Note : This endpoint is in preview and is subject to change.
If you have any feedback, contact Datadog support .
DELETE https://api.ap1.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.ap2.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.datadoghq.eu/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.us2.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.us3.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id} https://api.us5.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id}
Overview
Unsubscribe from sample log generation for a Cloud SIEM content pack.
After unsubscribing, no more sample logs are generated for the requested content pack.
Availability : this endpoint is restricted to Cloud SIEM trial organizations on an
eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject
requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.
This endpoint requires
any
of the following permissions:
security_monitoring_filters_writelogs_modify_indexesOAuth apps require the security_monitoring_filters_write, logs_modify_indexes authorization scope to access this endpoint.
Arguments Path Parameters content_pack_id [required ]
The identifier of the Cloud SIEM content pack to operate on (for example, aws-cloudtrail).
Response OK
Response containing a single sample log generation subscription.
Expand All
A sample log generation subscription.
The attributes describing a sample log generation subscription.
content_pack_id [required ]
The identifier of the Cloud SIEM content pack the subscription targets.
The time at which the subscription was created.
The time at which the subscription expires and stops generating logs.
Whether the subscription is currently active and generating logs.
The status of the subscription.
Allowed enum values: subscribed,renewed,unsubscribed,no_active_subscription,not_available,active,expired
The unique identifier of the subscription.
The type of the resource. The value should always be subscriptions.
Allowed enum values: subscriptions
default: subscriptions
{
"data" : {
"attributes" : {
"content_pack_id" : "aws-cloudtrail" ,
"created_at" : "2026-05-08T20:02:13.77481Z" ,
"expires_at" : "2026-05-11T20:02:13.77481Z" ,
"is_active" : true ,
"status" : "subscribed"
},
"id" : "789" ,
"type" : "subscriptions"
}
} Bad Request
{
"errors" : [
"Bad Request"
]
} Not Authorized
{
"errors" : [
"Bad Request"
]
} Too many requests
{
"errors" : [
"Bad Request"
]
} Code Example Copy
# Path parameters export content_pack_id = "CHANGE_ME" # Curl command curl -X DELETE "https://api.ap1.datadoghq.com "https://api.ap2.datadoghq.com "https://api.datadoghq.eu "https://api.ddog-gov.com "https://api.us2.ddog-gov.com "https://api.datadoghq.com "https://api.us3.datadoghq.com "https://api.us5.datadoghq.com /api/v2/security_monitoring/sample_log_generation/subscriptions/${content_pack_id} " \
-H "Accept: application/json" \
-H "DD-API-KEY: ${DD_API_KEY} " \
-H "DD-APPLICATION-KEY: ${DD_APP_KEY} " 
