Generate API Spec for Log Restriction Queries

features/v2/given.json

@@ -651,6 +651,19 @@
     "tag": "Logs Metrics",
     "operationId": "CreateLogsMetric"
   },
+  {
+    "parameters": [
+      {
+        "name": "body",
+        "origin": "request",
+        "value": "{\n  \"data\": {\n    \"type\": \"logs_restriction_queries\",\n    \"attributes\": {\n      \"restriction_query\": \"env:staging\"\n    }\n  }\n}"
+      }
+    ],
+    "step": "there is a valid \"restriction_query\" in the system",
+    "key": "restriction_query",
+    "tag": "Logs Restriction Queries",
+    "operationId": "CreateRestrictionQuery"
+  },
   {
     "parameters": [
       {

features/v2/undo.json

@@ -2377,6 +2377,73 @@
       "type": "idempotent"
     }
   },
+  "ListRestrictionQueries": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "CreateRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "operationId": "DeleteRestrictionQuery",
+      "parameters": [
+        {
+          "name": "restriction_query_id",
+          "source": "data.id"
+        }
+      ],
+      "type": "unsafe"
+    }
+  },
+  "GetRoleRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "ListUserRestrictionQueries": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "DeleteRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
+  "GetRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "UpdateRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
+  "RemoveRoleFromRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
+  "ListRestrictionQueryRoles": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "AddRoleToRestrictionQuery": {
+    "tag": "Logs Restriction Queries",
+    "undo": {
+      "type": "safe"
+    }
+  },
   "ListLogsGet": {
     "tag": "Logs",
     "undo": {

packages/datadog-api-client/README.md

@@ -398,6 +398,7 @@ apiInstance
 | Logs Indexes | @datadog/datadog-api-client-logs-indexes | [README.md](../../services/logs-indexes/README.md) |
 | Logs Metrics | @datadog/datadog-api-client-logs-metrics | [README.md](../../services/logs-metrics/README.md) |
 | Logs Pipelines | @datadog/datadog-api-client-logs-pipelines | [README.md](../../services/logs-pipelines/README.md) |
+| Logs Restriction Queries | @datadog/datadog-api-client-logs-restriction-queries | [README.md](../../services/logs-restriction-queries/README.md) |
 | Metrics | @datadog/datadog-api-client-metrics | [README.md](../../services/metrics/README.md) |
 | Microsoft Teams Integration | @datadog/datadog-api-client-microsoft-teams-integration | [README.md](../../services/microsoft-teams-integration/README.md) |
 | Monitors | @datadog/datadog-api-client-monitors | [README.md](../../services/monitors/README.md) |

private/bdd_runner/src/support/scenarios_model_mapping.ts

@@ -6677,6 +6677,100 @@ export const ScenariosModelMappings: { [key: string]: OperationMapping } = {
     },
     operationResponseType: "LogsMetricResponse",
   },
+  "LogsRestrictionQueriesApi.V2.ListRestrictionQueries": {
+    pageSize: {
+      type: "number",
+      format: "int64",
+    },
+    pageNumber: {
+      type: "number",
+      format: "int64",
+    },
+    operationResponseType: "RestrictionQueryListResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.CreateRestrictionQuery": {
+    body: {
+      type: "RestrictionQueryCreatePayload",
+      format: "",
+    },
+    operationResponseType: "RestrictionQueryWithoutRelationshipsResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.GetRoleRestrictionQuery": {
+    roleId: {
+      type: "string",
+      format: "",
+    },
+    operationResponseType: "RestrictionQueryListResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.ListUserRestrictionQueries": {
+    userId: {
+      type: "string",
+      format: "",
+    },
+    operationResponseType: "RestrictionQueryListResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.GetRestrictionQuery": {
+    restrictionQueryId: {
+      type: "string",
+      format: "",
+    },
+    operationResponseType: "RestrictionQueryWithRelationshipsResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.DeleteRestrictionQuery": {
+    restrictionQueryId: {
+      type: "string",
+      format: "",
+    },
+    operationResponseType: "{}",
+  },
+  "LogsRestrictionQueriesApi.V2.UpdateRestrictionQuery": {
+    restrictionQueryId: {
+      type: "string",
+      format: "",
+    },
+    body: {
+      type: "RestrictionQueryUpdatePayload",
+      format: "",
+    },
+    operationResponseType: "RestrictionQueryWithoutRelationshipsResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.ListRestrictionQueryRoles": {
+    restrictionQueryId: {
+      type: "string",
+      format: "",
+    },
+    pageSize: {
+      type: "number",
+      format: "int64",
+    },
+    pageNumber: {
+      type: "number",
+      format: "int64",
+    },
+    operationResponseType: "RestrictionQueryRolesResponse",
+  },
+  "LogsRestrictionQueriesApi.V2.AddRoleToRestrictionQuery": {
+    restrictionQueryId: {
+      type: "string",
+      format: "",
+    },
+    body: {
+      type: "RelationshipToRole",
+      format: "",
+    },
+    operationResponseType: "{}",
+  },
+  "LogsRestrictionQueriesApi.V2.RemoveRoleFromRestrictionQuery": {
+    restrictionQueryId: {
+      type: "string",
+      format: "",
+    },
+    body: {
+      type: "RelationshipToRole",
+      format: "",
+    },
+    operationResponseType: "{}",
+  },
   "MetricsApi.V2.ListTagConfigurations": {
     filterConfigured: {
       type: "boolean",

