Adding Observability Pipelines Secret Management feature support

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-destination-secret-key-returns-OK-response_1497740330/frozen.json

@@ -0,0 +1 @@
+"2026-02-20T14:42:05.988Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-destination-secret-key-returns-OK-response_1497740330/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with destination secret key returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "c01ed7042c1eca7eb2709abf07f54e60",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 526,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"endpoint_url_key\":\"SUMO_LOGIC_ENDPOINT_URL\",\"id\":\"sumo-logic-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"sumo_logic\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"id\":\"filter-processor\",\"include\":\"status:error\",\"type\":\"filter\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"Pipeline with Secret Key\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 370,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-02-20T14:42:05.991Z",
+        "time": 369
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-source-secret-key-returns-OK-response_3962960055/frozen.json

@@ -0,0 +1 @@
+"2026-02-20T14:42:32.372Z"

cassettes/v2/Observability-Pipelines_4170000189/Validate-an-observability-pipeline-with-source-secret-key-returns-OK-response_3962960055/recording.har

@@ -0,0 +1,67 @@
+{
+  "log": {
+    "_recordingName": "Observability Pipelines/Validate an observability pipeline with source secret key returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "abf3ef3d218bce08cf81f3126665181b",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 608,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 583,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"id\":\"datadog-logs-destination\",\"inputs\":[\"my-processor-group\"],\"type\":\"datadog_logs\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"http-client-source\"],\"processors\":[{\"enabled\":true,\"id\":\"filter-processor\",\"include\":\"status:error\",\"type\":\"filter\"}]}],\"sources\":[{\"auth_strategy\":\"bearer\",\"decoding\":\"bytes\",\"id\":\"http-client-source\",\"scrape_interval_secs\":15,\"scrape_timeout_secs\":5,\"token_key\":\"HTTP_CLIENT_TOKEN\",\"type\":\"http_client\"}]},\"name\":\"Pipeline with Source Secret\"},\"type\":\"pipelines\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate"
+        },
+        "response": {
+          "bodySize": 14,
+          "content": {
+            "mimeType": "application/vnd.api+json",
+            "size": 14,
+            "text": "{\"errors\":[]}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/vnd.api+json"
+            }
+          ],
+          "headersSize": 370,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-02-20T14:42:32.375Z",
+        "time": 375
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

examples/v2/observability-pipelines/ValidatePipeline_1330454428.ts

@@ -0,0 +1,60 @@
+/**
+ * Validate an observability pipeline with destination secret key returns "OK" response
+ */
+
+import { client, v2 } from "@datadog/datadog-api-client";
+
+const configuration = client.createConfiguration();
+const apiInstance = new v2.ObservabilityPipelinesApi(configuration);
+
+const params: v2.ObservabilityPipelinesApiValidatePipelineRequest = {
+  body: {
+    data: {
+      attributes: {
+        config: {
+          destinations: [
+            {
+              id: "sumo-logic-destination",
+              inputs: ["my-processor-group"],
+              type: "sumo_logic",
+              endpointUrlKey: "SUMO_LOGIC_ENDPOINT_URL",
+            },
+          ],
+          processorGroups: [
+            {
+              enabled: true,
+              id: "my-processor-group",
+              include: "service:my-service",
+              inputs: ["datadog-agent-source"],
+              processors: [
+                {
+                  enabled: true,
+                  id: "filter-processor",
+                  include: "status:error",
+                  type: "filter",
+                },
+              ],
+            },
+          ],
+          sources: [
+            {
+              id: "datadog-agent-source",
+              type: "datadog_agent",
+            },
+          ],
+        },
+        name: "Pipeline with Secret Key",
+      },
+      type: "pipelines",
+    },
+  },
+};
+
+apiInstance
+  .validatePipeline(params)
+  .then((data: v2.ValidationResponse) => {
+    console.log(
+      "API called successfully. Returned data: " + JSON.stringify(data)
+    );
+  })
+  .catch((error: any) => console.error(error));

