Datadog/security Suppressions
Datadog Security Suppressions — suppression rule management
2026.10.21.1
Changed: The README now shows how to store the API key and application key
in a datadog vault and wire them with ${{ vault.get("datadog", "API_KEY") }}
and ${{ vault.get("datadog", "APP_KEY") }}. The previous example passed
DD_API_KEY and DD_APP_KEY as literal global arguments, which swamp rejects
for sensitive arguments.
Changed: The apiKey and appKey descriptions now say to supply them with
a vault.get expression. Both were already marked sensitive.
Upgrade note: Documentation and argument descriptions only. Methods, arguments, resource schemas and stored data are unchanged.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| apiKey | string | Datadog API key (DD-API-KEY). Wire it with ${{ vault.get("datadog", "API_KEY") }}; never pass the literal value. |
| appKey | string | Datadog application key (DD-APPLICATION-KEY). Wire it with ${{ vault.get("datadog", "APP_KEY") }}; never pass the literal value. |
| site? | enum | Datadog site |
| Argument | Type | Description |
|---|---|---|
| query? | string | Query string. |
| sort? | string | Attribute used to sort the list of suppression rules. Prefix with `-` to sort... |
| Argument | Type | Description |
|---|---|---|
| data_exclusion_query? | string | An exclusion query on the input data of the security rules, which could be lo... |
| description? | string | A description for the suppression rule. |
| enabled | boolean | Whether the suppression rule is enabled. |
| expiration_date? | number | A Unix millisecond timestamp giving an expiration date for the suppression ru... |
| name | string | The name of the suppression rule. |
| rule_query | string | The rule query of the suppression rule, with the same syntax as the search ba... |
| start_date? | number | A Unix millisecond timestamp giving the start date for the suppression rule. ... |
| suppression_query? | string | The suppression query of the suppression rule. If a signal matches this query... |
| tags? | array | List of tags associated with the suppression rule. |
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
| Argument | Type | Description |
|---|---|---|
| data_exclusion_query? | string | An exclusion query on the input data of the security rules, which could be lo... |
| description? | string | A description for the suppression rule. |
| enabled | boolean | Whether the suppression rule is enabled. |
| expiration_date? | number | A Unix millisecond timestamp giving an expiration date for the suppression ru... |
| name | string | The name of the suppression rule. |
| rule_query | string | The rule query of the suppression rule, with the same syntax as the search ba... |
| start_date? | number | A Unix millisecond timestamp giving the start date for the suppression rule. ... |
| suppression_query? | string | The suppression query of the suppression rule. If a signal matches this query... |
| tags? | array | List of tags associated with the suppression rule. |
| Argument | Type | Description |
|---|---|---|
| suppression_id | string | The ID of the suppression rule |
| Argument | Type | Description |
|---|---|---|
| suppression_id | string | The ID of the suppression rule |
| data_exclusion_query? | string | An exclusion query on the input data of the security rules, which could be lo... |
| description? | string | A description for the suppression rule. |
| enabled? | boolean | Whether the suppression rule is enabled. |
| expiration_date? | number | A Unix millisecond timestamp giving an expiration date for the suppression ru... |
| name? | string | The name of the suppression rule. |
| rule_query? | string | The rule query of the suppression rule, with the same syntax as the search ba... |
| start_date? | number | A Unix millisecond timestamp giving the start date for the suppression rule. ... |
| suppression_query? | string | The suppression query of the suppression rule. If a signal matches this query... |
| tags? | array | List of tags associated with the suppression rule. |
| version? | number | The current version of the suppression. This is optional, but it can help pre... |
| Argument | Type | Description |
|---|---|---|
| suppression_id | string | The ID of the suppression rule |
| Argument | Type | Description |
|---|---|---|
| suppression_id | string | The ID of the suppression rule |
Resources
2026.10.15.1
Changed: Generated tests now include one execution test per method, so every method is covered. Nothing behavioral changed in the model code, schemas or resources.
2026.10.14.1
Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.
Upgrade note: Metadata only. No code, schema, or behavioral changes.
2026.10.07.1
Fixed: The shared API helper no longer throws on a successful response with an empty body (such as 202 Accepted); it returns an empty result. Paginated list requests tolerate an empty page body the same way. A body that is not valid JSON now fails with an error naming the HTTP method, path, and status, with a snippet of the body.
Upgrade note: Only the shared helper changed. No methods, arguments, schemas, or resources changed, so no migration is needed and existing stored resources remain valid.
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.08.1
Added: Initial code-generated release of @webframp/datadog/security-suppressions with 9 methods covering the Datadog security suppressions API surface.
2026.09.08.1
Added: Initial code-generated release of @webframp/datadog/security-suppressions with 9 methods covering the Datadog security suppressions API surface.
2026.08.28.2
Hardened codegen: instance names sanitized against path traversal; string schema patterns emit regex validation; output schemas passthrough unknown fields.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.24.1
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.21.2
Changed: Error messages and input validation are more specific.
- API errors now name the HTTP method and path that was attempted (e.g.
Datadog API HTTP 404: GET /api/v2/security_monitoring/configuration/suppressions/abc-123) instead of just the raw status code and response body. - A network-level failure (DNS error, connection reset, timeout) reaching the
Datadog API now raises
Datadog API request failed: <METHOD> <path>: <reason>instead of an unlabeled fetch error. suppression_idis now rejected up front if empty on every method that takes it, instead of building a malformed request path.get_suppressions_affecting_future_rulenow rejects an emptycasesorqueriesarray before making a request, instead of letting Datadog return an opaque validation error for a rule preview with no cases or queries.
No changes to request/response shapes or existing successful-path behavior.
2026.08.21.1
Changed: Tightened and clarified Zod schemas as part of a repo-wide schema audit.
- Added
.min(1)toapiKeyandappKeyin the global arguments schema — both are sent directly as request headers, and an empty value would never be accepted by the Datadog API. - Added descriptions to previously undocumented
options,schedulingOptions, andtypearguments onget_suppressions_affecting_future_rule.
No behavioral changes — these are documentation and validation tightenings only.
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-suppressions with 9 methods covering the Datadog security suppressions API surface.
2026.08.21.1
Changed: Tightened and clarified Zod schemas as part of a repo-wide schema audit.
- Added
.min(1)toapiKeyandappKeyin the global arguments schema — both are sent directly as request headers, and an empty value would never be accepted by the Datadog API. - Added descriptions to previously undocumented
options,schedulingOptions, andtypearguments onget_suppressions_affecting_future_rule.
No behavioral changes — these are documentation and validation tightenings only.
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-suppressions with 9 methods covering the Datadog security suppressions API surface.
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-suppressions with 9 methods covering the Datadog security suppressions API surface.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned