Skip to content

Add role policy type to org group policies #4277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
api-clients-generation-pipeline merged 1 commit into from
Sep 2, 2026
Merged

Add role policy type to org group policies #4277

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 111 additions & 12 deletions .generator/schemas/v2/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1394,6 +1394,16 @@ components:
schema:
example: monitor_timezone
type: string
OrgGroupPolicyFilterPolicyType:
description: Filter policies by policy type. Supported values are `org_config` and `role`.
in: query
name: filter[policy_type]
required: false
schema:
$ref: "#/components/schemas/OrgGroupPolicyFilterPolicyTypeValue"
x-enum-varnames:
- ORG_CONFIG
- ROLE
OrgGroupPolicyId:
description: The ID of the org group policy.
in: path
Expand Down Expand Up @@ -79520,7 +79530,8 @@ components:
properties:
content:
additionalProperties: {}
description: The policy content as key-value pairs.
description: >-
The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
example:
value: "UTC"
type: object
Expand All @@ -79532,7 +79543,8 @@ components:
format: date-time
type: string
policy_name:
description: The name of the policy.
description: >-
The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role).
example: "monitor_timezone"
type: string
policy_type:
Expand Down Expand Up @@ -79612,18 +79624,20 @@ components:
- ORG_GROUP_POLICY_CONFIGS
OrgGroupPolicyCreateAttributes:
description: >-
Attributes for creating an org group policy. If `policy_type` or `enforcement_tier` are not provided, they default to `org_config` and `DEFAULT` respectively.
Attributes for creating an org group policy. If `policy_type` is not provided, it defaults to `org_config`. `enforcement_tier` is optional; if not provided, the resulting value depends on `policy_type` and is otherwise unspecified.
properties:
content:
additionalProperties: {}
description: The policy content as key-value pairs.
description: >-
The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
example:
value: "UTC"
type: object
enforcement_tier:
$ref: "#/components/schemas/OrgGroupPolicyEnforcementTier"
policy_name:
description: The name of the policy.
description: >-
The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role).
example: "monitor_timezone"
type: string
policy_type:
Expand Down Expand Up @@ -79682,9 +79696,8 @@ components:
- attributes
type: object
OrgGroupPolicyEnforcementTier:
default: OVERRIDE_ALLOWED
description: >-
The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value.
The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value. `role` policies only support `GROUP_MANAGED` and `DELEGATE` — `OVERRIDE_ALLOWED` is rejected for this policy type. Transitioning a `role` policy to `DELEGATE` (disabling it) is one-way — the policy cannot be transitioned back to `GROUP_MANAGED` afterward.
enum:
- OVERRIDE_ALLOWED
- GROUP_MANAGED
Expand All @@ -79695,6 +79708,17 @@ components:
- OVERRIDE_ALLOWED
- GROUP_MANAGED
- DELEGATE
OrgGroupPolicyFilterPolicyTypeValue:
description: >-
The type of the policy to filter by. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role.
enum:
- org_config
- role
example: org_config
type: string
x-enum-varnames:
- ORG_CONFIG
- ROLE
OrgGroupPolicyListResponse:
description: Response containing a list of org group policies.
properties:
Expand Down Expand Up @@ -79909,13 +79933,15 @@ components:
OrgGroupPolicyPolicyType:
default: org_config
description: >-
The type of the policy. Only `org_config` is supported, indicating a policy backed by an organization configuration setting.
The type of the policy. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role.
enum:
- org_config
- role
example: org_config
type: string
x-enum-varnames:
- ORG_CONFIG
- ROLE
OrgGroupPolicyRelationshipToOne:
description: Relationship to a single org group policy.
properties:
Expand Down Expand Up @@ -80056,16 +80082,23 @@ components:
x-enum-varnames:
- ORG_GROUP_POLICIES
OrgGroupPolicyUpdateAttributes:
description: Attributes for updating an org group policy.
description: >-
Attributes for updating an org group policy. `policy_name`, `content`, and `enforcement_tier` may be omitted individually to leave them unchanged.
properties:
content:
additionalProperties: {}
description: The policy content as key-value pairs.
description: >-
The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
example:
value: "UTC"
type: object
enforcement_tier:
$ref: "#/components/schemas/OrgGroupPolicyEnforcementTier"
policy_name:
description: >-
The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role). Omit to leave unchanged.
example: "monitor_timezone"
type: string
type: object
OrgGroupPolicyUpdateData:
description: Data for updating an org group policy.
Expand Down Expand Up @@ -182060,6 +182093,7 @@ paths:
parameters:
- $ref: "#/components/parameters/OrgGroupPolicyFilterOrgGroupId"
- $ref: "#/components/parameters/OrgGroupPolicyFilterPolicyName"
- $ref: "#/components/parameters/OrgGroupPolicyFilterPolicyType"
- $ref: "#/components/parameters/OrgGroupPageNumber"
- $ref: "#/components/parameters/OrgGroupPageSize"
- $ref: "#/components/parameters/PolicySort"
Expand Down Expand Up @@ -182140,7 +182174,7 @@ paths:
content:
application/json:
examples:
default:
org_config:
value:
data:
attributes:
Expand All @@ -182155,6 +182189,22 @@ paths:
id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
type: org_groups
type: org_group_policies
role:
value:
data:
attributes:
content:
permissions:
- "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
enforcement_tier: "GROUP_MANAGED"
policy_name: "finance_read_only"
policy_type: "role"
relationships:
org_group:
data:
id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
type: org_groups
type: org_group_policies
schema:
$ref: "#/components/schemas/OrgGroupPolicyCreateRequest"
required: true
Expand All @@ -182180,6 +182230,24 @@ paths:
id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
type: org_groups
type: org_group_policies
role:
value:
data:
attributes:
content:
permissions:
- "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
enforcement_tier: "GROUP_MANAGED"
modified_at: "2024-01-15T10:30:00Z"
policy_name: "finance_read_only"
policy_type: "role"
id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
relationships:
org_group:
data:
id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
type: org_groups
type: org_group_policies
schema:
$ref: "#/components/schemas/OrgGroupPolicyResponse"
description: Created
Expand Down Expand Up @@ -182336,13 +182404,25 @@ paths:
content:
application/json:
examples:
default:
org_config:
value:
data:
attributes:
content:
value: "US/Eastern"
enforcement_tier: "GROUP_MANAGED"
policy_name: "monitor_timezone"
id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
type: org_group_policies
role:
value:
data:
attributes:
content:
permissions:
- "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
- "2b3c4d5e-6f78-90ab-cdef-0123456789ab"
enforcement_tier: "GROUP_MANAGED"
id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
type: org_group_policies
schema:
Expand Down Expand Up @@ -182370,6 +182450,25 @@ paths:
id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
type: org_groups
type: org_group_policies
role:
value:
data:
attributes:
content:
permissions:
- "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
- "2b3c4d5e-6f78-90ab-cdef-0123456789ab"
enforcement_tier: "GROUP_MANAGED"
modified_at: "2024-01-16T14:00:00Z"
policy_name: "finance_read_only"
policy_type: "role"
id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
relationships:
org_group:
data:
id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
type: org_groups
type: org_group_policies
schema:
$ref: "#/components/schemas/OrgGroupPolicyResponse"
description: OK
Expand Down
3 changes: 2 additions & 1 deletion examples/v2/org-groups/UpdateOrgGroupPolicy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@ public static void main(String[] args) {
.attributes(
new OrgGroupPolicyUpdateAttributes()
.content(Map.ofEntries(Map.entry("value", "UTC")))
.enforcementTier(OrgGroupPolicyEnforcementTier.OVERRIDE_ALLOWED))
.enforcementTier(OrgGroupPolicyEnforcementTier.OVERRIDE_ALLOWED)
.policyName("monitor_timezone"))
.id(UUID.fromString("1a2b3c4d-5e6f-7890-abcd-ef0123456789"))
.type(OrgGroupPolicyType.ORG_GROUP_POLICIES));

