Datadog API — Protections

naftiko: 1.0.0-alpha2
info:
  label: Datadog API — Protections
  description: 'Datadog API — Protections. 17 operations. Lead operation: Datadog Get All Workload Protection Agent Rules.
    Self-contained Naftiko capability covering one Datadog business surface.'
  tags:
  - Datadog
  - Protections
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    DATADOG_API_KEY: DATADOG_API_KEY
capability:
  consumes:
  - type: http
    namespace: datadog-protections
    baseUri: https://{subdomain}.{site}
    description: Datadog API — Protections business capability. Self-contained, no shared references.
    resources:
    - name: api-v2-remote_config-products-cws-agent_rules
      path: /api/v2/remote_config/products/cws/agent_rules
      operations:
      - name: listcsmthreatsagentrules
        method: GET
        description: Datadog Get All Workload Protection Agent Rules
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createcsmthreatsagentrule
        method: POST
        description: Datadog Create a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-remote_config-products-cws-agent_rules-agent_rule_id
      path: /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}
      operations:
      - name: deletecsmthreatsagentrule
        method: DELETE
        description: Datadog Delete a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: getcsmthreatsagentrule
        method: GET
        description: Datadog Get a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatecsmthreatsagentrule
        method: PATCH
        description: Datadog Update a Workload Protection Agent Rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-remote_config-products-cws-policy
      path: /api/v2/remote_config/products/cws/policy
      operations:
      - name: listcsmthreatsagentpolicies
        method: GET
        description: Datadog Get All Workload Protection Policies
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createcsmthreatsagentpolicy
        method: POST
        description: Datadog Create a Workload Protection Policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-remote_config-products-cws-policy-download
      path: /api/v2/remote_config/products/cws/policy/download
      operations:
      - name: downloadcsmthreatspolicy
        method: GET
        description: Datadog Download the Workload Protection Policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v2-remote_config-products-cws-policy-policy_id
      path: /api/v2/remote_config/products/cws/policy/{policy_id}
      operations:
      - name: deletecsmthreatsagentpolicy
        method: DELETE
        description: Datadog Delete a Workload Protection Policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: getcsmthreatsagentpolicy
        method: GET
        description: Datadog Get a Workload Protection Policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatecsmthreatsagentpolicy
        method: PATCH
        description: Datadog Update a Workload Protection Policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-security-cloud_workload-policy-download
      path: /api/v2/security/cloud_workload/policy/download
      operations:
      - name: downloadcloudworkloadpolicyfile
        method: GET
        description: Datadog Download the Workload Protection Policy (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v2-security_monitoring-cloud_workload_security-agent_rules
      path: /api/v2/security_monitoring/cloud_workload_security/agent_rules
      operations:
      - name: listcloudworkloadsecurityagentrules
        method: GET
        description: Datadog Get All Workload Protection Agent Rules (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createcloudworkloadsecurityagentrule
        method: POST
        description: Datadog Create a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: api-v2-security_monitoring-cloud_workload_security-agent_rules-agent_rule_id
      path: /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}
      operations:
      - name: deletecloudworkloadsecurityagentrule
        method: DELETE
        description: Datadog Delete a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: getcloudworkloadsecurityagentrule
        method: GET
        description: Datadog Get a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatecloudworkloadsecurityagentrule
        method: PATCH
        description: Datadog Update a Workload Protection Agent Rule (us1-fed)
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    authentication:
      type: bearer
      token: '{{env.DATADOG_API_KEY}}'
  exposes:
  - type: rest
    namespace: datadog-protections-rest
    port: 8080
    description: REST adapter for Datadog API — Protections. One Spectral-compliant resource per consumed operation, prefixed
      with /v1.
    resources:
    - path: /v1/api/v2/remote-config/products/cws/agent-rules
      name: api-v2-remote-config-products-cws-agent-rules
      description: REST surface for api-v2-remote_config-products-cws-agent_rules.
      operations:
      - method: GET
        name: listcsmthreatsagentrules
        description: Datadog Get All Workload Protection Agent Rules
        call: datadog-protections.listcsmthreatsagentrules
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: createcsmthreatsagentrule
        description: Datadog Create a Workload Protection Agent Rule
        call: datadog-protections.createcsmthreatsagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/remote-config/products/cws/agent-rules/{agent-rule-id}
      name: api-v2-remote-config-products-cws-agent-rules-agent-rule-id
      description: REST surface for api-v2-remote_config-products-cws-agent_rules-agent_rule_id.
      operations:
      - method: DELETE
        name: deletecsmthreatsagentrule
        description: Datadog Delete a Workload Protection Agent Rule
        call: datadog-protections.deletecsmthreatsagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: GET
        name: getcsmthreatsagentrule
        description: Datadog Get a Workload Protection Agent Rule
        call: datadog-protections.getcsmthreatsagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: updatecsmthreatsagentrule
        description: Datadog Update a Workload Protection Agent Rule
        call: datadog-protections.updatecsmthreatsagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/remote-config/products/cws/policy
      name: api-v2-remote-config-products-cws-policy
      description: REST surface for api-v2-remote_config-products-cws-policy.
      operations:
      - method: GET
        name: listcsmthreatsagentpolicies
        description: Datadog Get All Workload Protection Policies
        call: datadog-protections.listcsmthreatsagentpolicies
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: createcsmthreatsagentpolicy
        description: Datadog Create a Workload Protection Policy
        call: datadog-protections.createcsmthreatsagentpolicy
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/remote-config/products/cws/policy/download
      name: api-v2-remote-config-products-cws-policy-download
      description: REST surface for api-v2-remote_config-products-cws-policy-download.
      operations:
      - method: GET
        name: downloadcsmthreatspolicy
        description: Datadog Download the Workload Protection Policy
        call: datadog-protections.downloadcsmthreatspolicy
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/remote-config/products/cws/policy/{policy-id}
      name: api-v2-remote-config-products-cws-policy-policy-id
      description: REST surface for api-v2-remote_config-products-cws-policy-policy_id.
      operations:
      - method: DELETE
        name: deletecsmthreatsagentpolicy
        description: Datadog Delete a Workload Protection Policy
        call: datadog-protections.deletecsmthreatsagentpolicy
        outputParameters:
        - type: object
          mapping: $.