examples/v2/observability-pipelines/ValidatePipeline_2899320203.ts

@@ -0,0 +1,64 @@
+/**
+ * Validate an observability pipeline with source secret key returns "OK" response
+ */
+
+import { client, v2 } from "@datadog/datadog-api-client";
+
+const configuration = client.createConfiguration();
+const apiInstance = new v2.ObservabilityPipelinesApi(configuration);
+
+const params: v2.ObservabilityPipelinesApiValidatePipelineRequest = {
+  body: {
+    data: {
+      attributes: {
+        config: {
+          destinations: [
+            {
+              id: "datadog-logs-destination",
+              inputs: ["my-processor-group"],
+              type: "datadog_logs",
+            },
+          ],
+          processorGroups: [
+            {
+              enabled: true,
+              id: "my-processor-group",
+              include: "service:my-service",
+              inputs: ["http-client-source"],
+              processors: [
+                {
+                  enabled: true,
+                  id: "filter-processor",
+                  include: "status:error",
+                  type: "filter",
+                },
+              ],
+            },
+          ],
+          sources: [
+            {
+              id: "http-client-source",
+              type: "http_client",
+              decoding: "bytes",
+              scrapeIntervalSecs: 15,
+              scrapeTimeoutSecs: 5,
+              authStrategy: "bearer",
+              tokenKey: "HTTP_CLIENT_TOKEN",
+            },
+          ],
+        },
+        name: "Pipeline with Source Secret",
+      },
+      type: "pipelines",
+    },
+  },
+};
+
+apiInstance
+  .validatePipeline(params)
+  .then((data: v2.ValidationResponse) => {
+    console.log(
+      "API called successfully. Returned data: " + JSON.stringify(data)
+    );
+  })
+  .catch((error: any) => console.error(error));

features/v2/observability_pipelines.feature

@@ -190,3 +190,19 @@ Feature: Observability Pipelines
     When the request is sent
     Then the response status is 200 OK
     And the response "errors" has length 0
+
+  @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with destination secret key returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "sumo-logic-destination", "inputs": ["my-processor-group"], "type": "sumo_logic", "endpoint_url_key": "SUMO_LOGIC_ENDPOINT_URL"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "Pipeline with Secret Key"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0
+
+  @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with source secret key returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["http-client-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "http-client-source", "type": "http_client", "decoding": "bytes", "scrape_interval_secs": 15, "scrape_timeout_secs": 5, "auth_strategy": "bearer", "token_key": "HTTP_CLIENT_TOKEN"}]}, "name": "Pipeline with Source Secret"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0

packages/datadog-api-client-v2/index.ts

@@ -3684,6 +3684,7 @@ export { ObservabilityPipelineDedupeProcessorType } from "./models/Observability
 export { ObservabilityPipelineDiskBufferOptions } from "./models/ObservabilityPipelineDiskBufferOptions";
 export { ObservabilityPipelineElasticsearchDestination } from "./models/ObservabilityPipelineElasticsearchDestination";
 export { ObservabilityPipelineElasticsearchDestinationApiVersion } from "./models/ObservabilityPipelineElasticsearchDestinationApiVersion";
+export { ObservabilityPipelineElasticsearchDestinationAuth } from "./models/ObservabilityPipelineElasticsearchDestinationAuth";
 export { ObservabilityPipelineElasticsearchDestinationDataStream } from "./models/ObservabilityPipelineElasticsearchDestinationDataStream";
 export { ObservabilityPipelineElasticsearchDestinationType } from "./models/ObservabilityPipelineElasticsearchDestinationType";
 export { ObservabilityPipelineEnrichmentTableFile } from "./models/ObservabilityPipelineEnrichmentTableFile";

packages/datadog-api-client-v2/models/AzureStorageDestination.ts

@@ -22,6 +22,10 @@ export class AzureStorageDestination {
    * Configuration for buffer settings on destination components.
    */
   "buffer"?: ObservabilityPipelineBufferOptions;
+  /**
+   * Name of the environment variable or secret that holds the Azure Storage connection string.
+   */
+  "connectionStringKey"?: string;
   /**
    * The name of the Azure Blob Storage container to store logs in.
    */
@@ -63,6 +67,10 @@ export class AzureStorageDestination {
       baseName: "buffer",
       type: "ObservabilityPipelineBufferOptions",
     },
+    connectionStringKey: {
+      baseName: "connection_string_key",
+      type: "string",
+    },
     containerName: {
       baseName: "container_name",
       type: "string",

