Adding all Observability Pipeline new hec_token related features into the api (#3895)

Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>

Author: api-clients-generation-pipeline[bot]

.generator/schemas/v2/openapi.yaml

@@ -44467,6 +44467,40 @@ components:
       type: string
       x-enum-varnames:
         - ELASTICSEARCH
+    ObservabilityPipelineEnrichmentTableFieldEventLookup:
+      description: Looks up a value from a field path in the log event.
+      properties:
+        event:
+          description: The path to the field in the log event to use as the lookup key.
+          example: log.user.id
+          type: string
+      required:
+        - event
+      type: object
+    ObservabilityPipelineEnrichmentTableFieldSecretLookup:
+      description: Looks up a value stored as a pipeline secret.
+      properties:
+        secret:
+          description: The name of the secret containing the lookup key value.
+          example: MY_LOOKUP_SECRET
+          type: string
+      required:
+        - secret
+      type: object
+    ObservabilityPipelineEnrichmentTableFieldStringPath:
+      description: A plain field path in the log event, used as the lookup key.
+      example: log.user.id
+      type: string
+    ObservabilityPipelineEnrichmentTableFieldVrlLookup:
+      description: Evaluates a VRL expression to produce the lookup key.
+      properties:
+        vrl:
+          description: A VRL expression that returns the value to use as the lookup key.
+          example: .log.user.id
+          type: string
+      required:
+        - vrl
+      type: object
     ObservabilityPipelineEnrichmentTableFile:
       description: Defines a static enrichment table loaded from a CSV file.
       properties:
@@ -44517,6 +44551,16 @@ components:
       type: string
       x-enum-varnames:
         - CSV
+    ObservabilityPipelineEnrichmentTableFileKeyItemField:
+      description: |-
+        Specifies the source of the key value used for enrichment table lookups.
+        Can be a plain field path string or an object specifying `event`, `vrl`, or `secret`.
+      example: log.user.id
+      oneOf:
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldStringPath"
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldEventLookup"
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldVrlLookup"
+        - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldSecretLookup"
     ObservabilityPipelineEnrichmentTableFileKeyItems:
       description: Defines how to map log fields to enrichment table columns during lookups.
       properties:
@@ -44527,9 +44571,7 @@ components:
         comparison:
           $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison"
         field:
-          description: The `items` `field`.
-          example: log.user.id
-          type: string
+          $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemField"
       required:
         - column
         - comparison
@@ -47550,6 +47592,8 @@ components:
           description: Name of the environment variable or secret that holds the Splunk HEC token.
           example: SPLUNK_HEC_TOKEN
           type: string
+        token_strategy:
+          $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationTokenStrategy"
         type:
           $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationType"
       required:
@@ -47568,6 +47612,16 @@ components:
       x-enum-varnames:
         - JSON
         - RAW_MESSAGE
+    ObservabilityPipelineSplunkHecDestinationTokenStrategy:
+      description: Controls how the Splunk HEC token is supplied. Use `custom` to provide a token with `token_key`, or `from_source` to forward the token received from an upstream Splunk HEC source.
+      enum:
+        - custom
+        - from_source
+      example: custom
+      type: string
+      x-enum-varnames:
+        - CUSTOM
+        - FROM_SOURCE
     ObservabilityPipelineSplunkHecDestinationType:
       default: splunk_hec
       description: The destination type. Always `splunk_hec`.
@@ -47591,6 +47645,12 @@ components:
           description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components).
           example: splunk-hec-source
           type: string
+        store_hec_token:
+          description: |-
+            When `true`, the Splunk HEC token from the incoming request is stored in the event metadata.
+            This allows downstream components to forward the token to other Splunk HEC destinations.
+          example: true
+          type: boolean
         tls:
           $ref: "#/components/schemas/ObservabilityPipelineTls"
         type:

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-Splunk-HEC-destination-token_strategy-returns-OK-r_276364485/frozen.json

