Adding all Observability Pipeline new hec_token related features into the api (#3212)

Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>

Author: api-clients-generation-pipeline[bot]

.generator/schemas/v2/openapi.yaml

@@ -44467,6 +44467,40 @@ components:
       type: string
       x-enum-varnames:
         - ELASTICSEARCH
+    ObservabilityPipelineEnrichmentTableFieldEventLookup:
+      description: Looks up a value from a field path in the log event.
+      properties:
+        event:
+          description: The path to the field in the log event to use as the lookup key.
+          example: log.user.id
+          type: string
+      required:
+        - event
+      type: object
+    ObservabilityPipelineEnrichmentTableFieldSecretLookup:
+      description: Looks up a value stored as a pipeline secret.
+      properties:
+        secret:
+          description: The name of the secret containing the lookup key value.
+          example: MY_LOOKUP_SECRET
+          type: string
+      required:
+        - secret
+      type: object
+    ObservabilityPipelineEnrichmentTableFieldStringPath:
+      description: A plain field path in the log event, used as the lookup key.
+      example: log.user.id
+      type: string
+    ObservabilityPipelineEnrichmentTableFieldVrlLookup:
+      description: Evaluates a VRL expression to produce the lookup key.
+      properties:
+        vrl:
+          description: A VRL expression that returns the value to use as the lookup key.
+          example: .log.user.id
+          type: string
+      required:
+        - vrl
+      type: object
     ObservabilityPipelineEnrichmentTableFile:
       description: Defines a static enrichment table loaded from a CSV file.
       properties:
@@ -44517,6 +44551,16 @@ components:
       type: string
       x-enum-varnames:
         - CSV
+    ObservabilityPipelineEnrichmentTableFileKeyItemField:
+      description: |-
+        Specifies the source of the key value used for enrichment table lookups.
+        Can be a plain field path string or an object specifying `event`, `vrl`, or `secret`.
+      example: log.user.id
+      oneOf:
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldStringPath"
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldEventLookup"
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldVrlLookup"
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldSecretLookup"
     ObservabilityPipelineEnrichmentTableFileKeyItems:
       description: Defines how to map log fields to enrichment table columns during lookups.
       properties:
@@ -44527,9 +44571,7 @@ components:
         comparison:
           $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison"
         field:
-          description: The `items` `field`.
-          example: log.user.id
-          type: string
+          $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemField"
       required:
         - column
         - comparison
@@ -47550,6 +47592,8 @@ components:
           description: Name of the environment variable or secret that holds the Splunk HEC token.
           example: SPLUNK_HEC_TOKEN
           type: string
+        token_strategy:
+          $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationTokenStrategy"
         type:
           $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationType"
       required:
@@ -47568,6 +47612,16 @@ components:
       x-enum-varnames:
         - JSON
         - RAW_MESSAGE
+    ObservabilityPipelineSplunkHecDestinationTokenStrategy:
+      description: Controls how the Splunk HEC token is supplied. Use `custom` to provide a token with `token_key`, or `from_source` to forward the token received from an upstream Splunk HEC source.
+      enum:
+        - custom
+        - from_source
+      example: custom
+      type: string
+      x-enum-varnames:
+        - CUSTOM
+        - FROM_SOURCE
     ObservabilityPipelineSplunkHecDestinationType:
       default: splunk_hec
       description: The destination type. Always `splunk_hec`.
@@ -47591,6 +47645,12 @@ components:
           description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components).
           example: splunk-hec-source
           type: string
+        store_hec_token:
+          description: |-
+            When `true`, the Splunk HEC token from the incoming request is stored in the event metadata.
+            This allows downstream components to forward the token to other Splunk HEC destinations.
+          example: true
+          type: boolean
         tls:
           $ref: "#/components/schemas/ObservabilityPipelineTls"
         type:

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-destination-token-strategy-returns-OK-response.frozen

@@ -0,0 +1 @@
+2026-04-08T15:11:59.762Z

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-destination-token-strategy-returns-OK-response.yml

@@ -0,0 +1 @@
+2026-04-08T15:11:59.370Z

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-source-store-hec-token-returns-OK-response.frozen

@@ -0,0 +1 @@
+2026-04-09T11:54:29.220Z

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-source-store-hec-token-returns-OK-response.yml

@@ -0,0 +1,51 @@
+# Validate an observability pipeline with Splunk HEC destination token_strategy returns "OK" response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::ObservabilityPipelinesAPI.new
+
+body = DatadogAPIClient::V2::ObservabilityPipelineSpec.new({
+  data: DatadogAPIClient::V2::ObservabilityPipelineSpecData.new({
+    attributes: DatadogAPIClient::V2::ObservabilityPipelineDataAttributes.new({
+      config: DatadogAPIClient::V2::ObservabilityPipelineConfig.new({
+        destinations: [
+          DatadogAPIClient::V2::ObservabilityPipelineSplunkHecDestination.new({
+            id: "splunk-hec-destination",
+            inputs: [
+              "my-processor-group",
+            ],
+            type: DatadogAPIClient::V2::ObservabilityPipelineSplunkHecDestinationType::SPLUNK_HEC,
+            token_key: "SPLUNK_HEC_TOKEN",
+            token_strategy: DatadogAPIClient::V2::ObservabilityPipelineSplunkHecDestinationTokenStrategy::CUSTOM,
+          }),
+        ],
+        processor_groups: [
+          DatadogAPIClient::V2::ObservabilityPipelineConfigProcessorGroup.new({
+            enabled: true,
+            id: "my-processor-group",
+            include: "service:my-service",
+            inputs: [
+              "datadog-agent-source",
+            ],
+            processors: [
+              DatadogAPIClient::V2::ObservabilityPipelineFilterProcessor.new({
+                enabled: true,
+                id: "filter-processor",
+                include: "status:error",
+                type: DatadogAPIClient::V2::ObservabilityPipelineFilterProcessorType::FILTER,
+              }),
+            ],
+          }),
+        ],
+        sources: [
+          DatadogAPIClient::V2::ObservabilityPipelineDatadogAgentSource.new({
+            id: "datadog-agent-source",
+            type: DatadogAPIClient::V2::ObservabilityPipelineDatadogAgentSourceType::DATADOG_AGENT,
+          }),
+        ],
+      }),
+      name: "Pipeline with Splunk HEC token_strategy",
+    }),
+    type: "pipelines",
+  }),
+})
+p api_instance.validate_pipeline(body)

