Datadog API — Agent

naftiko: 1.0.0-alpha2
info:
  label: Datadog API — Agent
  description: 'Datadog API — Agent. 10 operations. Lead operation: Datadog Get All Workload Protection Agent Rules. Self-contained
    Naftiko capability covering one Datadog business surface.'
  tags:
  - Datadog
  - Agent
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    DATADOG_API_KEY: DATADOG_API_KEY
capability:
  consumes:
  - type: http
    namespace: datadog-agent
    baseUri: https://{subdomain}.{site}
    description: Datadog API — Agent business capability. Self-contained, no shared references.
    resources:
    - name: api-v2-remote_config-products-cws-agent_rules
      path: /api/v2/remote_config/products/cws/agent_rules
      operations:
      - name: listcsmthreatsagentrules
        method: GET
        description: Datadog Get All Workload Protection Agent Rules
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createcsmthreatsagentrule
        method: POST
        description: Datadog Create a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-remote_config-products-cws-agent_rules-agent_rule_id
      path: /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}
      operations:
      - name: deletecsmthreatsagentrule
        method: DELETE
        description: Datadog Delete a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: getcsmthreatsagentrule
        method: GET
        description: Datadog Get a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatecsmthreatsagentrule
        method: PATCH
        description: Datadog Update a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-security_monitoring-cloud_workload_security-agent_rules
      path: /api/v2/security_monitoring/cloud_workload_security/agent_rules
      operations:
      - name: listcloudworkloadsecurityagentrules
        method: GET
        description: Datadog Get All Workload Protection Agent Rules (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createcloudworkloadsecurityagentrule
        method: POST
        description: Datadog Create a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-security_monitoring-cloud_workload_security-agent_rules-agent_rule_id
      path: /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}
      operations:
      - name: deletecloudworkloadsecurityagentrule
        method: DELETE
        description: Datadog Delete a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: getcloudworkloadsecurityagentrule
        method: GET
        description: Datadog Get a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatecloudworkloadsecurityagentrule
        method: PATCH
        description: Datadog Update a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    authentication:
      type: bearer
      token: '{{env.DATADOG_API_KEY}}'
  exposes:
  - type: rest
    namespace: datadog-agent-rest
    port: 8080
    description: REST adapter for Datadog API — Agent. One Spectral-compliant resource per consumed operation, prefixed with
      /v1.
    resources:
    - path: /v1/api/v2/remote-config/products/cws/agent-rules
      name: api-v2-remote-config-products-cws-agent-rules
      description: REST surface for api-v2-remote_config-products-cws-agent_rules.
      operations:
      - method: GET
        name: listcsmthreatsagentrules
        description: Datadog Get All Workload Protection Agent Rules
        call: datadog-agent.listcsmthreatsagentrules
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: createcsmthreatsagentrule
        description: Datadog Create a Workload Protection Agent Rule
        call: datadog-agent.createcsmthreatsagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/remote-config/products/cws/agent-rules/{agent-rule-id}
      name: api-v2-remote-config-products-cws-agent-rules-agent-rule-id
      description: REST surface for api-v2-remote_config-products-cws-agent_rules-agent_rule_id.
      operations:
      - method: DELETE
        name: deletecsmthreatsagentrule
        description: Datadog Delete a Workload Protection Agent Rule
        call: datadog-agent.deletecsmthreatsagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: GET
        name: getcsmthreatsagentrule
        description: Datadog Get a Workload Protection Agent Rule
        call: datadog-agent.getcsmthreatsagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: updatecsmthreatsagentrule
        description: Datadog Update a Workload Protection Agent Rule
        call: datadog-agent.updatecsmthreatsagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/security-monitoring/cloud-workload-security/agent-rules
      name: api-v2-security-monitoring-cloud-workload-security-agent-rules
      description: REST surface for api-v2-security_monitoring-cloud_workload_security-agent_rules.
      operations:
      - method: GET
        name: listcloudworkloadsecurityagentrules
        description: Datadog Get All Workload Protection Agent Rules (us1-fed)
        call: datadog-agent.listcloudworkloadsecurityagentrules
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: createcloudworkloadsecurityagentrule
        description: Datadog Create a Workload Protection Agent Rule (us1-fed)
        call: datadog-agent.createcloudworkloadsecurityagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/security-monitoring/cloud-workload-security/agent-rules/{agent-rule-id}
      name: api-v2-security-monitoring-cloud-workload-security-agent-rules-agent-rule-id
      description: REST surface for api-v2-security_monitoring-cloud_workload_security-agent_rules-agent_rule_id.
      operations:
      - method: DELETE
        name: deletecloudworkloadsecurityagentrule
        description: Datadog Delete a Workload Protection Agent Rule (us1-fed)
        call: datadog-agent.deletecloudworkloadsecurityagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: GET
        name: getcloudworkloadsecurityagentrule
        description: Datadog Get a Workload Protection Agent Rule (us1-fed)
        call: datadog-agent.getcloudworkloadsecurityagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: updatecloudworkloadsecurityagentrule
        description: Datadog Update a Workload Protection Agent Rule (us1-fed)
        call: datadog-agent.updatecloudworkloadsecurityagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: datadog-agent-mcp
    port: 9090
    transport: http
    description: MCP adapter for Datadog API — Agent. One tool per consumed operation, routed inline through this capability's
      consumes block.
    tools:
    - name: datadog-get-all-workload-protection
      description: Datadog Get All Workload Protection Agent Rules
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-agent.listcsmthreatsagentrules
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-create-workload-protection-agent
      description: Datadog Create a Workload Protection Agent Rule
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: datadog-agent.createcsmthreatsagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-delete-workload-protection-agent
      description: Datadog Delete a Workload Protection Agent Rule
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: datadog-agent.deletecsmthreatsagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-workload-protection-agent
      description: Datadog Get a Workload Protection Agent Rule
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-agent.getcsmthreatsagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-update-workload-protection-agent
      description: Datadog Update a Workload Protection Agent Rule
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: datadog-agent.updatecsmthreatsagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-all-workload-protection-2
      description: Datadog Get All Workload Protection Agent Rules (us1-fed)
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-agent.listcloudworkloadsecurityagentrules
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-create-workload-protection-agent-2
      description: Datadog Create a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: datadog-agent.createcloudworkloadsecurityagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-delete-workload-protection-agent-2
      description: Datadog Delete a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: datadog-agent.deletecloudworkloadsecurityagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-workload-protection-agent-2
      description: Datadog Get a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-agent.getcloudworkloadsecurityagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-update-workload-protection-agent-2
      description: Datadog Update a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: datadog-agent.updatecloudworkloadsecurityagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.