---
title: "List batch migration resources"
method: GET
path: "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources"
tags: ["Security Monitoring"]
---

# List batch migration resources

`GET /api/v2/security_monitoring/batch-migrations/{batch_id}/resources`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_rules_read`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security_monitoring/batch-migrations/:batch_id/resources/get.ts> (a function with typed inputs; its response is checked against the schema)

List the resources of a batch migration, including the input of each source rule and,
once translated, the proposed Cloud SIEM detection rule in `output`.

## Path parameters

- `batch_id` string, uuid, required

## Query parameters

- `page[size]` integer
- `page[number]` integer
- `filter[query]` string

## Response `200`

OK

- SecurityMonitoringBatchMigrationResourcesListResponse: Response containing batch migration resources.
  - `data` SecurityMonitoringBatchMigrationResourceData[], required: The batch migration resources.
    - `attributes` SecurityMonitoringBatchMigrationResourceAttributes, required: Attributes of a batch migration resource.
      - `batchId` string, uuid, required: The UUID of the batch migration that contains the resource.
      - `createdAt` string, date-time, required: The creation date of the resource, in RFC 3339 format.
      - `createdBy` string: The UUID of the user or service account who created the resource.
      - `description` string: The description of the resource.
      - `input` string, required: The source query or natural language description to translate.
      - `inputType` 'natural_language' | 'spl' | 'kql', required: The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
      - `lastUpdatedAt` string, date-time, required: The last update date of the resource, in RFC 3339 format.
      - `lastUpdatedBy` string: The UUID of the user or service account who last updated the resource, or the name of a system actor.
      - `name` string, required: The name of the resource.
      - `output` SecurityMonitoringBatchMigrationResourceOutput, nullable, required: The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null.
      - `outputType` string, required: The type of the translation output. Currently always `siem_rule`.
      - `ruleId` string: The ID of the Cloud SIEM detection rule created when the resource was published.
      - `status` 'pending' | 'in_progress' | 'completed' | 'canceled' | 'failed' | 'publishing' | 'published' | 'duplicate', required: The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection.
    - `id` string, uuid, required: The UUID of the batch migration resource.
    - `type` 'batchMigrationResource', required: The type of resource for a batch migration resource.
  - `meta` SecurityMonitoringBatchMigrationListMeta, required: Metadata of a list response.
    - `totalCount` integer, required: Total number of items matching the request.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)