services/logs_restriction_queries/.yarnrc.yml

@@ -0,0 +1 @@
+nodeLinker: node-modules

services/logs_restriction_queries/README.md

@@ -0,0 +1,59 @@
+# @datadog/datadog-api-client-logs-restriction-queries
+
+## Description
+
+**Note: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).**
+
+A Restriction Query is a logs query that restricts which logs the `logs_read_data` permission grants read access to.
+For users whose roles have Restriction Queries, any log query they make only returns those log events that also match
+one of their Restriction Queries. This is true whether the user queries log events from any log-related feature, including
+the log explorer, Live Tail, re-hydration, or a dashboard widget.
+
+Restriction Queries currently only support use of the following components of log events:
+
+- Reserved attributes
+- The log message
+- Tags
+
+To restrict read access on log data, add a team tag to log events to indicate which teams own them, and then scope Restriction Queries to the relevant values of the team tag. Tags can be applied to log events in many ways, and a log event can have multiple tags with the same key (like team) and different values. This means the same log event can be visible to roles whose restriction queries are scoped to different team values.
+
+See [How to Set Up RBAC for Logs](https://docs.datadoghq.com/logs/guide/logs-rbac/?tab=api#restrict-access-to-logs) for details on how to add restriction queries.
+
+## Navigation
+
+- [Installation](#installation)
+- [Getting Started](#getting-started)
+
+## Installation
+
+```sh
+# NPM
+npm install @datadog/datadog-api-client-logs-restriction-queries
+# Yarn
+yarn add @datadog/datadog-api-client-logs-restriction-queries
+```
+
+## Getting Started
+```ts
+import { createConfiguration } from "@datadog/datadog-api-client";
+import { LogsRestrictionQueriesApiV2 } from "@datadog/datadog-api-client-logs-restriction-queries";
+import { v2 } from "@datadog/datadog-api-client-logs-restriction-queries";
+
+const configuration = createConfiguration();
+// Enable unstable operations
+const configurationOpts = {
+    unstableOperations: {
+        "LogsRestrictionQueriesApi.v2.listRestrictionQueries": true
+    }
+}
+
+const configuration = createConfiguration(configurationOpts);
+const apiInstance = new LogsRestrictionQueriesApiV2(configuration);
+const params = {/* parameters */};
+
+apiInstance.listRestrictionQueries(params).then((data) => {
+    console.log("API called successfully. Returned data: " + JSON.stringify(data));
+}).catch((error) => {
+    console.error("Error calling API: " + error);
+});
+```

services/logs_restriction_queries/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@datadog/datadog-api-client-logs-restriction-queries",
+  "description": "",
+  "author": "",
+  "keywords": [
+    "api",
+    "fetch",
+    "typescript"
+  ],
+  "license": "Apache-2.0",
+  "licenses": [
+    {
+      "type": "Apache-2.0",
+      "url": "http://www.apache.org/licenses/LICENSE-2.0"
+    }
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/DataDog/datadog-api-client-typescript.git",
+    "directory": "services/logs-restriction-queries"
+  },
+  "files": [
+    "dist/**/*"
+  ],
+  "main": "./dist/index.js",
+  "typings": "./dist/index.d.ts",
+  "scripts": {
+    "prepack": "yarn workspace @datadog/datadog-api-client build && yarn build",
+    "build": "yarn generate-version-files && tsc",
+    "generate-version-files": "node -p \"'export const version = ' + JSON.stringify(require('./package.json').version)\" > src/version.ts"
+  },
+  "dependencies": {
+    "@datadog/datadog-api-client": "^2.0.0-beta.0"
+  },
+  "devDependencies": {
+    "typescript": "5.8.3"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "version": "0.0.1",
+  "packageManager": "yarn@4.9.1"
+}

services/logs_restriction_queries/src/index.ts

@@ -0,0 +1,3 @@
+export * as v2 from "./v2";
+
+export { LogsRestrictionQueriesApi as LogsRestrictionQueriesApiV2 } from "./v2/LogsRestrictionQueriesApi";