packages/datadog-api-client-v2/models/MicrosoftSentinelDestination.ts

@@ -22,6 +22,14 @@ export class MicrosoftSentinelDestination {
    * Azure AD client ID used for authentication.
    */
   "clientId": string;
+  /**
+   * Name of the environment variable or secret that holds the Azure AD client secret.
+   */
+  "clientSecretKey"?: string;
+  /**
+   * Name of the environment variable or secret that holds the Data Collection Endpoint (DCE) URI.
+   */
+  "dceUriKey"?: string;
   /**
    * The immutable ID of the Data Collection Rule (DCR).
    */
@@ -72,6 +80,14 @@ export class MicrosoftSentinelDestination {
       type: "string",
       required: true,
     },
+    clientSecretKey: {
+      baseName: "client_secret_key",
+      type: "string",
+    },
+    dceUriKey: {
+      baseName: "dce_uri_key",
+      type: "string",
+    },
     dcrImmutableId: {
       baseName: "dcr_immutable_id",
       type: "string",

packages/datadog-api-client-v2/models/ObjectSerializer.ts

@@ -1925,6 +1925,7 @@ import { ObservabilityPipelineDedupeProcessor } from "./ObservabilityPipelineDed
 import { ObservabilityPipelineDedupeProcessorCache } from "./ObservabilityPipelineDedupeProcessorCache";
 import { ObservabilityPipelineDiskBufferOptions } from "./ObservabilityPipelineDiskBufferOptions";
 import { ObservabilityPipelineElasticsearchDestination } from "./ObservabilityPipelineElasticsearchDestination";
+import { ObservabilityPipelineElasticsearchDestinationAuth } from "./ObservabilityPipelineElasticsearchDestinationAuth";
 import { ObservabilityPipelineElasticsearchDestinationDataStream } from "./ObservabilityPipelineElasticsearchDestinationDataStream";
 import { ObservabilityPipelineEnrichmentTableFile } from "./ObservabilityPipelineEnrichmentTableFile";
 import { ObservabilityPipelineEnrichmentTableFileEncoding } from "./ObservabilityPipelineEnrichmentTableFileEncoding";
@@ -7529,6 +7530,8 @@ const typeMap: { [index: string]: any } = {
     ObservabilityPipelineDiskBufferOptions,
   ObservabilityPipelineElasticsearchDestination:
     ObservabilityPipelineElasticsearchDestination,
+  ObservabilityPipelineElasticsearchDestinationAuth:
+    ObservabilityPipelineElasticsearchDestinationAuth,
   ObservabilityPipelineElasticsearchDestinationDataStream:
     ObservabilityPipelineElasticsearchDestinationDataStream,
   ObservabilityPipelineEnrichmentTableFile:

packages/datadog-api-client-v2/models/ObservabilityPipelineAmazonDataFirehoseSource.ts

@@ -15,6 +15,10 @@ import { AttributeTypeMap } from "../../datadog-api-client-common/util";
  * **Supported pipeline types:** logs
  */
 export class ObservabilityPipelineAmazonDataFirehoseSource {
+  /**
+   * Name of the environment variable or secret that holds the Firehose delivery stream address.
+   */
+  "addressKey"?: string;
   /**
    * AWS authentication credentials used for accessing AWS services such as S3.
    * If omitted, the system’s default credentials are used (for example, the IAM role and environment variables).
@@ -49,6 +53,10 @@ export class ObservabilityPipelineAmazonDataFirehoseSource {
    * @ignore
    */
   static readonly attributeTypeMap: AttributeTypeMap = {
+    addressKey: {
+      baseName: "address_key",
+      type: "string",
+    },
     auth: {
       baseName: "auth",
       type: "ObservabilityPipelineAwsAuth",