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-enrichment-table-secret-field-lookup-returns-OK-response.frozen

@@ -0,0 +1,50 @@
+# Validate an observability pipeline with Splunk HEC source store_hec_token returns "OK" response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::ObservabilityPipelinesAPI.new
+
+body = DatadogAPIClient::V2::ObservabilityPipelineSpec.new({
+  data: DatadogAPIClient::V2::ObservabilityPipelineSpecData.new({
+    attributes: DatadogAPIClient::V2::ObservabilityPipelineDataAttributes.new({
+      config: DatadogAPIClient::V2::ObservabilityPipelineConfig.new({
+        destinations: [
+          DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestination.new({
+            id: "datadog-logs-destination",
+            inputs: [
+              "my-processor-group",
+            ],
+            type: DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestinationType::DATADOG_LOGS,
+          }),
+        ],
+        processor_groups: [
+          DatadogAPIClient::V2::ObservabilityPipelineConfigProcessorGroup.new({
+            enabled: true,
+            id: "my-processor-group",
+            include: "service:my-service",
+            inputs: [
+              "splunk-hec-source",
+            ],
+            processors: [
+              DatadogAPIClient::V2::ObservabilityPipelineFilterProcessor.new({
+                enabled: true,
+                id: "filter-processor",
+                include: "status:error",
+                type: DatadogAPIClient::V2::ObservabilityPipelineFilterProcessorType::FILTER,
+              }),
+            ],
+          }),
+        ],
+        sources: [
+          DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSource.new({
+            id: "splunk-hec-source",
+            type: DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSourceType::SPLUNK_HEC,
+            store_hec_token: true,
+          }),
+        ],
+      }),
+      name: "Pipeline with Splunk HEC store_hec_token",
+    }),
+    type: "pipelines",
+  }),
+})
+p api_instance.validate_pipeline(body)

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-enrichment-table-secret-field-lookup-returns-OK-response.yml

@@ -0,0 +1,73 @@
+# Validate an observability pipeline with enrichment table secret field lookup returns "OK" response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::ObservabilityPipelinesAPI.new
+
+body = DatadogAPIClient::V2::ObservabilityPipelineSpec.new({
+  data: DatadogAPIClient::V2::ObservabilityPipelineSpecData.new({
+    attributes: DatadogAPIClient::V2::ObservabilityPipelineDataAttributes.new({
+      config: DatadogAPIClient::V2::ObservabilityPipelineConfig.new({
+        destinations: [
+          DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestination.new({
+            id: "datadog-logs-destination",
+            inputs: [
+              "my-processor-group",
+            ],
+            type: DatadogAPIClient::V2::ObservabilityPipelineDatadogLogsDestinationType::DATADOG_LOGS,
+          }),
+        ],
+        processor_groups: [
+          DatadogAPIClient::V2::ObservabilityPipelineConfigProcessorGroup.new({
+            enabled: true,
+            id: "my-processor-group",
+            include: "service:my-service",
+            inputs: [
+              "datadog-agent-source",
+            ],
+            processors: [
+              DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableProcessor.new({
+                enabled: true,
+                id: "enrichment-processor",
+                include: "*",
+                target: "enriched",
+                type: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableProcessorType::ENRICHMENT_TABLE,
+                file: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFile.new({
+                  encoding: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFileEncoding.new({
+                    delimiter: ",",
+                    type: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFileEncodingType::CSV,
+                    includes_headers: true,
+                  }),
+                  key: [
+                    DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFileKeyItems.new({
+                      column: "user_id",
+                      comparison: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFileKeyItemsComparison::EQUALS,
+                      field: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFieldSecretLookup.new({
+                        secret: "LOOKUP_KEY_SECRET",
+                      }),
+                    }),
+                  ],
+                  path: "/etc/enrichment/lookup.csv",
+                  schema: [
+                    DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFileSchemaItems.new({
+                      column: "user_id",
+                      type: DatadogAPIClient::V2::ObservabilityPipelineEnrichmentTableFileSchemaItemsType::STRING,
+                    }),
+                  ],
+                }),
+              }),
+            ],
+          }),
+        ],
+        sources: [
+          DatadogAPIClient::V2::ObservabilityPipelineDatadogAgentSource.new({
+            id: "datadog-agent-source",
+            type: DatadogAPIClient::V2::ObservabilityPipelineDatadogAgentSourceType::DATADOG_AGENT,
+          }),
+        ],
+      }),
+      name: "Pipeline with Enrichment Table Secret Field Lookup",
+    }),
+    type: "pipelines",
+  }),
+})
+p api_instance.validate_pipeline(body)