Add field attribute to the Workload Protection hash action

.generator/schemas/v2/openapi.yaml

@@ -10205,11 +10205,11 @@ components:
     CloudWorkloadSecurityAgentPolicyVersion:
       description: The versions of the policy
       properties:
-        Date:
+        date:
           description: The date and time the version was created
           nullable: true
           type: string
-        Name:
+        name:
           description: The version of the policy
           example: 1.47.0-rc2
           type: string
@@ -10236,8 +10236,11 @@ components:
           $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
       type: object
     CloudWorkloadSecurityAgentRuleActionHash:
-      additionalProperties: {}
-      description: An empty object indicating the hash action
+      description: Hash file specified by the field attribute
+      properties:
+        field:
+          description: The field of the hash action
+          type: string
       type: object
     CloudWorkloadSecurityAgentRuleActionMetadata:
       description: The metadata action applied on the scope matching the rule
@@ -10285,9 +10288,14 @@ components:
           format: int64
           type: integer
         value:
-          description: The value of the set action
-          type: string
+          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSetValue'
       type: object
+    CloudWorkloadSecurityAgentRuleActionSetValue:
+      description: The value of the set action
+      oneOf:
+      - type: string
+      - type: integer
+      - type: boolean
     CloudWorkloadSecurityAgentRuleActions:
       description: The array of actions the rule can perform if triggered
       items:

examples/v2_csm-threats_CreateCSMThreatsAgentRule_1295653933.rs

@@ -2,12 +2,13 @@
 use datadog_api_client::datadog;
 use datadog_api_client::datadogV2::api_csm_threats::CSMThreatsAPI;
 use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleAction;
+use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleActionHash;
 use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleActionSet;
+use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleActionSetValue;
 use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleCreateAttributes;
 use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleCreateData;
 use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleCreateRequest;
 use datadog_api_client::datadogV2::model::CloudWorkloadSecurityAgentRuleType;
-use std::collections::BTreeMap;
 
 #[tokio::main]
 async fn main() {
@@ -25,9 +26,13 @@ async fn main() {
                         .inherited(true)
                         .name("test_set".to_string())
                         .scope("process".to_string())
-                        .value("test_value".to_string()),
+                        .value(CloudWorkloadSecurityAgentRuleActionSetValue::String(
+                            "test_value".to_string(),
+                        )),
+                ),
+                CloudWorkloadSecurityAgentRuleAction::new().hash(
+                    CloudWorkloadSecurityAgentRuleActionHash::new().field("exec.file".to_string()),
                 ),
-                CloudWorkloadSecurityAgentRuleAction::new().hash(BTreeMap::from([])),
             ]))
             .description("My Agent rule with set action".to_string())
             .enabled(true)

examples/v2_csm-threats_CreateCSMThreatsAgentRule_1363354233.rs

@@ -22,7 +22,7 @@ async fn main() {
             .actions(Some(vec![CloudWorkloadSecurityAgentRuleAction::new().set(
                 CloudWorkloadSecurityAgentRuleActionSet::new()
                     .default_value("/dev/null".to_string())
-                    .expression("open.file.path".to_string())
+                    .expression("exec.file.path".to_string())
                     .name("test_set".to_string())
                     .scope("process".to_string()),
             )]))

src/datadogV2/model/mod.rs

@@ -4748,12 +4748,16 @@ pub mod model_cloud_workload_security_agent_rule_attributes;
 pub use self::model_cloud_workload_security_agent_rule_attributes::CloudWorkloadSecurityAgentRuleAttributes;
 pub mod model_cloud_workload_security_agent_rule_action;
 pub use self::model_cloud_workload_security_agent_rule_action::CloudWorkloadSecurityAgentRuleAction;
+pub mod model_cloud_workload_security_agent_rule_action_hash;
+pub use self::model_cloud_workload_security_agent_rule_action_hash::CloudWorkloadSecurityAgentRuleActionHash;
 pub mod model_cloud_workload_security_agent_rule_kill;
 pub use self::model_cloud_workload_security_agent_rule_kill::CloudWorkloadSecurityAgentRuleKill;
 pub mod model_cloud_workload_security_agent_rule_action_metadata;
 pub use self::model_cloud_workload_security_agent_rule_action_metadata::CloudWorkloadSecurityAgentRuleActionMetadata;
 pub mod model_cloud_workload_security_agent_rule_action_set;
 pub use self::model_cloud_workload_security_agent_rule_action_set::CloudWorkloadSecurityAgentRuleActionSet;
+pub mod model_cloud_workload_security_agent_rule_action_set_value;
+pub use self::model_cloud_workload_security_agent_rule_action_set_value::CloudWorkloadSecurityAgentRuleActionSetValue;
 pub mod model_cloud_workload_security_agent_rule_creator_attributes;
 pub use self::model_cloud_workload_security_agent_rule_creator_attributes::CloudWorkloadSecurityAgentRuleCreatorAttributes;
 pub mod model_cloud_workload_security_agent_rule_updater_attributes;