Expand Down
21 changes: 21 additions & 0 deletions src/main/java/com/datadog/api/client/v2/api/OrgGroupsApi.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import com.datadog.api.client.v2.model.OrgGroupMembershipUpdateRequest;
import com.datadog.api.client.v2.model.OrgGroupPolicyConfigListResponse;
import com.datadog.api.client.v2.model.OrgGroupPolicyCreateRequest;
import com.datadog.api.client.v2.model.OrgGroupPolicyFilterPolicyTypeValue;
import com.datadog.api.client.v2.model.OrgGroupPolicyListResponse;
import com.datadog.api.client.v2.model.OrgGroupPolicyOverrideCreateRequest;
import com.datadog.api.client.v2.model.OrgGroupPolicyOverrideListResponse;
Expand Down Expand Up @@ -2066,6 +2067,7 @@ public ApiResponse<OrgGroupMembershipListResponse> listOrgGroupMembershipsWithHt
/** Manage optional parameters to listOrgGroupPolicies. */
public static class ListOrgGroupPoliciesOptionalParameters {
private String filterPolicyName;
private OrgGroupPolicyFilterPolicyTypeValue filterPolicyType;
private Long pageNumber;
private Long pageSize;
private OrgGroupPolicySortOption sort;
Expand All @@ -2081,6 +2083,19 @@ public ListOrgGroupPoliciesOptionalParameters filterPolicyName(String filterPoli
return this;
}

/**
* Set filterPolicyType.
*
* @param filterPolicyType Filter policies by policy type. Supported values are <code>org_config
* </code> and <code>role</code>. (optional)
* @return ListOrgGroupPoliciesOptionalParameters
*/
public ListOrgGroupPoliciesOptionalParameters filterPolicyType(
OrgGroupPolicyFilterPolicyTypeValue filterPolicyType) {
this.filterPolicyType = filterPolicyType;
return this;
}

