Skip to content

Commit 6ea3b58

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Adding valid tokens to Splunk and HTTP server source (#3311)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 2ea50d9 commit 6ea3b58

17 files changed

Lines changed: 1074 additions & 6 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54251,6 +54251,16 @@ components:
5425154251
description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `plain`).
5425254252
example: HTTP_AUTH_USERNAME
5425354253
type: string
54254+
valid_tokens:
54255+
description: |-
54256+
A list of tokens that are accepted for authenticating incoming HTTP requests. When set,
54257+
the source rejects any request whose token does not match an enabled entry in this list.
54258+
Cannot be combined with the `plain` auth strategy.
54259+
items:
54260+
$ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidToken"
54261+
maxItems: 1000
54262+
minItems: 1
54263+
type: array
5425454264
required:
5425554265
- id
5425654266
- type
@@ -54276,6 +54286,55 @@ components:
5427654286
type: string
5427754287
x-enum-varnames:
5427854288
- HTTP_SERVER
54289+
ObservabilityPipelineHttpServerSourceValidToken:
54290+
description: An accepted token used to authenticate incoming HTTP server requests.
54291+
properties:
54292+
enabled:
54293+
default: true
54294+
description: |-
54295+
Indicates whether this token is currently accepted. Disabled tokens are rejected without
54296+
being removed from the configuration.
54297+
example: true
54298+
type: boolean
54299+
field_to_add:
54300+
$ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd"
54301+
path_to_token:
54302+
$ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToToken"
54303+
token_key:
54304+
description: Name of the environment variable or secret that holds the expected token value.
54305+
example: HTTP_SERVER_TOKEN
54306+
pattern: "^[A-Za-z0-9_]+$"
54307+
type: string
54308+
required:
54309+
- token_key
54310+
type: object
54311+
ObservabilityPipelineHttpServerSourceValidTokenPathToToken:
54312+
description: |-
54313+
Specifies where the worker extracts the token from in the incoming HTTP request.
54314+
This can be either a built-in location (`path` or `address`) or an HTTP header object.
54315+
oneOf:
54316+
- $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation"
54317+
- $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader"
54318+
ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader:
54319+
description: Extract the token from a specific HTTP request header.
54320+
properties:
54321+
header:
54322+
description: The name of the HTTP header that carries the token.
54323+
example: X-Token
54324+
type: string
54325+
required:
54326+
- header
54327+
type: object
54328+
ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation:
54329+
description: Built-in token location on the incoming HTTP request.
54330+
enum:
54331+
- path
54332+
- address
54333+
example: path
54334+
type: string
54335+
x-enum-varnames:
54336+
- PATH
54337+
- ADDRESS
5427954338
ObservabilityPipelineKafkaDestination:
5428054339
description: |-
5428154340
The `kafka` destination sends logs to Apache Kafka topics.
@@ -56299,6 +56358,27 @@ components:
5629956358
type: string
5630056359
x-enum-varnames:
5630156360
- SOCKET
56361+
ObservabilityPipelineSourceValidTokenFieldToAdd:
56362+
description: |-
56363+
An optional metadata field that is attached to every event authenticated by the
56364+
associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
56365+
properties:
56366+
key:
56367+
description: The metadata field name to add to incoming events.
56368+
example: token_name
56369+
maxLength: 256
56370+
pattern: "^[A-Za-z0-9_]+$"
56371+
type: string
56372+
value:
56373+
description: The metadata field value to add to incoming events.
56374+
example: my_token
56375+
maxLength: 1024
56376+
pattern: "^[A-Za-z0-9_]+$"
56377+
type: string
56378+
required:
56379+
- key
56380+
- value
56381+
type: object
5630256382
ObservabilityPipelineSpec:
5630356383
description: Input schema representing an observability pipeline configuration. Used in create and validate requests.
5630456384
properties:
@@ -56495,6 +56575,15 @@ components:
5649556575
$ref: "#/components/schemas/ObservabilityPipelineTls"
5649656576
type:
5649756577
$ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceType"
56578+
valid_tokens:
56579+
description: |-
56580+
A list of tokens that are accepted for authenticating incoming HEC requests. When set, the source
56581+
rejects any request whose HEC token does not match an enabled entry in this list.
56582+
items:
56583+
$ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceValidToken"
56584+
maxItems: 1000
56585+
minItems: 1
56586+
type: array
5649856587
required:
5649956588
- id
5650056589
- type
@@ -56509,6 +56598,26 @@ components:
5650956598
type: string
5651056599
x-enum-varnames:
5651156600
- SPLUNK_HEC
56601+
ObservabilityPipelineSplunkHecSourceValidToken:
56602+
description: An accepted HEC token used to authenticate incoming Splunk HEC requests.
56603+
properties:
56604+
enabled:
56605+
default: true
56606+
description: |-
56607+
Indicates whether this token is currently accepted. Disabled tokens are rejected without
56608+
being removed from the configuration.
56609+
example: true
56610+
type: boolean
56611+
field_to_add:
56612+
$ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd"
56613+
token_key:
56614+
description: Name of the environment variable or secret that holds the expected HEC token value.
56615+
example: SPLUNK_HEC_TOKEN
56616+
pattern: "^[A-Za-z0-9_]+$"
56617+
type: string
56618+
required:
56619+
- token_key
56620+
type: object
5651256621
ObservabilityPipelineSplunkTcpSource:
5651356622
description: |-
5651456623
The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.

