\n

action_fqns [required]

\n
\n

[string]

\n

The fully qualified action names this policy matches. Use * to match all actions\nof the integration, or a fully qualified name prefixed with the integration's action\nnamespace (for example com.datadoghq.script.* for the Script integration).

\n
\n \n
\n
\n
\n
\n
\n

integration [required]

\n
\n

enum

\n

The integration the action pattern applies to. \nAllowed enum values: INTEGRATION_KUBERNETES,INTEGRATION_SCRIPT,INTEGRATION_REMOTE_ACTION

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

date-time

\n

The date and time the execution policy was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

string

\n

The ID of the user who created the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

effect [required]

\n
\n

enum

\n

Whether the policy allows or denies matching actions. \nAllowed enum values: allow,deny

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

object

\n

Restricts where the policy applies. Exactly one of kubernetes, scripts,\nor remote_action_rshell can be set.

\n
\n
\n
\n
\n
\n

kubernetes

\n
\n

object

\n

Restricts the policy to specific Kubernetes namespaces.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The Kubernetes scope rules.

\n
\n
\n
\n
\n
\n

target_namespaces [required]

\n
\n

[string]

\n

The Kubernetes namespaces this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

remote_action_rshell

\n
\n

object

\n

Restricts the policy to specific remote shell paths.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The remote shell scope rules.

\n
\n
\n
\n
\n
\n

access [required]

\n
\n

enum

\n

The level of remote shell access granted for the target paths. \nAllowed enum values: read_only,read_write

\n
\n \n
\n
\n
\n
\n
\n

target_paths [required]

\n
\n

[string]

\n

The file system paths this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scripts

\n
\n

object

\n

Restricts the policy to specific scripts.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The script scope rules.

\n
\n
\n
\n
\n
\n

target_script_names [required]

\n
\n

[string]

\n

The script names this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

targets [required]

\n
\n

[object]

\n

The targets this policy applies to.

\n
\n
\n
\n
\n
\n

agent_tags [required]

\n
\n

[string]

\n

The Agent tags identifying the target.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

A human-readable name for the target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

updated_at [required]

\n
\n

date-time

\n

The date and time the execution policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

updated_by [required]

\n
\n

string

\n

The ID of the user who last updated the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

version [required]

\n
\n

int32

\n

The version of the execution policy. Incremented on every update.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The ID of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be execution_policy. \nAllowed enum values: execution_policy

default: execution_policy

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "404": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "UpdateExecutionPolicy": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "created_at": "2026-01-15T10:00:00.000Z", + "created_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ], + "name": "Production hosts" + } + ], + "updated_at": "2026-01-15T10:00:00.000Z", + "updated_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "version": 1 + }, + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single execution policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

An execution policy.

\n
\n
\n
\n
\n
\n

action_pattern [required]

\n
\n

object

\n

The set of actions this policy applies to.

\n
\n
\n
\n
\n
\n

action_fqns [required]

\n
\n

[string]

\n

The fully qualified action names this policy matches. Use * to match all actions\nof the integration, or a fully qualified name prefixed with the integration's action\nnamespace (for example com.datadoghq.script.* for the Script integration).

\n
\n \n
\n
\n
\n
\n
\n

integration [required]

\n
\n

enum

\n

The integration the action pattern applies to. \nAllowed enum values: INTEGRATION_KUBERNETES,INTEGRATION_SCRIPT,INTEGRATION_REMOTE_ACTION

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

date-time

\n

The date and time the execution policy was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

string

\n

The ID of the user who created the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

effect [required]

\n
\n

enum

\n

Whether the policy allows or denies matching actions. \nAllowed enum values: allow,deny

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

object

\n

Restricts where the policy applies. Exactly one of kubernetes, scripts,\nor remote_action_rshell can be set.

\n
\n
\n
\n
\n
\n

kubernetes

\n
\n

object

\n

Restricts the policy to specific Kubernetes namespaces.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The Kubernetes scope rules.

\n
\n
\n
\n
\n
\n

target_namespaces [required]

\n
\n

[string]

\n

The Kubernetes namespaces this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

remote_action_rshell

\n
\n

object

\n

Restricts the policy to specific remote shell paths.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The remote shell scope rules.

\n
\n
\n
\n
\n
\n

access [required]

\n
\n

enum

\n

The level of remote shell access granted for the target paths. \nAllowed enum values: read_only,read_write

\n
\n \n
\n
\n
\n
\n
\n

target_paths [required]

\n
\n

[string]

\n

The file system paths this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scripts

\n
\n

object

\n

Restricts the policy to specific scripts.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The script scope rules.