/**
* Set pageNumber.
*
Expand Down Expand Up @@ -2222,6 +2237,7 @@ public ApiResponse<OrgGroupPolicyListResponse> listOrgGroupPoliciesWithHttpInfo(
"Missing the required parameter 'filterOrgGroupId' when calling listOrgGroupPolicies");
}
String filterPolicyName = parameters.filterPolicyName;
OrgGroupPolicyFilterPolicyTypeValue filterPolicyType = parameters.filterPolicyType;
Long pageNumber = parameters.pageNumber;
Long pageSize = parameters.pageSize;
OrgGroupPolicySortOption sort = parameters.sort;
Expand All @@ -2235,6 +2251,8 @@ public ApiResponse<OrgGroupPolicyListResponse> listOrgGroupPoliciesWithHttpInfo(
apiClient.parameterToPairs("", "filter[org_group_id]", filterOrgGroupId));
localVarQueryParams.addAll(
apiClient.parameterToPairs("", "filter[policy_name]", filterPolicyName));
localVarQueryParams.addAll(
apiClient.parameterToPairs("", "filter[policy_type]", filterPolicyType));
localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[number]", pageNumber));
localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[size]", pageSize));
localVarQueryParams.addAll(apiClient.parameterToPairs("", "sort", sort));
Expand Down Expand Up @@ -2294,6 +2312,7 @@ public ApiResponse<OrgGroupPolicyListResponse> listOrgGroupPoliciesWithHttpInfo(
return result;
}
String filterPolicyName = parameters.filterPolicyName;
OrgGroupPolicyFilterPolicyTypeValue filterPolicyType = parameters.filterPolicyType;
Long pageNumber = parameters.pageNumber;
Long pageSize = parameters.pageSize;
OrgGroupPolicySortOption sort = parameters.sort;
Expand All @@ -2307,6 +2326,8 @@ public ApiResponse<OrgGroupPolicyListResponse> listOrgGroupPoliciesWithHttpInfo(
apiClient.parameterToPairs("", "filter[org_group_id]", filterOrgGroupId));
localVarQueryParams.addAll(
apiClient.parameterToPairs("", "filter[policy_name]", filterPolicyName));
localVarQueryParams.addAll(
apiClient.parameterToPairs("", "filter[policy_type]", filterPolicyType));
localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[number]", pageNumber));
localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[size]", pageSize));
localVarQueryParams.addAll(apiClient.parameterToPairs("", "sort", sort));
Expand Down
20 changes: 13 additions & 7 deletions src/main/java/com/datadog/api/client/v2/model/OrgGroupPolicyAttributes.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,7 @@ public class OrgGroupPolicyAttributes {
private Map<String, Object> content = null;

public static final String JSON_PROPERTY_ENFORCEMENT_TIER = "enforcement_tier";
private OrgGroupPolicyEnforcementTier enforcementTier =
OrgGroupPolicyEnforcementTier.OVERRIDE_ALLOWED;
private OrgGroupPolicyEnforcementTier enforcementTier;

public static final String JSON_PROPERTY_MODIFIED_AT = "modified_at";
private OffsetDateTime modifiedAt;
Expand Down Expand Up @@ -78,7 +77,10 @@ public OrgGroupPolicyAttributes putContentItem(String key, Object contentItem) {
}

/**
* The policy content as key-value pairs.
* The policy content as key-value pairs. For <code>org_config</code> policies, an arbitrary
* key-value map (for example, <code>{"value": "UTC"}</code>). For <code>role</code> policies, a
* <code>permissions</code> key containing an array of permission UUIDs (for example, <code>
* {"permissions": ["&lt;uuid&gt;", ...]}</code>).
*
* @return content
*/
Expand All @@ -103,7 +105,10 @@ public OrgGroupPolicyAttributes enforcementTier(OrgGroupPolicyEnforcementTier en
* The enforcement tier of the policy. <code>OVERRIDE_ALLOWED</code> means the policy is set but
* member orgs may mutate it. <code>GROUP_MANAGED</code> means the policy is strictly controlled
* and mutations are blocked for affected orgs. <code>DELEGATE</code> means each member org
* controls its own value.
* controls its own value. <code>role</code> policies only support <code>GROUP_MANAGED</code> and
* <code>DELEGATE</code> — <code>OVERRIDE_ALLOWED</code> is rejected for this policy type.
* Transitioning a <code>role</code> policy to <code>DELEGATE</code> (disabling it) is one-way —
* the policy cannot be transitioned back to <code>GROUP_MANAGED</code> afterward.
*
* @return enforcementTier
*/
Expand Down Expand Up @@ -146,7 +151,8 @@ public OrgGroupPolicyAttributes policyName(String policyName) {
}

/**
* The name of the policy.
* The name of the policy. This becomes the name of the resource created across orgs in the group
* (for example, for <code>role</code> policies, the name of the created role).
*
* @return policyName
*/
Expand All @@ -167,8 +173,8 @@ public OrgGroupPolicyAttributes policyType(OrgGroupPolicyPolicyType policyType)
}

/**
* The type of the policy. Only <code>org_config</code> is supported, indicating a policy backed
* by an organization configuration setting.
* The type of the policy. <code>org_config</code> indicates a policy backed by an organization
* configuration setting. <code>role</code> indicates a policy backed by a Datadog custom role.
*
* @return policyType
*/
Expand Down
Loading
Loading