dd-octo-sts · Oct 30, 2026 · Oct 30, 2026
@@ -4045,6 +4045,101 @@ components:
       type: string
       x-enum-varnames:
         - CCM_CONFIG_VALIDATION
+    AWSCloudAuthIntakeMappingAttributesResponse:
+      description: Attributes for AWS cloud authentication intake mapping response.
+      properties:
+        arn_pattern:
+          description: AWS caller ARN pattern allowed to authenticate for telemetry submission. ARN syntax and AWS integration membership are validated by the server. For an assumed role, use the STS assumed-role ARN with a trailing /* wildcard to match its sessions.
+          example: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+          type: string
+        par_enrollment_enabled:
+          description: Whether the mapping allows Private Action Runner enrollment. This attribute may be omitted when enrollment is disabled. Enrollment permission is managed separately from the ARN pattern.
+          example: true
+          readOnly: true
+          type: boolean
+      required:
+        - arn_pattern
+      type: object
+    AWSCloudAuthIntakeMappingCreateAttributes:
+      description: Attributes for creating an AWS cloud authentication intake mapping.
+      properties:
+        arn_pattern:
+          description: AWS caller ARN pattern allowed to authenticate for telemetry submission. ARN syntax and AWS integration membership are validated by the server. For an assumed role, use the STS assumed-role ARN with a trailing /* wildcard to match its sessions.
+          example: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+          minLength: 1
+          type: string
+      required:
+        - arn_pattern
+      type: object
+    AWSCloudAuthIntakeMappingCreateData:
+      description: Data for creating an AWS cloud authentication intake mapping.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingCreateAttributes"
+        type:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingType"
+      required:
+        - type
+        - attributes
+      type: object
+    AWSCloudAuthIntakeMappingCreateRequest:
+      description: Request used to create an AWS cloud authentication intake mapping.
+      properties:
+        data:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingCreateData"
+      required:
+        - data
+      type: object
+    AWSCloudAuthIntakeMappingDataResponse:
+      description: Data for AWS cloud authentication intake mapping response.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingAttributesResponse"
+        id:
+          description: Unique identifier for the intake mapping.
+          example: c5c758c6-18c2-4484-ae3f-46b84128404a
+          type: string
+        type:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingType"
+      required:
+        - id
+        - type
+        - attributes
+      type: object
+    AWSCloudAuthIntakeMappingResponse:
+      description: Response containing a single AWS cloud authentication intake mapping.
+      properties:
+        data:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingDataResponse"
+      required:
+        - data
+      type: object
+    AWSCloudAuthIntakeMappingType:
+      description: Type identifier for AWS cloud authentication intake mapping.
+      enum:
+        - aws_cloud_auth_intake_mapping
+      example: aws_cloud_auth_intake_mapping
+      type: string
+      x-enum-varnames:
+        - AWS_CLOUD_AUTH_INTAKE_MAPPING
+    AWSCloudAuthIntakeMappingsData:
+      description: List of AWS cloud authentication intake mappings.
+      items:
+        $ref: "#/components/schemas/AWSCloudAuthIntakeMappingDataResponse"
+      type: array
+    AWSCloudAuthIntakeMappingsResponse:
+      description: Response containing a list of AWS cloud authentication intake mappings.
+      properties:
+        data:
+          $ref: "#/components/schemas/AWSCloudAuthIntakeMappingsData"
+          example:
+            - attributes:
+                arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+              id: c5c758c6-18c2-4484-ae3f-46b84128404a
+              type: aws_cloud_auth_intake_mapping
+      required:
+        - data
+      type: object
     AWSCloudAuthPersonaMappingAttributesResponse:
       description: Attributes for AWS cloud authentication persona mapping response
       properties:
@@ -256919,6 +257014,164 @@ paths:
           - generate_log_reports
           - manage_log_reports
           - product_analytics_saved_widgets_write
+  /api/v2/wif/aws/intake_mapping:
+    get:
+      description: List AWS cloud authentication intake mappings configured for the organization.
