---
title: "Add resources to a batch migration"
method: POST
path: "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources"
tags: ["Security Monitoring"]
---

# Add resources to a batch migration

`POST /api/v2/security_monitoring/batch-migrations/{batch_id}/resources`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_rules_write`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security_monitoring/batch-migrations/:batch_id/resources/post.ts> (a function with typed inputs; its response is checked against the schema)

Add 1 to 1000 resources to a `draft` batch migration. Returns `409 Conflict` if the
batch migration is not `draft`, and `400 Bad Request` if the batch migration would
contain more than 1000 resources.

## Path parameters

- `batch_id` string, uuid, required

## Request body

- SecurityMonitoringBatchMigrationResourcesCreateRequest: Request to add resources to a batch migration.
  - `data` SecurityMonitoringBatchMigrationResourcesCreateData, required: Data of the resources to add to a batch migration.
    - `attributes` SecurityMonitoringBatchMigrationResourcesCreateAttributes, required: Attributes of the resources to add to a batch migration.
      - `resources` SecurityMonitoringBatchMigrationResourceCreateItem[], required: The resources to add. From 1 to 1000 resources.
        - `description` string: The description of the resource.
        - `input` string, required: The source query or natural language description to translate. Must not be blank.
        - `inputType` 'natural_language' | 'spl' | 'kql', required: The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
        - `name` string: The name of the resource.
    - `type` 'batchMigrationResources', required: The type of resource for a request on a set of batch migration resources.

## Response `201`

Created

- SecurityMonitoringBatchMigrationResourcesCreateResponse: Response containing the batch migration resources that were added.
  - `data` SecurityMonitoringBatchMigrationResourceData[], required: The added batch migration resources.
    - `attributes` SecurityMonitoringBatchMigrationResourceAttributes, required: Attributes of a batch migration resource.
      - `batchId` string, uuid, required: The UUID of the batch migration that contains the resource.
      - `createdAt` string, date-time, required: The creation date of the resource, in RFC 3339 format.
      - `createdBy` string: The UUID of the user or service account who created the resource.
      - `description` string: The description of the resource.
      - `input` string, required: The source query or natural language description to translate.
      - `inputType` 'natural_language' | 'spl' | 'kql', required: The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
      - `lastUpdatedAt` string, date-time, required: The last update date of the resource, in RFC 3339 format.
      - `lastUpdatedBy` string: The UUID of the user or service account who last updated the resource, or the name of a system actor.
      - `name` string, required: The name of the resource.
      - `output` SecurityMonitoringBatchMigrationResourceOutput, nullable, required: The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null.
      - `outputType` string, required: The type of the translation output. Currently always `siem_rule`.
      - `ruleId` string: The ID of the Cloud SIEM detection rule created when the resource was published.
      - `status` 'pending' | 'in_progress' | 'completed' | 'canceled' | 'failed' | 'publishing' | 'published' | 'duplicate', required: The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection.
    - `id` string, uuid, required: The UUID of the batch migration resource.
    - `type` 'batchMigrationResource', required: The type of resource for a batch migration resource.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)