{"openapi":"3.1.0","info":{"title":"Datadog Security Monitoring (BYOK) API","version":"0.1.0","description":"Datadog Security Monitoring (BYOK) lets an AI assistant read your own Datadog Security Monitoring data through the Datadog Security Monitoring API with a key you supply (Datadog API key (US1 site, datadoghq.com)). Read-only: 7 tools (list_rules, get_rule, list_suppressions, list_security_filters, get_content_pack_states, list_critical_assets, list_signal_notification_rules). The BYOK key travels...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-datadog-security.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-datadog-security/docs"},"termsOfService":"https://connectorbay.com/byok-datadog-security/terms"},"servers":[{"url":"https://byok-datadog-security.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-datadog-security/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_rules":{"post":{"operationId":"list_rules","summary":"List security detection rules with name, type, enabled and default flags, tags, version and message. Filter with a query","description":"List security detection rules with name, type, enabled and default flags, tags, version and message. Filter with a query on type, source or tags and sort by name, date, severity or type. Use for \"Which Datadog security detection rules are enabled for Okta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"query":{"anyOf":[{"maxLength":300,"type":"string"},{"type":"null"}],"default":null,"description":"Filter, for example 'type:log_detection' or 'source:okta' or 'tags:cloud_provider:aws'.","title":"Query"},"sort":{"anyOf":[{"enum":["name","creation_date","update_date","enabled","type","highest_severity","source","-name","-creation_date","-update_date","-enabled","-type","-highest_severity","-source"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort attribute; prefix with - for descending.","title":"Sort"},"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"Items per page (1 to 100, default 10).","title":"Page Size"},"page_number":{"anyOf":[{"maximum":10000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Page number, starting at 0.","title":"Page Number"}},"title":"list_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_rule":{"post":{"operationId":"get_rule","summary":"Get one detection rule by id with its message, tags, severity cases (condition, status, notifications) and queries. Use ","description":"Get one detection rule by id with its message, tags, severity cases (condition, status, notifications) and queries. Use for \"Show the Datadog security rule abc-def-ghi\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"rule_id":{"description":"Rule id from list_rules, for example 'abc-def-ghi'.","maxLength":60,"title":"Rule Id","type":"string"}},"required":["rule_id"],"title":"get_ruleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_suppressions":{"post":{"operationId":"list_suppressions","summary":"List suppression rules that silence matching detection signals: name, queries, enabled flag, start and expiry dates (Uni","description":"List suppression rules that silence matching detection signals: name, queries, enabled flag, start and expiry dates (Unix ms). Creator names are left out. Use for \"Which Datadog security suppressions are active\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"query":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Filter text.","title":"Query"},"sort":{"anyOf":[{"enum":["name","start_date","expiration_date","update_date","enabled","-name","-start_date","-expiration_date","-update_date","-creation_date","-enabled"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort attribute; prefix with - for descending.","title":"Sort"},"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"Items per page (1 to 100, default 10).","title":"Page Size"},"page_number":{"anyOf":[{"maximum":10000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Page number, starting at 0.","title":"Page Number"}},"title":"list_suppressionsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_security_filters":{"post":{"operationId":"list_security_filters","summary":"List Cloud SIEM security filters: name, query, filtered data type, enabled and built-in flags, exclusion filters. Use fo","description":"List Cloud SIEM security filters: name, query, filtered data type, enabled and built-in flags, exclusion filters. Use for \"Which Datadog security filters are enabled\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_security_filtersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_content_pack_states":{"post":{"operationId":"get_content_pack_states","summary":"Show the activation state of every Cloud SIEM content pack (integration status and log collection status) plus the SIEM ","description":"Show the activation state of every Cloud SIEM content pack (integration status and log collection status) plus the SIEM retention and SKU. Use for \"Which Cloud SIEM content packs are active in Datadog\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"get_content_pack_statesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_critical_assets":{"post":{"operationId":"list_critical_assets","summary":"List critical assets whose signals get raised severity: query, rule query, severity, tags and enabled flag. Creator name","description":"List critical assets whose signals get raised severity: query, rule query, severity, tags and enabled flag. Creator names are left out. Use for \"Which assets does Datadog Cloud SIEM treat as critical\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_critical_assetsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_signal_notification_rules":{"post":{"operationId":"list_signal_notification_rules","summary":"List notification rules for security signals: name, enabled flag, selectors (query, rule types, severities), targets and","description":"List notification rules for security signals: name, enabled flag, selectors (query, rule types, severities), targets and time aggregation. Use for \"Where does Datadog send security signal notifications\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_signal_notification_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}