\n
\n
\n
\n
\n
\n

target_script_names [required]

\n
\n

[string]

\n

The script names this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

targets [required]

\n
\n

[object]

\n

The targets this policy applies to.

\n
\n
\n
\n
\n
\n

agent_tags [required]

\n
\n

[string]

\n

The Agent tags identifying the target.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

A human-readable name for the target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

updated_at [required]

\n
\n

date-time

\n

The date and time the execution policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

updated_by [required]

\n
\n

string

\n

The ID of the user who last updated the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

version [required]

\n
\n

int32

\n

The version of the execution policy. Incremented on every update.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The ID of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be execution_policy. \nAllowed enum values: execution_policy

default: execution_policy

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "404": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ] + } + ] + }, + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy" + } + }, + "json": { + "data": { + "attributes": { + "action_pattern": { + "action_fqns": [ + "com.datadoghq.script.*" + ], + "integration": "INTEGRATION_SCRIPT" + }, + "effect": "allow", + "name": "Block prod restarts", + "scope": { + "kubernetes": { + "rules": [ + { + "target_namespaces": [ + "default" + ] + } + ] + }, + "remote_action_rshell": { + "rules": [ + { + "access": "read_only", + "target_paths": [ + "/var/log" + ] + } + ] + }, + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "agent_tags": [ + "env:prod" + ], + "name": "Production hosts" + } + ] + }, + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single execution policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes used to create or update an execution policy.

\n
\n
\n
\n
\n
\n

action_pattern [required]

\n
\n

object

\n

The set of actions this policy applies to.

\n
\n
\n
\n
\n
\n

action_fqns [required]

\n
\n

[string]

\n

The fully qualified action names this policy matches. Use * to match all actions\nof the integration, or a fully qualified name prefixed with the integration's action\nnamespace (for example com.datadoghq.script.* for the Script integration).

\n
\n \n
\n
\n
\n
\n
\n

integration [required]

\n
\n

enum

\n

The integration the action pattern applies to. \nAllowed enum values: INTEGRATION_KUBERNETES,INTEGRATION_SCRIPT,INTEGRATION_REMOTE_ACTION

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

effect [required]

\n
\n

enum

\n

Whether the policy allows or denies matching actions. \nAllowed enum values: allow,deny

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

object

\n

Restricts where the policy applies. Exactly one of kubernetes, scripts,\nor remote_action_rshell can be set.

\n
\n
\n
\n
\n
\n

kubernetes

\n
\n

object

\n

Restricts the policy to specific Kubernetes namespaces.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The Kubernetes scope rules.

\n
\n
\n
\n
\n
\n

target_namespaces [required]

\n
\n

[string]

\n

The Kubernetes namespaces this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

remote_action_rshell

\n
\n

object

\n

Restricts the policy to specific remote shell paths.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The remote shell scope rules.

\n
\n
\n
\n
\n
\n

access [required]

\n
\n

enum

\n

The level of remote shell access granted for the target paths. \nAllowed enum values: read_only,read_write

\n
\n \n
\n
\n
\n
\n
\n

target_paths [required]

\n
\n

[string]

\n

The file system paths this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scripts

\n
\n

object

\n

Restricts the policy to specific scripts.

\n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

The script scope rules.

\n
\n
\n
\n
\n
\n

target_script_names [required]

\n
\n

[string]

\n

The script names this rule applies to.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

targets

\n
\n

[object]

\n

The targets this policy applies to.

\n
\n
\n
\n
\n
\n

agent_tags [required]

\n
\n

[string]

\n

The Agent tags identifying the target.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

