--- title: List batch migration resources description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # List batch migration resources{% #list-batch-migration-resources %} {% tab title="v2" %} **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. | Datadog site | API endpoint | | ----------------- | -------------------------------------------------------------------------------------------------- | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | ### Overview List the resources of a batch migration, including the input of each source rule and, once translated, the proposed Cloud SIEM detection rule in `output`. This endpoint requires the `security_monitoring_rules_read` permission. OAuth apps require the `security_monitoring_rules_read` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Arguments #### Path Parameters | Name | Type | Description | | -------------------------- | ------ | -------------------------------- | | batch_id [*required*] | string | The UUID of the batch migration. | #### Query Strings | Name | Type | Description | | ------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | page[size] | integer | Size for a given page. The maximum allowed value is 500. | | page[number] | integer | Specific page number to return, starting at 1. | | filter[query] | string | A search query in Datadog search syntax to filter resources, such as `status:completed`. Filterable attributes are `id`, `name`, `description`, `inputType`, `status`, `input`, `createdBy`, and `lastUpdatedBy`. Free text matches the resource name. | ### Response {% tab title="200" %} OK {% tab title="Model" %} Response containing batch migration resources. | Parent field | Field | Type | Description | | ------------ | ------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | [object] | The batch migration resources. | | data | attributes [*required*] | object | Attributes of a batch migration resource. | | attributes | batchId [*required*] | uuid | The UUID of the batch migration that contains the resource. | | attributes | createdAt [*required*] | date-time | The creation date of the resource, in RFC 3339 format. | | attributes | createdBy | string | The UUID of the user or service account who created the resource. | | attributes | description | string | The description of the resource. | | attributes | input [*required*] | string | The source query or natural language description to translate. | | attributes | inputType [*required*] | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language,spl,kql` | | attributes | lastUpdatedAt [*required*] | date-time | The last update date of the resource, in RFC 3339 format. | | attributes | lastUpdatedBy | string | The UUID of the user or service account who last updated the resource, or the name of a system actor. | | attributes | name [*required*] | string | The name of the resource. | | attributes | output [*required*] | object | The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null. | | attributes | outputType [*required*] | string | The type of the translation output. Currently always `siem_rule`. | | attributes | ruleId | string | The ID of the Cloud SIEM detection rule created when the resource was published. | | attributes | status [*required*] | enum | The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection. Allowed enum values: `pending,in_progress,completed,canceled,failed,publishing,published,duplicate` | | data | id [*required*] | uuid | The UUID of the batch migration resource. | | data | type [*required*] | enum | The type of resource for a batch migration resource. Allowed enum values: `batchMigrationResource` | | | meta [*required*] | object | Metadata of a list response. | | meta | totalCount [*required*] | int64 | Total number of items matching the request. | {% /tab %} {% tab title="Example" %} ```json { "data": [ { "attributes": { "batchId": "7cdb3a75-64fb-46ce-9445-41969e78fe8e", "createdAt": "2026-09-21T12:00:00Z", "createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "lastUpdatedAt": "2026-09-21T12:02:00Z", "lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "name": "Repeated Windows login failures", "output": { "name": "Repeated Windows login failures", "type": "log_detection" }, "outputType": "siem_rule", "ruleId": "abc-def-ghi", "status": "completed" }, "id": "c968cf83-56c2-4d54-a993-6c86dfb83527", "type": "batchMigrationResource" } ], "meta": { "totalCount": 1 } } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="401" %} Unauthorized {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="404" %} Not Found {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \# Path parameters export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e" \# Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" \# Curl command curl -X GET "https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/${batch_id}/resources" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" {% /tab %}