src/datadogV2/model/model_cloud_workload_security_agent_policy_version.rs

@@ -12,10 +12,10 @@ use std::fmt::{self, Formatter};
 #[derive(Clone, Debug, PartialEq, Serialize)]
 pub struct CloudWorkloadSecurityAgentPolicyVersion {
     /// The date and time the version was created
-    #[serde(rename = "Date", default, with = "::serde_with::rust::double_option")]
+    #[serde(rename = "date", default, with = "::serde_with::rust::double_option")]
     pub date: Option<Option<String>>,
     /// The version of the policy
-    #[serde(rename = "Name")]
+    #[serde(rename = "name")]
     pub name: Option<String>,
     #[serde(flatten)]
     pub additional_properties: std::collections::BTreeMap<String, serde_json::Value>,
@@ -86,10 +86,10 @@ impl<'de> Deserialize<'de> for CloudWorkloadSecurityAgentPolicyVersion {
 
                 while let Some((k, v)) = map.next_entry::<String, serde_json::Value>()? {
                     match k.as_str() {
-                        "Date" => {
+                        "date" => {
                             date = Some(serde_json::from_value(v).map_err(M::Error::custom)?);
                         }
-                        "Name" => {
+                        "name" => {
                             if v.is_null() {
                                 continue;
                             }

src/datadogV2/model/model_cloud_workload_security_agent_rule_action.rs

@@ -14,9 +14,9 @@ pub struct CloudWorkloadSecurityAgentRuleAction {
     /// SECL expression used to target the container to apply the action on
     #[serde(rename = "filter")]
     pub filter: Option<String>,
-    /// An empty object indicating the hash action
+    /// Hash file specified by the field attribute
     #[serde(rename = "hash")]
-    pub hash: Option<std::collections::BTreeMap<String, serde_json::Value>>,
+    pub hash: Option<crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionHash>,
     /// Kill system call applied on the container matching the rule
     #[serde(rename = "kill")]
     pub kill: Option<crate::datadogV2::model::CloudWorkloadSecurityAgentRuleKill>,
@@ -51,7 +51,10 @@ impl CloudWorkloadSecurityAgentRuleAction {
         self
     }
 
-    pub fn hash(mut self, value: std::collections::BTreeMap<String, serde_json::Value>) -> Self {
+    pub fn hash(
+        mut self,
+        value: crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionHash,
+    ) -> Self {
         self.hash = Some(value);
         self
     }
@@ -113,7 +116,9 @@ impl<'de> Deserialize<'de> for CloudWorkloadSecurityAgentRuleAction {
                 M: MapAccess<'a>,
             {
                 let mut filter: Option<String> = None;
-                let mut hash: Option<std::collections::BTreeMap<String, serde_json::Value>> = None;
+                let mut hash: Option<
+                    crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionHash,
+                > = None;
                 let mut kill: Option<crate::datadogV2::model::CloudWorkloadSecurityAgentRuleKill> =
                     None;
                 let mut metadata: Option<

src/datadogV2/model/model_cloud_workload_security_agent_rule_action_hash.rs

@@ -0,0 +1,105 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2019-Present Datadog, Inc.
+use serde::de::{Error, MapAccess, Visitor};
+use serde::{Deserialize, Deserializer, Serialize};
+use serde_with::skip_serializing_none;
+use std::fmt::{self, Formatter};
+
+/// Hash file specified by the field attribute
+#[non_exhaustive]
+#[skip_serializing_none]
+#[derive(Clone, Debug, PartialEq, Serialize)]
+pub struct CloudWorkloadSecurityAgentRuleActionHash {
+    /// The field of the hash action
+    #[serde(rename = "field")]
+    pub field: Option<String>,
+    #[serde(flatten)]
+    pub additional_properties: std::collections::BTreeMap<String, serde_json::Value>,
+    #[serde(skip)]
+    #[serde(default)]
+    pub(crate) _unparsed: bool,
+}
+
+impl CloudWorkloadSecurityAgentRuleActionHash {
+    pub fn new() -> CloudWorkloadSecurityAgentRuleActionHash {
+        CloudWorkloadSecurityAgentRuleActionHash {
+            field: None,
+            additional_properties: std::collections::BTreeMap::new(),
+            _unparsed: false,
+        }
+    }
+
+    pub fn field(mut self, value: String) -> Self {
+        self.field = Some(value);
+        self
+    }
+
+    pub fn additional_properties(
+        mut self,
+        value: std::collections::BTreeMap<String, serde_json::Value>,
+    ) -> Self {
+        self.additional_properties = value;
+        self
+    }
+}
+
+impl Default for CloudWorkloadSecurityAgentRuleActionHash {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<'de> Deserialize<'de> for CloudWorkloadSecurityAgentRuleActionHash {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        struct CloudWorkloadSecurityAgentRuleActionHashVisitor;
+        impl<'a> Visitor<'a> for CloudWorkloadSecurityAgentRuleActionHashVisitor {
+            type Value = CloudWorkloadSecurityAgentRuleActionHash;
+
+            fn expecting(&self, f: &mut Formatter<'_>) -> fmt::Result {
+                f.write_str("a mapping")
+            }
+
+            fn visit_map<M>(self, mut map: M) -> Result<Self::Value, M::Error>
+            where
+                M: MapAccess<'a>,
+            {
+                let mut field: Option<String> = None;
+                let mut additional_properties: std::collections::BTreeMap<
+                    String,
+                    serde_json::Value,
+                > = std::collections::BTreeMap::new();
+                let mut _unparsed = false;
+
+                while let Some((k, v)) = map.next_entry::<String, serde_json::Value>()? {
+                    match k.as_str() {
+                        "field" => {
+                            if v.is_null() {
+                                continue;
+                            }
+                            field = Some(serde_json::from_value(v).map_err(M::Error::custom)?);
+                        }
+                        &_ => {
+                            if let Ok(value) = serde_json::from_value(v.clone()) {
+                                additional_properties.insert(k, value);
+                            }
+                        }
+                    }
+                }
+
+                let content = CloudWorkloadSecurityAgentRuleActionHash {
+                    field,
+                    additional_properties,
+                    _unparsed,
+                };
+
+                Ok(content)
+            }
+        }
+
+        deserializer.deserialize_any(CloudWorkloadSecurityAgentRuleActionHashVisitor)
+    }
+}