A human-readable name for the target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The ID of the execution policy.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be execution_policy. \nAllowed enum values: execution_policy

default: execution_policy

\n
\n \n
\n
\n
\n
" + } + } +} \ No newline at end of file diff --git a/hugo/content/en/api/v2/execution-policy/request.CreateExecutionPolicy.json b/hugo/content/en/api/v2/execution-policy/request.CreateExecutionPolicy.json new file mode 100644 index 00000000000..ee8660a01d1 --- /dev/null +++ b/hugo/content/en/api/v2/execution-policy/request.CreateExecutionPolicy.json @@ -0,0 +1,15 @@ +{ + "data": { + "type": "execution_policy", + "attributes": { + "name": "Cassette Execution Policy exampleexecutionpolicy", + "effect": "allow", + "action_pattern": { + "integration": "INTEGRATION_SCRIPT", + "action_fqns": [ + "com.datadoghq.script.*" + ] + } + } + } +} \ No newline at end of file diff --git a/hugo/content/en/api/v2/execution-policy/request.CreateExecutionPolicy_1075977289.json b/hugo/content/en/api/v2/execution-policy/request.CreateExecutionPolicy_1075977289.json new file mode 100644 index 00000000000..a591b855ff0 --- /dev/null +++ b/hugo/content/en/api/v2/execution-policy/request.CreateExecutionPolicy_1075977289.json @@ -0,0 +1,34 @@ +{ + "data": { + "type": "execution_policy", + "attributes": { + "name": "Cassette Execution Policy exampleexecutionpolicy", + "effect": "allow", + "action_pattern": { + "integration": "INTEGRATION_SCRIPT", + "action_fqns": [ + "com.datadoghq.script.*" + ] + }, + "scope": { + "scripts": { + "rules": [ + { + "target_script_names": [ + "restart_service.sh" + ] + } + ] + } + }, + "targets": [ + { + "name": "Production hosts", + "agent_tags": [ + "env:prod" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/hugo/content/en/api/v2/execution-policy/request.UpdateExecutionPolicy.json b/hugo/content/en/api/v2/execution-policy/request.UpdateExecutionPolicy.json new file mode 100644 index 00000000000..02308fbcf9c --- /dev/null +++ b/hugo/content/en/api/v2/execution-policy/request.UpdateExecutionPolicy.json @@ -0,0 +1,16 @@ +{ + "data": { + "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", + "type": "execution_policy", + "attributes": { + "name": "Cassette Execution Policy Updated", + "effect": "allow", + "action_pattern": { + "integration": "INTEGRATION_SCRIPT", + "action_fqns": [ + "com.datadoghq.script.*" + ] + } + } + } +} \ No newline at end of file diff --git a/hugo/data/api/v2/CodeExamples.json b/hugo/data/api/v2/CodeExamples.json index fb2b7d262da..9d52008adf5 100644 --- a/hugo/data/api/v2/CodeExamples.json +++ b/hugo/data/api/v2/CodeExamples.json @@ -763,6 +763,25 @@ "description": "Search events returns \"OK\" response with pagination" } ], + "CreateExecutionPolicy": [ + { + "group": "execution_policy", + "suffix": "", + "description": "Create an execution policy returns \"Created\" response" + }, + { + "group": "execution_policy", + "suffix": "_1075977289", + "description": "Create an execution policy with scope and targets returns \"Created\" response" + } + ], + "UpdateExecutionPolicy": [ + { + "group": "execution_policy", + "suffix": "", + "description": "Update an execution policy returns \"OK\" response" + } + ], "CreateFastlyAccount": [ { "group": "fastly_integration", diff --git a/hugo/data/api/v2/full_spec.yaml b/hugo/data/api/v2/full_spec.yaml index f7698a2fd21..b524edc7f6a 100644 --- a/hugo/data/api/v2/full_spec.yaml +++ b/hugo/data/api/v2/full_spec.yaml @@ -521,6 +521,15 @@ components: schema: example: github type: string + ExecutionPolicyId: + description: The ID of the execution policy. + example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + in: path + name: policy_id + required: true + schema: + format: uuid + type: string FastlyAccountID: description: Fastly Account id. in: path @@ -37532,6 +37541,349 @@ components: example: "One or several indexes are missing or invalid. Results hold data from the other indexes." type: string type: object + ExecutionPolicyActionPattern: + description: The set of actions this policy applies to. + properties: + action_fqns: + description: |- + The fully qualified action names this policy matches. Use `*` to match all actions + of the integration, or a fully qualified name prefixed with the integration's action + namespace (for example `com.datadoghq.script.*` for the Script integration). + example: + - "com.datadoghq.script.