+      operationId: ListAWSCloudAuthIntakeMappings
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                default:
+                  value:
+                    data:
+                      - attributes:
+                          arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+                        id: c5c758c6-18c2-4484-ae3f-46b84128404a
+                        type: aws_cloud_auth_intake_mapping
+              schema:
+                $ref: "#/components/schemas/AWSCloudAuthIntakeMappingsResponse"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Forbidden
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      summary: List AWS cloud authentication intake mappings
+      tags:
+        - Cloud Authentication
+      x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)."
+    post:
+      description: Create an AWS cloud authentication intake mapping to authorize an AWS ARN pattern for Agent authentication. The AWS account must already be integrated with Datadog, and managed API key rotation must be enabled for the organization. Patterns that conflict with existing intake or persona mappings are rejected.
+      operationId: CreateAWSCloudAuthIntakeMapping
+      requestBody:
+        content:
+          application/json:
+            examples:
+              default:
+                value:
+                  data:
+                    attributes:
+                      arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+                    type: aws_cloud_auth_intake_mapping
+            schema:
+              $ref: "#/components/schemas/AWSCloudAuthIntakeMappingCreateRequest"
+        required: true
+      responses:
+        "201":
+          content:
+            application/json:
+              examples:
+                default:
+                  value:
+                    data:
+                      attributes:
+                        arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+                      id: c5c758c6-18c2-4484-ae3f-46b84128404a
+                      type: aws_cloud_auth_intake_mapping
+              schema:
+                $ref: "#/components/schemas/AWSCloudAuthIntakeMappingResponse"
+          description: Created
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Conflict
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      summary: Create an AWS cloud authentication intake mapping
+      tags:
+        - Cloud Authentication
+      x-codegen-request-body-name: body
+      x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)."
+  /api/v2/wif/aws/intake_mapping/{intake_mapping_id}:
+    delete:
+      description: Delete an AWS cloud authentication intake mapping by ID.
+      operationId: DeleteAWSCloudAuthIntakeMapping
+      parameters:
+        - $ref: "#/components/parameters/IntakeMappingID"
+      responses:
+        "204":
+          description: No Content
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Not Found
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      summary: Delete an AWS cloud authentication intake mapping
+      tags:
+        - Cloud Authentication
+      x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)."
+    get:
+      description: Get an AWS cloud authentication intake mapping by ID.
+      operationId: GetAWSCloudAuthIntakeMapping
+      parameters:
+        - $ref: "#/components/parameters/IntakeMappingID"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                default:
+                  value:
+                    data:
+                      attributes:
+                        arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*
+                      id: c5c758c6-18c2-4484-ae3f-46b84128404a
+                      type: aws_cloud_auth_intake_mapping
+              schema:
+                $ref: "#/components/schemas/AWSCloudAuthIntakeMappingResponse"
+          description: OK
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Not Found
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      summary: Get an AWS cloud authentication intake mapping
+      tags:
+        - Cloud Authentication
+      x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)."
   /api/v2/wif/aws/persona_mapping:
     get:
       description: List all AWS cloud authentication persona mappings. This endpoint retrieves all configured persona mappings that associate AWS IAM principals with Datadog users.