src/datadogV2/model/model_cloud_workload_security_agent_rule_action_set.rs

@@ -40,7 +40,7 @@ pub struct CloudWorkloadSecurityAgentRuleActionSet {
     pub ttl: Option<i64>,
     /// The value of the set action
     #[serde(rename = "value")]
-    pub value: Option<String>,
+    pub value: Option<crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionSetValue>,
     #[serde(flatten)]
     pub additional_properties: std::collections::BTreeMap<String, serde_json::Value>,
     #[serde(skip)]
@@ -111,7 +111,10 @@ impl CloudWorkloadSecurityAgentRuleActionSet {
         self
     }
 
-    pub fn value(mut self, value: String) -> Self {
+    pub fn value(
+        mut self,
+        value: crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionSetValue,
+    ) -> Self {
         self.value = Some(value);
         self
     }
@@ -157,7 +160,9 @@ impl<'de> Deserialize<'de> for CloudWorkloadSecurityAgentRuleActionSet {
                 let mut scope: Option<String> = None;
                 let mut size: Option<i64> = None;
                 let mut ttl: Option<i64> = None;
-                let mut value: Option<String> = None;
+                let mut value: Option<
+                    crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionSetValue,
+                > = None;
                 let mut additional_properties: std::collections::BTreeMap<
                     String,
                     serde_json::Value,
@@ -226,6 +231,14 @@ impl<'de> Deserialize<'de> for CloudWorkloadSecurityAgentRuleActionSet {
                                 continue;
                             }
                             value = Some(serde_json::from_value(v).map_err(M::Error::custom)?);
+                            if let Some(ref _value) = value {
+                                match _value {
+                                    crate::datadogV2::model::CloudWorkloadSecurityAgentRuleActionSetValue::UnparsedObject(_value) => {
+                                        _unparsed = true;
+                                    },
+                                    _ => {}
+                                }
+                            }
                         }
                         &_ => {
                             if let Ok(value) = serde_json::from_value(v.clone()) {

src/datadogV2/model/model_cloud_workload_security_agent_rule_action_set_value.rs

@@ -0,0 +1,39 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2019-Present Datadog, Inc.
+use serde::{Deserialize, Deserializer, Serialize};
+
+/// The value of the set action
+#[non_exhaustive]
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(untagged)]
+pub enum CloudWorkloadSecurityAgentRuleActionSetValue {
+    String(String),
+    I32(i32),
+    Bool(bool),
+    UnparsedObject(crate::datadog::UnparsedObject),
+}
+
+impl<'de> Deserialize<'de> for CloudWorkloadSecurityAgentRuleActionSetValue {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value: serde_json::Value = Deserialize::deserialize(deserializer)?;
+        if let Ok(_v) = serde_json::from_value::<String>(value.clone()) {
+            return Ok(CloudWorkloadSecurityAgentRuleActionSetValue::String(_v));
+        }
+        if let Ok(_v) = serde_json::from_value::<i32>(value.clone()) {
+            return Ok(CloudWorkloadSecurityAgentRuleActionSetValue::I32(_v));
+        }
+        if let Ok(_v) = serde_json::from_value::<bool>(value.clone()) {
+            return Ok(CloudWorkloadSecurityAgentRuleActionSetValue::Bool(_v));
+        }
+
+        return Ok(
+            CloudWorkloadSecurityAgentRuleActionSetValue::UnparsedObject(
+                crate::datadog::UnparsedObject { value },
+            ),
+        );
+    }
+}

tests/scenarios/cassettes/v2/csm_threats/Create-a-Workload-Protection-agent-rule-returns-Bad-Request-response.frozen

@@ -1 +1 @@
-2025-10-10T15:20:39.566Z
+2025-11-28T15:36:35.422Z