*" + items: + type: string + type: array + integration: + $ref: "#/components/schemas/ExecutionPolicyIntegration" + required: + - integration + - action_fqns + type: object + ExecutionPolicyAttributes: + description: An execution policy. + properties: + action_pattern: + $ref: "#/components/schemas/ExecutionPolicyActionPattern" + created_at: + description: The date and time the execution policy was created. + example: "2026-01-15T10:00:00.000Z" + format: date-time + type: string + created_by: + description: The ID of the user who created the execution policy. + example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: string + effect: + $ref: "#/components/schemas/ExecutionPolicyEffect" + name: + description: The name of the execution policy. + example: "Block prod restarts" + type: string + scope: + $ref: "#/components/schemas/ExecutionPolicyScope" + targets: + description: The targets this policy applies to. + items: + $ref: "#/components/schemas/ExecutionPolicyTarget" + type: array + updated_at: + description: The date and time the execution policy was last updated. + example: "2026-01-15T10:00:00.000Z" + format: date-time + type: string + updated_by: + description: The ID of the user who last updated the execution policy. + example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: string + version: + description: The version of the execution policy. Incremented on every update. + example: 1 + format: int32 + maximum: 2147483647 + type: integer + required: + - name + - effect + - action_pattern + - targets + - version + - created_at + - updated_at + - created_by + - updated_by + type: object + ExecutionPolicyCreateRequest: + description: Request object that includes the execution policy to create. + properties: + data: + $ref: "#/components/schemas/ExecutionPolicyCreateRequestData" + required: + - data + type: object + ExecutionPolicyCreateRequestData: + description: Object for a single execution policy. + properties: + attributes: + $ref: "#/components/schemas/ExecutionPolicyWriteAttributes" + type: + $ref: "#/components/schemas/ExecutionPolicyType" + required: + - type + - attributes + type: object + ExecutionPolicyEffect: + description: Whether the policy allows or denies matching actions. + enum: + - allow + - deny + example: allow + type: string + x-enum-varnames: + - ALLOW + - DENY + ExecutionPolicyIntegration: + description: The integration the action pattern applies to. + enum: + - INTEGRATION_KUBERNETES + - INTEGRATION_SCRIPT + - INTEGRATION_REMOTE_ACTION + example: INTEGRATION_SCRIPT + type: string + x-enum-varnames: + - INTEGRATION_KUBERNETES + - INTEGRATION_SCRIPT + - INTEGRATION_REMOTE_ACTION + ExecutionPolicyKubernetesScope: + description: Restricts the policy to specific Kubernetes namespaces. + properties: + rules: + description: The Kubernetes scope rules. + items: + $ref: "#/components/schemas/ExecutionPolicyKubernetesScopeRule" + type: array + required: + - rules + type: object + ExecutionPolicyKubernetesScopeRule: + description: A rule restricting a Kubernetes scope to specific namespaces. + properties: + target_namespaces: + description: The Kubernetes namespaces this rule applies to. + example: + - "default" + items: + type: string + type: array + required: + - target_namespaces + type: object + ExecutionPolicyListResponse: + description: Response object that includes a list of execution policies. + properties: + data: + description: The execution policies. + items: + $ref: "#/components/schemas/ExecutionPolicyResponseData" + type: array + meta: + $ref: "#/components/schemas/ExecutionPolicyListResponseMeta" + required: + - data + - meta + type: object + ExecutionPolicyListResponseMeta: + description: Pagination metadata for the list of execution policies. + properties: + page: + $ref: "#/components/schemas/ExecutionPolicyListResponsePage" + required: + - page + type: object + ExecutionPolicyListResponsePage: + description: Pagination details. + properties: + total: + description: The total number of execution policies matching the query. + example: 1 + format: int32 + maximum: 2147483647 + type: integer + required: + - total + type: object + ExecutionPolicyRemoteActionRshellAccess: + description: The level of remote shell access granted for the target paths. + enum: + - read_only + - read_write + example: read_only + type: string + x-enum-varnames: + - READ_ONLY + - READ_WRITE + ExecutionPolicyRemoteActionRshellScope: + description: Restricts the policy to specific remote shell paths. + properties: + rules: + description: The remote shell scope rules. + items: + $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellScopeRule" + type: array + required: + - rules + type: object + ExecutionPolicyRemoteActionRshellScopeRule: + description: A rule restricting remote shell access to specific paths. + properties: + access: + $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellAccess" + target_paths: + description: The file system paths this rule applies to. + example: + - "/var/log" + items: + type: string + type: array + required: + - target_paths + - access + type: object + ExecutionPolicyResponse: + description: Response object that includes a single execution policy. + properties: + data: + $ref: "#/components/schemas/ExecutionPolicyResponseData" + required: + - data + type: object + ExecutionPolicyResponseData: + description: Object for a single execution policy. + properties: + attributes: + $ref: "#/components/schemas/ExecutionPolicyAttributes" + id: + description: The ID of the execution policy. + example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + readOnly: true + type: string + type: + $ref: "#/components/schemas/ExecutionPolicyType" + required: + - id + - type + - attributes + type: object + ExecutionPolicyScope: + description: |- + Restricts where the policy applies. Exactly one of `kubernetes`, `scripts`, + or `remote_action_rshell` can be set. + properties: + kubernetes: + $ref: "#/components/schemas/ExecutionPolicyKubernetesScope" + remote_action_rshell: + $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellScope" + scripts: + $ref: "#/components/schemas/ExecutionPolicyScriptScope" + type: object + ExecutionPolicyScriptScope: + description: Restricts the policy to specific scripts. + properties: + rules: + description: The script scope rules. + items: + $ref: "#/components/schemas/ExecutionPolicyScriptScopeRule" + type: array + required: + - rules + type: object + ExecutionPolicyScriptScopeRule: + description: A rule restricting a script scope to specific script names. + properties: + target_script_names: + description: The script names this rule applies to. + example: + - "restart_service.sh" + items: + type: string + type: array + required: + - target_script_names + type: object + ExecutionPolicyTarget: + description: A target this policy is scoped to, expressed as a set of Agent tags. + properties: + agent_tags: + description: The Agent tags identifying the target. + example: + - "env:prod" + items: + type: string + type: array + name: + description: A human-readable name for the target. + example: "Production hosts" + nullable: true + type: string + required: + - agent_tags + type: object + ExecutionPolicyType: + default: execution_policy + description: The type of the resource. The value should always be `execution_policy`. + enum: + - execution_policy + example: execution_policy + type: string + x-enum-varnames: + - EXECUTION_POLICY + ExecutionPolicyUpdateRequest: + description: Request object that includes the execution policy to update. + properties: + data: + $ref: "#/components/schemas/ExecutionPolicyUpdateRequestData" + required: + - data + type: object + ExecutionPolicyUpdateRequestData: + description: Object for a single execution policy. + properties: + attributes: + $ref: "#/components/schemas/ExecutionPolicyWriteAttributes" + id: + description: The ID of the execution policy. + example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: string + type: + $ref: "#/components/schemas/ExecutionPolicyType" + required: + - id + - type + - attributes + type: object + ExecutionPolicyWriteAttributes: + description: Attributes used to create or update an execution policy. + properties: + action_pattern: + $ref: "#/components/schemas/ExecutionPolicyActionPattern" + effect: + $ref: "#/components/schemas/ExecutionPolicyEffect" + name: + description: The name of the execution policy. + example: "Block prod restarts" + type: string + scope: + $ref: "#/components/schemas/ExecutionPolicyScope" + targets: + description: The targets this policy applies to. + items: + $ref: "#/components/schemas/ExecutionPolicyTarget" + type: array + required: + - name + - effect + - action_pattern + type: object ExposureRolloutStepRequest: description: Rollout step request payload. properties: @@ -122802,6 +123154,406 @@ paths: tags: - Action Connection x-menu-order: 3 + /api/v2/actions/execution-policies: + get: + description: Retrieve a list of execution policies for the current organization. + operationId: ListExecutionPolicies + parameters: + - description: The number of execution policies to return per page. + example: 100 + in: query + name: page[size] + required: false + schema: + default: 100 + format: int32 + maximum: 100 + minimum: 1 + type: integer + - description: The page number to return. + example: 0 + in: query + name: page[number] + required: false + schema: + default: 0 + format: int32 + maximum: 1000 + minimum: 0 + type: integer + - description: Filter execution policies by name. + example: "Block prod restarts" + in: query + name: filter[name] + required: false + schema: + type: string + - description: Filter execution policies by a list of IDs. + example: + - "3fa85f64-5717-4562-b3fc-2c963f66afa6" + explode: true + in: query + name: filter[ids] + required: false + schema: + items: + type: string + type: array + style: form + - description: Filter execution policies by a list of integrations. + example: + - INTEGRATION_SCRIPT + explode: true + in: query + name: filter[integration] + required: false + schema: + items: + $ref: "#/components/schemas/ExecutionPolicyIntegration" + type: array + style: form + - description: Filter execution policies by a list of effects. + example: + - allow + explode: true + in: query + name: filter[effects] + required: false + schema: + items: + $ref: "#/components/schemas/ExecutionPolicyEffect" + type: array + style: form + - description: Filter execution policies by a list of creator IDs. + example: + - "3fa85f64-5717-4562-b3fc-2c963f66afa6" + explode: true + in: query + name: filter[creator_ids] + required: false + schema: + items: + type: string + type: array + style: form + - description: |- + The sort order for the results. Prefix a field with `-` to sort in + descending order. Valid fields are `name`, `effect`, `integration`, + `created_at`, and `updated_at`. + example: + - "-created_at" + explode: true + in: query + name: sort + required: false + schema: + items: + type: string + type: array + style: form + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - attributes: + action_pattern: + action_fqns: + - "com.datadoghq.script.