---
title: CSM Threats
description: Workload Protection monitors file, network, and process activity across your environment to detect real-time threats to your infrastructure.
breadcrumbs: Docs > API > CSM Threats
---

> For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/llms.txt).

# CSM Threats

Workload Protection monitors file, network, and process activity across your environment to detect real-time threats to your infrastructure. See [Workload Protection](https://docs.datadoghq.com/security/workload_protection.md) for more information on setting up Workload Protection.

**Note**: These endpoints are split based on whether you are using the US1-FED site or not. Please reference the specific resource for the site you are using.

## [Get all Workload Protection agent rules](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/get-all-workload-protection-agent-rules.md)

| Datadog site      | API endpoint                                                                    |
| ----------------- | ------------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/remote_config/products/cws/agent_rules      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules  |

## [Get a Workload Protection agent rule](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/get-a-workload-protection-agent-rule.md)

| Datadog site      | API endpoint                                                                                    |
| ----------------- | ----------------------------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}  |

## [Create a Workload Protection agent rule](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/create-a-workload-protection-agent-rule.md)

| Datadog site      | API endpoint                                                                     |
| ----------------- | -------------------------------------------------------------------------------- |
| app.datadoghq.com | POST https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules     |
| us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| app.datadoghq.eu  | POST https://api.datadoghq.eu/api/v2/remote_config/products/cws/agent_rules      |
| ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules |
| app.ddog-gov.com  | POST https://api.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules      |
| us2.ddog-gov.com  | POST https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules  |

## [Update a Workload Protection agent rule](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/update-a-workload-protection-agent-rule.md)

| Datadog site      | API endpoint                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------- |
| app.datadoghq.com | PATCH https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}     |
| us3.datadoghq.com | PATCH https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| us5.datadoghq.com | PATCH https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| app.datadoghq.eu  | PATCH https://api.datadoghq.eu/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}      |
| ap1.datadoghq.com | PATCH https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| ap2.datadoghq.com | PATCH https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| uk1.datadoghq.com | PATCH https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| app.ddog-gov.com  | PATCH https://api.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}      |
| us2.ddog-gov.com  | PATCH https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}  |

## [Delete a Workload Protection agent rule](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/delete-a-workload-protection-agent-rule.md)

| Datadog site      | API endpoint                                                                                       |
| ----------------- | -------------------------------------------------------------------------------------------------- |
| app.datadoghq.com | DELETE https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}     |
| us3.datadoghq.com | DELETE https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| us5.datadoghq.com | DELETE https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| app.datadoghq.eu  | DELETE https://api.datadoghq.eu/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}      |
| ap1.datadoghq.com | DELETE https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| ap2.datadoghq.com | DELETE https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| uk1.datadoghq.com | DELETE https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} |
| app.ddog-gov.com  | DELETE https://api.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}      |
| us2.ddog-gov.com  | DELETE https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}  |

## [Get all Workload Protection policies](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/get-all-workload-protection-policies.md)

| Datadog site      | API endpoint                                                               |
| ----------------- | -------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/remote_config/products/cws/policy     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/policy |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/policy |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/remote_config/products/cws/policy      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/policy |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/policy |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/policy |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/remote_config/products/cws/policy      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/policy  |

## [Get a Workload Protection policy](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/get-a-workload-protection-policy.md)

| Datadog site      | API endpoint                                                                           |
| ----------------- | -------------------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id}     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/remote_config/products/cws/policy/{policy_id}      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/remote_config/products/cws/policy/{policy_id}      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/policy/{policy_id}  |

## [Create a Workload Protection policy](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/create-a-workload-protection-policy.md)

| Datadog site      | API endpoint                                                                |
| ----------------- | --------------------------------------------------------------------------- |
| app.datadoghq.com | POST https://api.datadoghq.com/api/v2/remote_config/products/cws/policy     |
| us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/policy |
| us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/policy |
| app.datadoghq.eu  | POST https://api.datadoghq.eu/api/v2/remote_config/products/cws/policy      |
| ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/policy |
| ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/policy |
| uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/policy |
| app.ddog-gov.com  | POST https://api.ddog-gov.com/api/v2/remote_config/products/cws/policy      |
| us2.ddog-gov.com  | POST https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/policy  |

## [Update a Workload Protection policy](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/update-a-workload-protection-policy.md)

| Datadog site      | API endpoint                                                                             |
| ----------------- | ---------------------------------------------------------------------------------------- |
| app.datadoghq.com | PATCH https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id}     |
| us3.datadoghq.com | PATCH https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| us5.datadoghq.com | PATCH https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| app.datadoghq.eu  | PATCH https://api.datadoghq.eu/api/v2/remote_config/products/cws/policy/{policy_id}      |
| ap1.datadoghq.com | PATCH https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| ap2.datadoghq.com | PATCH https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| uk1.datadoghq.com | PATCH https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| app.ddog-gov.com  | PATCH https://api.ddog-gov.com/api/v2/remote_config/products/cws/policy/{policy_id}      |
| us2.ddog-gov.com  | PATCH https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/policy/{policy_id}  |