‎cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-HTTP-server-source-valid-tokens-returns-OK-response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-05-18T16:51:43.688Z

‎cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-HTTP-server-source-valid-tokens-returns-OK-response.yml‎

Lines changed: 27 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-source-valid-tokens-returns-OK-response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-05-18T16:51:43.307Z

‎cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-source-valid-tokens-returns-OK-response.yml‎

Lines changed: 27 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/v2/observability-pipelines/ValidatePipeline_1130701356.rb‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Validate an observability pipeline with Splunk HEC source valid_tokens returns "OK" response
2+
3+
require "datadog_api_client"
4+
api_instance = DatadogAPIClient::V2::ObservabilityPipelinesAPI.new
5+
6+
body = DatadogAPIClient::V2::ObservabilityPipelineSpec.new({
7+
data: DatadogAPIClient::V2::ObservabilityPipelineSpecData.new({
8+
attributes: DatadogAPIClient::V2::ObservabilityPipelineDataAttributes.new({
9+
config: DatadogAPIClient::V2::ObservabilityPipelineConfig.new({
10+
destinations: [
11+
DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestination.new({
12+
id: "datadog-logs-destination",
13+
inputs: [
14+
"my-processor-group",
15+
],
16+
type: DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestinationType::DATADOG_LOGS,
17+
}),
18+
],
19+
processor_groups: [
20+
DatadogAPIClient::V2::ObservabilityPipelineConfigProcessorGroup.new({
21+
enabled: true,
22+
id: "my-processor-group",
23+
include: "service:my-service",
24+
inputs: [
25+
"splunk-hec-source",
26+
],
27+
processors: [
28+
DatadogAPIClient::V2::ObservabilityPipelineFilterProcessor.new({
29+
enabled: true,
30+
id: "filter-processor",
31+
include: "status:error",
32+
type: DatadogAPIClient::V2::ObservabilityPipelineFilterProcessorType::FILTER,
33+
}),
34+
],
35+
}),
36+
],
37+
sources: [
38+
DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSource.new({
39+
id: "splunk-hec-source",
40+
type: DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSourceType::SPLUNK_HEC,
41+
valid_tokens: [
42+
DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSourceValidToken.new({
43+
token_key: "SPLUNK_HEC_TOKEN",
44+
enabled: true,
45+
field_to_add: DatadogAPIClient::V2::ObservabilityPipelineSourceValidTokenFieldToAdd.new({
46+
key: "token_name",
47+
value: "primary_token",
48+
}),
49+
}),
50+
DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSourceValidToken.new({
51+
token_key: "SPLUNK_HEC_TOKEN_BACKUP",
52+
enabled: false,
53+
}),
54+
],
55+
}),
56+
],
57+
}),
58+
name: "Pipeline with Splunk HEC valid_tokens",
59+
}),
60+
type: "pipelines",
61+
}),
62+
})
63+
p api_instance.validate_pipeline(body)