      - method: GET
        name: getcsmthreatsagentpolicy
        description: Datadog Get a Workload Protection Policy
        call: datadog-protections.getcsmthreatsagentpolicy
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: updatecsmthreatsagentpolicy
        description: Datadog Update a Workload Protection Policy
        call: datadog-protections.updatecsmthreatsagentpolicy
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/security/cloud-workload/policy/download
      name: api-v2-security-cloud-workload-policy-download
      description: REST surface for api-v2-security-cloud_workload-policy-download.
      operations:
      - method: GET
        name: downloadcloudworkloadpolicyfile
        description: Datadog Download the Workload Protection Policy (us1-fed)
        call: datadog-protections.downloadcloudworkloadpolicyfile
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/security-monitoring/cloud-workload-security/agent-rules
      name: api-v2-security-monitoring-cloud-workload-security-agent-rules
      description: REST surface for api-v2-security_monitoring-cloud_workload_security-agent_rules.
      operations:
      - method: GET
        name: listcloudworkloadsecurityagentrules
        description: Datadog Get All Workload Protection Agent Rules (us1-fed)
        call: datadog-protections.listcloudworkloadsecurityagentrules
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: createcloudworkloadsecurityagentrule
        description: Datadog Create a Workload Protection Agent Rule (us1-fed)
        call: datadog-protections.createcloudworkloadsecurityagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/v2/security-monitoring/cloud-workload-security/agent-rules/{agent-rule-id}
      name: api-v2-security-monitoring-cloud-workload-security-agent-rules-agent-rule-id
      description: REST surface for api-v2-security_monitoring-cloud_workload_security-agent_rules-agent_rule_id.
      operations:
      - method: DELETE
        name: deletecloudworkloadsecurityagentrule
        description: Datadog Delete a Workload Protection Agent Rule (us1-fed)
        call: datadog-protections.deletecloudworkloadsecurityagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: GET
        name: getcloudworkloadsecurityagentrule
        description: Datadog Get a Workload Protection Agent Rule (us1-fed)
        call: datadog-protections.getcloudworkloadsecurityagentrule
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: updatecloudworkloadsecurityagentrule
        description: Datadog Update a Workload Protection Agent Rule (us1-fed)
        call: datadog-protections.updatecloudworkloadsecurityagentrule
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: datadog-protections-mcp
    port: 9090
    transport: http
    description: MCP adapter for Datadog API — Protections. One tool per consumed operation, routed inline through this capability's
      consumes block.
    tools:
    - name: datadog-get-all-workload-protection
      description: Datadog Get All Workload Protection Agent Rules
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.listcsmthreatsagentrules
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-create-workload-protection-agent
      description: Datadog Create a Workload Protection Agent Rule
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: datadog-protections.createcsmthreatsagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-delete-workload-protection-agent
      description: Datadog Delete a Workload Protection Agent Rule
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: datadog-protections.deletecsmthreatsagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-workload-protection-agent
      description: Datadog Get a Workload Protection Agent Rule
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.getcsmthreatsagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-update-workload-protection-agent
      description: Datadog Update a Workload Protection Agent Rule
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: datadog-protections.updatecsmthreatsagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-all-workload-protection-2
      description: Datadog Get All Workload Protection Policies
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.listcsmthreatsagentpolicies
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-create-workload-protection-policy
      description: Datadog Create a Workload Protection Policy
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: datadog-protections.createcsmthreatsagentpolicy
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-download-workload-protection-policy
      description: Datadog Download the Workload Protection Policy
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.downloadcsmthreatspolicy
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-delete-workload-protection-policy
      description: Datadog Delete a Workload Protection Policy
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: datadog-protections.deletecsmthreatsagentpolicy
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-workload-protection-policy
      description: Datadog Get a Workload Protection Policy
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.getcsmthreatsagentpolicy
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-update-workload-protection-policy
      description: Datadog Update a Workload Protection Policy
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: datadog-protections.updatecsmthreatsagentpolicy
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-download-workload-protection-policy-2
      description: Datadog Download the Workload Protection Policy (us1-fed)
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.downloadcloudworkloadpolicyfile
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-all-workload-protection-3
      description: Datadog Get All Workload Protection Agent Rules (us1-fed)
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.listcloudworkloadsecurityagentrules
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-create-workload-protection-agent-2
      description: Datadog Create a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: datadog-protections.createcloudworkloadsecurityagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-delete-workload-protection-agent-2
      description: Datadog Delete a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: datadog-protections.deletecloudworkloadsecurityagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-get-workload-protection-agent-2
      description: Datadog Get a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: datadog-protections.getcloudworkloadsecurityagentrule
      outputParameters:
      - type: object
        mapping: $.
    - name: datadog-update-workload-protection-agent-2
      description: Datadog Update a Workload Protection Agent Rule (us1-fed)
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: datadog-protections.updatecloudworkloadsecurityagentrule
      with:
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.