*" + integration: INTEGRATION_SCRIPT + created_at: "2026-01-15T10:00:00.000Z" + created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + effect: allow + name: "Block prod restarts" + targets: [] + updated_at: "2026-01-15T10:00:00.000Z" + updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + version: 1 + id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: execution_policy + meta: + page: + total: 1 + schema: + $ref: "#/components/schemas/ExecutionPolicyListResponse" + description: OK + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: List execution policies + tags: + - Execution Policy + x-menu-order: 9 + x-permission: + operator: OR + permissions: + - execution_groups_read + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + post: + description: Create a new execution policy. + operationId: CreateExecutionPolicy + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + action_pattern: + action_fqns: + - "com.datadoghq.script.*" + integration: INTEGRATION_SCRIPT + effect: allow + name: "Block prod restarts" + type: execution_policy + schema: + $ref: "#/components/schemas/ExecutionPolicyCreateRequest" + description: The execution policy to create. + required: true + responses: + "201": + content: + application/json: + examples: + default: + value: + data: + attributes: + action_pattern: + action_fqns: + - "com.datadoghq.script.*" + integration: INTEGRATION_SCRIPT + created_at: "2026-01-15T10:00:00.000Z" + created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + effect: allow + name: "Block prod restarts" + targets: [] + updated_at: "2026-01-15T10:00:00.000Z" + updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + version: 1 + id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: execution_policy + schema: + $ref: "#/components/schemas/ExecutionPolicyResponse" + description: Created + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Create an execution policy + tags: + - Execution Policy + x-codegen-request-body-name: body + x-menu-order: 10 + x-permission: + operator: OR + permissions: + - execution_groups_write + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + /api/v2/actions/execution-policies/{policy_id}: + delete: + description: Delete a specific execution policy. + operationId: DeleteExecutionPolicy + parameters: + - $ref: "#/components/parameters/ExecutionPolicyId" + responses: + "204": + description: No Content + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Delete an execution policy + tags: + - Execution Policy + x-menu-order: 13 + x-permission: + operator: OR + permissions: + - execution_groups_write + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + get: + description: Retrieve an existing execution policy by ID. + operationId: GetExecutionPolicy + parameters: + - $ref: "#/components/parameters/ExecutionPolicyId" + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + action_pattern: + action_fqns: + - "com.datadoghq.script.*" + integration: INTEGRATION_SCRIPT + created_at: "2026-01-15T10:00:00.000Z" + created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + effect: allow + name: "Block prod restarts" + targets: [] + updated_at: "2026-01-15T10:00:00.000Z" + updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + version: 1 + id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: execution_policy + schema: + $ref: "#/components/schemas/ExecutionPolicyResponse" + description: OK + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Get an execution policy + tags: + - Execution Policy + x-menu-order: 11 + x-permission: + operator: OR + permissions: + - execution_groups_read + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + put: + description: |- + Update an existing execution policy. + Returns the execution policy object when the request is successful. + operationId: UpdateExecutionPolicy + parameters: + - $ref: "#/components/parameters/ExecutionPolicyId" + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + action_pattern: + action_fqns: + - "com.datadoghq.script.*" + integration: INTEGRATION_SCRIPT + effect: allow + name: "Block prod restarts" + id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: execution_policy + schema: + $ref: "#/components/schemas/ExecutionPolicyUpdateRequest" + description: The new execution policy. + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + action_pattern: + action_fqns: + - "com.datadoghq.script.