---
title: "Create a batch migration"
method: POST
path: "/api/v2/security_monitoring/batch-migrations"
tags: ["Security Monitoring"]
---

# Create a batch migration

`POST /api/v2/security_monitoring/batch-migrations`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_rules_write`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security_monitoring/batch-migrations/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a batch migration in the `draft` status, together with 1 to 100 initial
resources. Each resource holds one source rule to translate into a Cloud SIEM detection
rule. To load more rules, add them with the add resources endpoint before starting the
batch migration. A batch migration can hold up to 1000 resources. The response does not
include the created resources: list the resources of the batch migration to retrieve them.
Alternatively, use the start-a-rule-proposal endpoint to get a single proposed rule.

## Request body

- SecurityMonitoringBatchMigrationCreateRequest: Request to create a batch migration.
  - `data` SecurityMonitoringBatchMigrationCreateData, required: Data of the batch migration to create.
    - `attributes` SecurityMonitoringBatchMigrationCreateAttributes, required: Attributes of the batch migration to create.
      - `description` string: The description of the batch migration.
      - `name` string: The name of the batch migration.
      - `resources` SecurityMonitoringBatchMigrationResourceCreateItem[], required: The initial resources of the batch migration. From 1 to 100 resources.
        - `description` string: The description of the resource.
        - `input` string, required: The source query or natural language description to translate. Must not be blank.
        - `inputType` 'natural_language' | 'spl' | 'kql', required: The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
        - `name` string: The name of the resource.
      - `tags` string[]: Tags of the batch migration. Up to 50 tags, each up to 256 characters.
    - `type` 'batchMigration', required: The type of resource for a batch migration.

## Response `201`

Created

- SecurityMonitoringBatchMigrationResponse: Response containing a batch migration.
  - `data` SecurityMonitoringBatchMigrationData, required: A batch migration.
    - `attributes` SecurityMonitoringBatchMigrationAttributes, required: Attributes of a batch migration.
      - `createdAt` string, date-time, required: The creation date of the batch migration, in RFC 3339 format.
      - `createdBy` string: The UUID of the user or service account who created the batch migration.
      - `description` string: The description of the batch migration.
      - `inputSource` 'batch_migration' | 'threat_hunting' | 'user', required: The origin of a batch migration. Always `batch_migration` for batch migrations created through this API.
      - `lastUpdatedAt` string, date-time, required: The last update date of the batch migration, in RFC 3339 format.
      - `lastUpdatedBy` string: The UUID of the user or service account who last updated the batch migration, or the name of a system actor.
      - `name` string, required: The name of the batch migration.
      - `orgId` integer, required: The ID of the organization that owns the batch migration.
      - `resourceStatusCounts` SecurityMonitoringBatchMigrationResourceStatusCounts, required: The number of resources of a batch migration in each status.
        - `canceled` integer, required: Number of resources whose translation was canceled.
        - `completed` integer, required: Number of resources translated and ready to be published.
        - `duplicate` integer, required: Number of resources identified as duplicates of an existing rule. Reserved for future use.
        - `failed` integer, required: Number of resources whose translation failed.
        - `inProgress` integer, required: Number of resources being translated.
        - `pending` integer, required: Number of resources waiting to be translated.
        - `published` integer, required: Number of resources published as Cloud SIEM detection rules.
        - `publishing` integer, required: Number of resources being published.
      - `status` 'draft' | 'in_progress' | 'canceled' | 'completed', required: The status of a batch migration. A batch migration is created as `draft` and moves to `in_progress` when started. It moves to `completed` once no resource is `pending` or `in_progress`, or to `canceled` when canceled.
      - `tags` string[], required: Tags of the batch migration. Up to 50 tags, each up to 256 characters.
    - `id` string, uuid, required: The UUID of the batch migration.
    - `type` 'batchMigration', required: The type of resource for a batch migration.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)