--- title: Add resources to a batch migration description: Add 1 to 1000 resources to a draft batch migration. breadcrumbs: ドキュメント > API > Add resources to a batch migration --- > For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/llms.txt). # Add resources to a batch migration ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help.md) or your Customer Success Manager. {% /alert %} | Datadog site | API endpoint | | ----------------- | --------------------------------------------------------------------------------------------------- | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | ### Overview Add 1 to 1000 resources to a `draft` batch migration. Returns `409 Conflict` if the batch migration is not `draft`, and `400 Bad Request` if the batch migration would contain more than 1000 resources. This endpoint requires the `security_monitoring_rules_write` permission. OAuth apps require the `security_monitoring_rules_write` authorization [scope](https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/ja/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Arguments #### Path Parameters | Field | Type | Description | | --------------------- | ------ | -------------------------------- | | batch_id [*required*] | string | The UUID of the batch migration. | ### Request #### Body Data (required) {% tabs %} {% tab label="Model" %} | Parent field | Field | Type | Description | | ------------ | ----------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Data of the resources to add to a batch migration. | | data | attributes [*required*] | object | Attributes of the resources to add to a batch migration. | | attributes | resources [*required*] | [object] | The resources to add. From 1 to 1000 resources. | | resources | description | string | The description of the resource. | | resources | input [*required*] | string | The source query or natural language description to translate. Must not be blank. | | resources | inputType [*required*] | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language`, `spl`, `kql`. | | resources | name | string | The name of the resource. | | data | type [*required*] | enum | The type of resource for a request on a set of batch migration resources. Allowed enum values: `batchMigrationResources`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "type": "batchMigrationResources", "attributes": { "resources": [ { "name": "Linux sudo abuse", "inputType": "spl", "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host" } ] } } } ``` {% /tab %} {% /tabs %} ### Response {% tabs %} {% tab label="201" %} Created {% tabs %} {% tab label="Model" %} Response containing the batch migration resources that were added. | Parent field | Field | Type | Description | | ------------ | -------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | [object] | The added batch migration resources. | | data | attributes [*required*] | object | Attributes of a batch migration resource. | | attributes | batchId [*required*] | uuid | The UUID of the batch migration that contains the resource. | | attributes | createdAt [*required*] | date-time | The creation date of the resource, in RFC 3339 format. | | attributes | createdBy | string | The UUID of the user or service account who created the resource. | | attributes | description | string | The description of the resource. | | attributes | input [*required*] | string | The source query or natural language description to translate. | | attributes | inputType [*required*] | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language`, `spl`, `kql`. | | attributes | lastUpdatedAt [*required*] | date-time | The last update date of the resource, in RFC 3339 format. | | attributes | lastUpdatedBy | string | The UUID of the user or service account who last updated the resource, or the name of a system actor. | | attributes | name [*required*] | string | The name of the resource. | | attributes | output [*required*] | object | The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null. | | attributes | outputType [*required*] | string | The type of the translation output. Currently always `siem_rule`. | | attributes | ruleId | string | The ID of the Cloud SIEM detection rule created when the resource was published. | | attributes | status [*required*] | enum | The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection. Allowed enum values: `pending`, `in_progress`, `completed`, `canceled`, `failed`, `publishing`, `published`, `duplicate`. | | data | id [*required*] | uuid | The UUID of the batch migration resource. | | data | type [*required*] | enum | The type of resource for a batch migration resource. Allowed enum values: `batchMigrationResource`. | {% /tab %} {% tab label="Example" %} ```json { "data": [ { "attributes": { "batchId": "7cdb3a75-64fb-46ce-9445-41969e78fe8e", "createdAt": "2026-09-21T12:00:00Z", "createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "lastUpdatedAt": "2026-09-21T12:02:00Z", "lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "name": "Repeated Windows login failures", "output": { "name": "Repeated Windows login failures", "type": "log_detection" }, "outputType": "siem_rule", "ruleId": "abc-def-ghi", "status": "completed" }, "id": "c968cf83-56c2-4d54-a993-6c86dfb83527", "type": "batchMigrationResource" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="401" %} Unauthorized {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="404" %} Not Found {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="409" %} Conflict {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Path parameters export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e" # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "type": "batchMigrationResources", "attributes": { "resources": [ { "name": "Linux sudo abuse", "inputType": "spl", "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host" } ] } } } EOF ``` {% /tab %} {% /tabs %}