*" + integration: INTEGRATION_SCRIPT + created_at: "2026-01-15T10:00:00.000Z" + created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + effect: allow + name: "Block prod restarts" + targets: [] + updated_at: "2026-01-15T10:00:00.000Z" + updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + version: 2 + id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" + type: execution_policy + schema: + $ref: "#/components/schemas/ExecutionPolicyResponse" + description: OK + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Update an execution policy + tags: + - Execution Policy + x-codegen-request-body-name: body + x-menu-order: 12 + x-permission: + operator: OR + permissions: + - execution_groups_write + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/agentless_scanning/accounts/aws: get: description: Fetches the scan options configured for AWS accounts. @@ -217032,6 +217784,12 @@ tags: **Update to Datadog monitor events `aggregation_key` starting March 1, 2025:** The Datadog monitor events `aggregation_key` is unique to each Monitor ID. Starting March 1st, this key will also include Monitor Group, making it unique per *Monitor ID and Monitor Group*. If you're using monitor events `aggregation_key` in dashboard queries or the Event API, you must migrate to use `@monitor.id`. Reach out to [support](https://www.datadoghq.com/support/) if you have any question. name: Events + - description: |- + Execution policies control which actions Datadog Action Platform is allowed to run + against your infrastructure, and where. Each policy pairs an effect (allow or deny) + with a pattern of actions, and can scope that decision to specific Kubernetes + namespaces, scripts, or remote shell paths. + name: Execution Policy - description: |- Manage your Datadog Fastly integration accounts and services directly through the Datadog API. See the [Fastly integration page](https://docs.datadoghq.com/integrations/fastly/) for more information. name: Fastly Integration diff --git a/hugo/data/api/v2/translate_actions.json b/hugo/data/api/v2/translate_actions.json index eb9bbbe4438..a14e82dbf54 100644 --- a/hugo/data/api/v2/translate_actions.json +++ b/hugo/data/api/v2/translate_actions.json @@ -133,6 +133,30 @@ "request_description": "Update an existing Action Connection request body", "request_schema_description": "Request used to update an action connection." }, + "ListExecutionPolicies": { + "description": "Retrieve a list of execution policies for the current organization.", + "summary": "List execution policies" + }, + "CreateExecutionPolicy": { + "description": "Create a new execution policy.", + "summary": "Create an execution policy", + "request_description": "The execution policy to create.", + "request_schema_description": "Request object that includes the execution policy to create." + }, + "DeleteExecutionPolicy": { + "description": "Delete a specific execution policy.", + "summary": "Delete an execution policy" + }, + "GetExecutionPolicy": { + "description": "Retrieve an existing execution policy by ID.", + "summary": "Get an execution policy" + }, + "UpdateExecutionPolicy": { + "description": "Update an existing execution policy.\nReturns the execution policy object when the request is successful.", + "summary": "Update an execution policy", + "request_description": "The new execution policy.", + "request_schema_description": "Request object that includes the execution policy to update." + }, "ListAwsScanOptions": { "description": "Fetches the scan options configured for AWS accounts.", "summary": "List AWS scan options" diff --git a/hugo/data/api/v2/translate_tags.json b/hugo/data/api/v2/translate_tags.json index 7144a40e42c..801c41babcd 100644 --- a/hugo/data/api/v2/translate_tags.json +++ b/hugo/data/api/v2/translate_tags.json @@ -207,6 +207,10 @@ "name": "Events", "description": "The Event Management API allows you to programmatically post events to the Events Explorer and fetch events from the Events Explorer. See the [Event Management page](https://docs.datadoghq.com/service_management/events/) for more information.\n\n**Update to Datadog monitor events `aggregation_key` starting March 1, 2025:** The Datadog monitor events `aggregation_key` is unique to each Monitor ID. Starting March 1st, this key will also include Monitor Group, making it unique per *Monitor ID and Monitor Group*. If you're using monitor events `aggregation_key` in dashboard queries or the Event API, you must migrate to use `@monitor.id`. Reach out to [support](https://www.datadoghq.com/support/) if you have any question." }, + "execution-policy": { + "name": "Execution Policy", + "description": "Execution policies control which actions Datadog Action Platform is allowed to run\nagainst your infrastructure, and where. Each policy pairs an effect (allow or deny)\nwith a pattern of actions, and can scope that decision to specific Kubernetes\nnamespaces, scripts, or remote shell paths." + }, "fastly-integration": { "name": "Fastly Integration", "description": "Manage your Datadog Fastly integration accounts and services directly through the Datadog API. See the [Fastly integration page](https://docs.datadoghq.com/integrations/fastly/) for more information."