‎examples/v2/observability-pipelines/ValidatePipeline_1785209526.rb‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Validate an observability pipeline with HTTP server source valid_tokens returns "OK" response
2+
3+
require "datadog_api_client"
4+
api_instance = DatadogAPIClient::V2::ObservabilityPipelinesAPI.new
5+
6+
body = DatadogAPIClient::V2::ObservabilityPipelineSpec.new({
7+
data: DatadogAPIClient::V2::ObservabilityPipelineSpecData.new({
8+
attributes: DatadogAPIClient::V2::ObservabilityPipelineDataAttributes.new({
9+
config: DatadogAPIClient::V2::ObservabilityPipelineConfig.new({
10+
destinations: [
11+
DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestination.new({
12+
id: "datadog-logs-destination",
13+
inputs: [
14+
"my-processor-group",
15+
],
16+
type: DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestinationType::DATADOG_LOGS,
17+
}),
18+
],
19+
processor_groups: [
20+
DatadogAPIClient::V2::ObservabilityPipelineConfigProcessorGroup.new({
21+
enabled: true,
22+
id: "my-processor-group",
23+
include: "service:my-service",
24+
inputs: [
25+
"http-server-source",
26+
],
27+
processors: [
28+
DatadogAPIClient::V2::ObservabilityPipelineFilterProcessor.new({
29+
enabled: true,
30+
id: "filter-processor",
31+
include: "status:error",
32+
type: DatadogAPIClient::V2::ObservabilityPipelineFilterProcessorType::FILTER,
33+
}),
34+
],
35+
}),
36+
],
37+
sources: [
38+
DatadogAPIClient::V2::ObservabilityPipelineHttpServerSource.new({
39+
id: "http-server-source",
40+
type: DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceType::HTTP_SERVER,
41+
auth_strategy: DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceAuthStrategy::NONE,
42+
decoding: DatadogAPIClient::V2::ObservabilityPipelineDecoding::DECODE_JSON,
43+
valid_tokens: [
44+
DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceValidToken.new({
45+
token_key: "HTTP_SERVER_TOKEN",
46+
enabled: true,
47+
path_to_token: DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader.new({
48+
header: "X-Token",
49+
}),
50+
field_to_add: DatadogAPIClient::V2::ObservabilityPipelineSourceValidTokenFieldToAdd.new({
51+
key: "token_name",
52+
value: "primary_token",
53+
}),
54+
}),
55+
DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceValidToken.new({
56+
token_key: "HTTP_SERVER_TOKEN_BACKUP",
57+
enabled: true,
58+
path_to_token: DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation::PATH,
59+
}),
60+
],
61+
}),
62+
],
63+
}),
64+
name: "Pipeline with HTTP server valid_tokens",
65+
}),
66+
type: "pipelines",
67+
}),
68+
})
69+
p api_instance.validate_pipeline(body)

‎features/v2/observability_pipelines.feature‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,14 @@ Feature: Observability Pipelines
176176
Then the response status is 200 OK
177177
And the response "errors" has length 0
178178

179+
@team:DataDog/observability-pipelines
180+
Scenario: Validate an observability pipeline with HTTP server source valid_tokens returns "OK" response
181+
Given new "ValidatePipeline" request
182+
And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["http-server-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "http-server-source", "type": "http_server", "auth_strategy": "none", "decoding": "json", "valid_tokens": [{"token_key": "HTTP_SERVER_TOKEN", "enabled": true, "path_to_token": {"header": "X-Token"}, "field_to_add": {"key": "token_name", "value": "primary_token"}}, {"token_key": "HTTP_SERVER_TOKEN_BACKUP", "enabled": true, "path_to_token": "path"}]}]}, "name": "Pipeline with HTTP server valid_tokens"}, "type": "pipelines"}}
183+
When the request is sent
184+
Then the response status is 200 OK
185+
And the response "errors" has length 0
186+
179187
@team:DataDog/observability-pipelines
180188
Scenario: Validate an observability pipeline with OCSF mapper custom mapping returns "OK" response
181189
Given new "ValidatePipeline" request
@@ -223,6 +231,14 @@ Feature: Observability Pipelines
223231
Then the response status is 200 OK
224232
And the response "errors" has length 0
225233