## [Delete a Workload Protection policy](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/delete-a-workload-protection-policy.md)

| Datadog site      | API endpoint                                                                              |
| ----------------- | ----------------------------------------------------------------------------------------- |
| app.datadoghq.com | DELETE https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id}     |
| us3.datadoghq.com | DELETE https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| us5.datadoghq.com | DELETE https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| app.datadoghq.eu  | DELETE https://api.datadoghq.eu/api/v2/remote_config/products/cws/policy/{policy_id}      |
| ap1.datadoghq.com | DELETE https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| ap2.datadoghq.com | DELETE https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| uk1.datadoghq.com | DELETE https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/policy/{policy_id} |
| app.ddog-gov.com  | DELETE https://api.ddog-gov.com/api/v2/remote_config/products/cws/policy/{policy_id}      |
| us2.ddog-gov.com  | DELETE https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/policy/{policy_id}  |

## [Download the Workload Protection policy](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/download-the-workload-protection-policy.md)

| Datadog site      | API endpoint                                                                        |
| ----------------- | ----------------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/download     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/remote_config/products/cws/policy/download |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/remote_config/products/cws/policy/download |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/remote_config/products/cws/policy/download      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/remote_config/products/cws/policy/download |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/remote_config/products/cws/policy/download |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/remote_config/products/cws/policy/download |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/remote_config/products/cws/policy/download      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/remote_config/products/cws/policy/download  |

## [Get all Workload Protection agent rules (US1-FED)](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/get-all-workload-protection-agent-rules-us1-fed.md)

| Datadog site      | API endpoint                                                                                     |
| ----------------- | ------------------------------------------------------------------------------------------------ |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/security_monitoring/cloud_workload_security/agent_rules      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules  |

## [Get a Workload Protection agent rule (US1-FED)](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/get-a-workload-protection-agent-rule-us1-fed.md)

| Datadog site      | API endpoint                                                                                                     |
| ----------------- | ---------------------------------------------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}  |

## [Create a Workload Protection agent rule (US1-FED)](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/create-a-workload-protection-agent-rule-us1-fed.md)

| Datadog site      | API endpoint                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------- |
| app.datadoghq.com | POST https://api.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules     |
| us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| app.datadoghq.eu  | POST https://api.datadoghq.eu/api/v2/security_monitoring/cloud_workload_security/agent_rules      |
| ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules |
| app.ddog-gov.com  | POST https://api.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules      |
| us2.ddog-gov.com  | POST https://api.us2.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules  |

## [Update a Workload Protection agent rule (US1-FED)](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/update-a-workload-protection-agent-rule-us1-fed.md)

| Datadog site      | API endpoint                                                                                                       |
| ----------------- | ------------------------------------------------------------------------------------------------------------------ |
| app.datadoghq.com | PATCH https://api.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}     |
| us3.datadoghq.com | PATCH https://api.us3.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| us5.datadoghq.com | PATCH https://api.us5.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| app.datadoghq.eu  | PATCH https://api.datadoghq.eu/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}      |
| ap1.datadoghq.com | PATCH https://api.ap1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| ap2.datadoghq.com | PATCH https://api.ap2.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| uk1.datadoghq.com | PATCH https://api.uk1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| app.ddog-gov.com  | PATCH https://api.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}      |
| us2.ddog-gov.com  | PATCH https://api.us2.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}  |

## [Delete a Workload Protection agent rule (US1-FED)](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/delete-a-workload-protection-agent-rule-us1-fed.md)

| Datadog site      | API endpoint                                                                                                        |
| ----------------- | ------------------------------------------------------------------------------------------------------------------- |
| app.datadoghq.com | DELETE https://api.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}     |
| us3.datadoghq.com | DELETE https://api.us3.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| us5.datadoghq.com | DELETE https://api.us5.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| app.datadoghq.eu  | DELETE https://api.datadoghq.eu/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}      |
| ap1.datadoghq.com | DELETE https://api.ap1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| ap2.datadoghq.com | DELETE https://api.ap2.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| uk1.datadoghq.com | DELETE https://api.uk1.datadoghq.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} |
| app.ddog-gov.com  | DELETE https://api.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}      |
| us2.ddog-gov.com  | DELETE https://api.us2.ddog-gov.com/api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}  |

## [Download the Workload Protection policy (US1-FED)](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/csm-threats/download-the-workload-protection-policy-us1-fed.md)

| Datadog site      | API endpoint                                                                     |
| ----------------- | -------------------------------------------------------------------------------- |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security/cloud_workload/policy/download     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security/cloud_workload/policy/download |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security/cloud_workload/policy/download |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/security/cloud_workload/policy/download      |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security/cloud_workload/policy/download |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security/cloud_workload/policy/download |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security/cloud_workload/policy/download |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/security/cloud_workload/policy/download      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/security/cloud_workload/policy/download  |