@@ -0,0 +1,45 @@
+// Create an AWS cloud authentication intake mapping returns "Created" response
+
+import com.datadog.api.client.ApiClient;
+import com.datadog.api.client.ApiException;
+import com.datadog.api.client.v2.api.CloudAuthenticationApi;
+import com.datadog.api.client.v2.model.AWSCloudAuthIntakeMappingCreateAttributes;
+import com.datadog.api.client.v2.model.AWSCloudAuthIntakeMappingCreateData;
+import com.datadog.api.client.v2.model.AWSCloudAuthIntakeMappingCreateRequest;
+import com.datadog.api.client.v2.model.AWSCloudAuthIntakeMappingResponse;
+import com.datadog.api.client.v2.model.AWSCloudAuthIntakeMappingType;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = ApiClient.getDefaultApiClient();
+    defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
+    defaultClient.setUnstableOperationEnabled("v2.createAWSCloudAuthIntakeMapping", true);
+    CloudAuthenticationApi apiInstance = new CloudAuthenticationApi(defaultClient);
+
+    // there is an integrated AWS test account for WIF
+    String AWS_WIF_ACCOUNT_V2_DATA_0_ATTRIBUTES_AWS_ACCOUNT_ID =
+        System.getenv("AWS_WIF_ACCOUNT_V2_DATA_0_ATTRIBUTES_AWS_ACCOUNT_ID");
+
+    AWSCloudAuthIntakeMappingCreateRequest body =
+        new AWSCloudAuthIntakeMappingCreateRequest()
+            .data(
+                new AWSCloudAuthIntakeMappingCreateData()
+                    .type(AWSCloudAuthIntakeMappingType.AWS_CLOUD_AUTH_INTAKE_MAPPING)
+                    .attributes(
+                        new AWSCloudAuthIntakeMappingCreateAttributes()
+                            .arnPattern(
+                                "arn:aws:sts::123456789012:assumed-role/DatadogAgent-de20b7e944abfac3/*")));
+
+    try {
+      AWSCloudAuthIntakeMappingResponse result = apiInstance.createAWSCloudAuthIntakeMapping(body);
+      System.out.println(result);
+    } catch (ApiException e) {
+      System.err.println(
+          "Exception when calling CloudAuthenticationApi#createAWSCloudAuthIntakeMapping");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
@@ -0,0 +1,29 @@
+// Delete an AWS cloud authentication intake mapping returns "No Content" response
+
+import com.datadog.api.client.ApiClient;
+import com.datadog.api.client.ApiException;
+import com.datadog.api.client.v2.api.CloudAuthenticationApi;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = ApiClient.getDefaultApiClient();
+    defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
+    defaultClient.setUnstableOperationEnabled("v2.deleteAWSCloudAuthIntakeMapping", true);
+    CloudAuthenticationApi apiInstance = new CloudAuthenticationApi(defaultClient);
+
+    // there is a valid "aws_cloud_auth_intake_mapping" in the system
+    String AWS_CLOUD_AUTH_INTAKE_MAPPING_DATA_ID =
+        System.getenv("AWS_CLOUD_AUTH_INTAKE_MAPPING_DATA_ID");
+
+    try {
+      apiInstance.deleteAWSCloudAuthIntakeMapping(AWS_CLOUD_AUTH_INTAKE_MAPPING_DATA_ID);
+    } catch (ApiException e) {
+      System.err.println(
+          "Exception when calling CloudAuthenticationApi#deleteAWSCloudAuthIntakeMapping");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
@@ -0,0 +1,32 @@
+// Get an AWS cloud authentication intake mapping returns "OK" response
+
+import com.datadog.api.client.ApiClient;
+import com.datadog.api.client.ApiException;
+import com.datadog.api.client.v2.api.CloudAuthenticationApi;
+import com.datadog.api.client.v2.model.AWSCloudAuthIntakeMappingResponse;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = ApiClient.getDefaultApiClient();
+    defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
+    defaultClient.setUnstableOperationEnabled("v2.getAWSCloudAuthIntakeMapping", true);
+    CloudAuthenticationApi apiInstance = new CloudAuthenticationApi(defaultClient);
+
+    // there is a valid "aws_cloud_auth_intake_mapping" in the system
+    String AWS_CLOUD_AUTH_INTAKE_MAPPING_DATA_ID =
+        System.getenv("AWS_CLOUD_AUTH_INTAKE_MAPPING_DATA_ID");
+
+    try {
+      AWSCloudAuthIntakeMappingResponse result =
+          apiInstance.getAWSCloudAuthIntakeMapping(AWS_CLOUD_AUTH_INTAKE_MAPPING_DATA_ID);
+      System.out.println(result);
+    } catch (ApiException e) {
+      System.err.println(
+          "Exception when calling CloudAuthenticationApi#getAWSCloudAuthIntakeMapping");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}