234+
@team:DataDog/observability-pipelines
235+
Scenario: Validate an observability pipeline with Splunk HEC source valid_tokens returns "OK" response
236+
Given new "ValidatePipeline" request
237+
And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["splunk-hec-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "splunk-hec-source", "type": "splunk_hec", "valid_tokens": [{"token_key": "SPLUNK_HEC_TOKEN", "enabled": true, "field_to_add": {"key": "token_name", "value": "primary_token"}}, {"token_key": "SPLUNK_HEC_TOKEN_BACKUP", "enabled": false}]}]}, "name": "Pipeline with Splunk HEC valid_tokens"}, "type": "pipelines"}}
238+
When the request is sent
239+
Then the response status is 200 OK
240+
And the response "errors" has length 0
241+
226242
@team:DataDog/observability-pipelines
227243
Scenario: Validate an observability pipeline with amazon S3 source compression returns "OK" response
228244
Given new "ValidatePipeline" request

‎lib/datadog_api_client/inflector.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4420,6 +4420,10 @@ def overrides
44204420
"v2.observability_pipeline_http_server_source" => "ObservabilityPipelineHttpServerSource",
44214421
"v2.observability_pipeline_http_server_source_auth_strategy" => "ObservabilityPipelineHttpServerSourceAuthStrategy",
44224422
"v2.observability_pipeline_http_server_source_type" => "ObservabilityPipelineHttpServerSourceType",
4423+
"v2.observability_pipeline_http_server_source_valid_token" => "ObservabilityPipelineHttpServerSourceValidToken",
4424+
"v2.observability_pipeline_http_server_source_valid_token_path_to_token" => "ObservabilityPipelineHttpServerSourceValidTokenPathToToken",
4425+
"v2.observability_pipeline_http_server_source_valid_token_path_to_token_header" => "ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader",
4426+
"v2.observability_pipeline_http_server_source_valid_token_path_to_token_location" => "ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation",
44234427
"v2.observability_pipeline_kafka_destination" => "ObservabilityPipelineKafkaDestination",
44244428
"v2.observability_pipeline_kafka_destination_compression" => "ObservabilityPipelineKafkaDestinationCompression",
44254429
"v2.observability_pipeline_kafka_destination_encoding" => "ObservabilityPipelineKafkaDestinationEncoding",
@@ -4545,6 +4549,7 @@ def overrides
45454549
"v2.observability_pipeline_socket_source_framing_octet_counting_method" => "ObservabilityPipelineSocketSourceFramingOctetCountingMethod",
45464550
"v2.observability_pipeline_socket_source_mode" => "ObservabilityPipelineSocketSourceMode",
45474551
"v2.observability_pipeline_socket_source_type" => "ObservabilityPipelineSocketSourceType",
4552+
"v2.observability_pipeline_source_valid_token_field_to_add" => "ObservabilityPipelineSourceValidTokenFieldToAdd",
45484553
"v2.observability_pipeline_spec" => "ObservabilityPipelineSpec",
45494554
"v2.observability_pipeline_spec_data" => "ObservabilityPipelineSpecData",
45504555
"v2.observability_pipeline_split_array_processor" => "ObservabilityPipelineSplitArrayProcessor",
@@ -4556,6 +4561,7 @@ def overrides
45564561
"v2.observability_pipeline_splunk_hec_destination_type" => "ObservabilityPipelineSplunkHecDestinationType",
45574562
"v2.observability_pipeline_splunk_hec_source" => "ObservabilityPipelineSplunkHecSource",
45584563
"v2.observability_pipeline_splunk_hec_source_type" => "ObservabilityPipelineSplunkHecSourceType",
4564+
"v2.observability_pipeline_splunk_hec_source_valid_token" => "ObservabilityPipelineSplunkHecSourceValidToken",
45594565
"v2.observability_pipeline_splunk_tcp_source" => "ObservabilityPipelineSplunkTcpSource",
45604566
"v2.observability_pipeline_splunk_tcp_source_type" => "ObservabilityPipelineSplunkTcpSourceType",
45614567
"v2.observability_pipeline_sumo_logic_destination" => "ObservabilityPipelineSumoLogicDestination",

0 commit comments

Comments
 (0)