@@ -0,0 +1 @@
+"2026-04-08T15:11:59.762Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-Splunk-HEC-destination-token_strategy-returns-OK-r_276364485/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with Splunk HEC destination token_strategy returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "71464a8fa8e1502453de0fde42aaea8c",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 553,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"splunk-hec-destination\",\"inputs\":[\"my-processor-group\"],\"token_key\":\"SPLUNK_HEC_TOKEN\",\"token_strategy\":\"custom\",\"type\":\"splunk_hec\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"id\":\"filter-processor\",\"include\":\"status:error\",\"type\":\"filter\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"Pipeline with Splunk HEC token_strategy\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 370,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-04-08T15:11:59.764Z",
+        "time": 370
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-Splunk-HEC-source-store_hec_token-returns-OK-respo_247742775/frozen.json

@@ -0,0 +1 @@
+"2026-04-08T15:11:59.370Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-Splunk-HEC-source-store_hec_token-returns-OK-respo_247742775/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with Splunk HEC source store_hec_token returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "af5cae27d9df78c907ef82b805cf3c0f",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 515,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"splunk-hec-source\"],\"processors\":[{\"enabled\":true,\"id\":\"filter-processor\",\"include\":\"status:error\",\"type\":\"filter\"}]}],\"sources\":[{\"id\":\"splunk-hec-source\",\"store_hec_token\":true,\"type\":\"splunk_hec\"}]},\"name\":\"Pipeline with Splunk HEC store_hec_token\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 369,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-04-08T15:11:59.373Z",
+        "time": 383
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-enrichment-table-secret-field-lookup-returns-OK-resp_5418750/frozen.json

@@ -0,0 +1 @@
+"2026-04-09T11:54:29.220Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-enrichment-table-secret-field-lookup-returns-OK-resp_5418750/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with enrichment table secret field lookup returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "862a8010da15d364489e4b7b8dc6e8ba",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 783,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"file\":{\"encoding\":{\"delimiter\":\",\",\"includes_headers\":true,\"type\":\"csv\"},\"key\":[{\"column\":\"user_id\",\"comparison\":\"equals\",\"field\":{\"secret\":\"LOOKUP_KEY_SECRET\"}}],\"path\":\"/etc/enrichment/lookup.csv\",\"schema\":[{\"column\":\"user_id\",\"type\":\"string\"}]},\"id\":\"enrichment-processor\",\"include\":\"*\",\"target\":\"enriched\",\"type\":\"enrichment_table\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"Pipeline with Enrichment Table Secret Field Lookup\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 370,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-04-09T11:54:30.102Z",
+        "time": 216
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

examples/v2/observability-pipelines/ValidatePipeline_1267410221.ts

@@ -0,0 +1,61 @@
+/**
+ * Validate an observability pipeline with Splunk HEC destination token_strategy returns "OK" response
+ */
+
+import { client, v2 } from "@datadog/datadog-api-client";
+
+const configuration = client.createConfiguration();
+const apiInstance = new v2.ObservabilityPipelinesApi(configuration);
+
+const params: v2.ObservabilityPipelinesApiValidatePipelineRequest = {
+  body: {
+    data: {
+      attributes: {
+        config: {
+          destinations: [
+            {
+              id: "splunk-hec-destination",
+              inputs: ["my-processor-group"],
+              type: "splunk_hec",
+              tokenKey: "SPLUNK_HEC_TOKEN",
+              tokenStrategy: "custom",
+            },
+          ],
+          processorGroups: [
+            {
+              enabled: true,
+              id: "my-processor-group",
+              include: "service:my-service",
+              inputs: ["datadog-agent-source"],
+              processors: [
+                {
+                  enabled: true,
+                  id: "filter-processor",
+                  include: "status:error",
+                  type: "filter",
+                },
+              ],
+            },
+          ],
+          sources: [
+            {
+              id: "datadog-agent-source",
+              type: "datadog_agent",
+            },
+          ],
+        },
+        name: "Pipeline with Splunk HEC token_strategy",
+      },
+      type: "pipelines",
+    },
+  },
+};
+
+apiInstance
+  .validatePipeline(params)
+  .then((data: v2.ValidationResponse) => {
+    console.log(
+      "API called successfully. Returned data: " + JSON.stringify(data)
+    );
+  })
+  .catch((error: any) => console.error(error));