---
title: "Create a critical asset"
method: POST
path: "/api/v2/security_monitoring/configuration/critical_assets"
tags: ["Security Monitoring"]
---

# Create a critical asset

`POST /api/v2/security_monitoring/configuration/critical_assets`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/configuration/critical_assets`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_critical_assets_write`

Create a new critical asset.

## Request body

- SecurityMonitoringCriticalAssetCreateRequest: Request object that includes the critical asset that you would like to create.
  - `data` SecurityMonitoringCriticalAssetCreateData, required: Object for a single critical asset.
    - `attributes` SecurityMonitoringCriticalAssetCreateAttributes, required: Object containing the attributes of the critical asset to be created.
      - `description` string: A description of the critical asset.
      - `enabled` boolean: Whether the critical asset is enabled. Defaults to `true` if not specified.
      - `query` string, required: The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer.
      - `rule_query` string, required: The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to.
      - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical' | 'increase' | 'decrease' | 'no-op', required: Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op).
      - `tags` string[]: List of tags associated with the critical asset.
    - `type` 'critical_assets', required: The type of the resource. The value should always be `critical_assets`.

## Response `200`

OK

- SecurityMonitoringCriticalAssetResponse: Response object containing a single critical asset.
  - `data` SecurityMonitoringCriticalAsset: The critical asset's properties.
    - `attributes` SecurityMonitoringCriticalAssetAttributes: The attributes of the critical asset.
      - `creation_author_id` integer: ID of user who created the critical asset.
      - `creation_date` integer: A Unix millisecond timestamp given the creation date of the critical asset.
      - `creator` SecurityMonitoringUser: A user.
        - `handle` string: The handle of the user.
        - `name` string, nullable: The name of the user.
      - `description` string: A description of the critical asset.
      - `enabled` boolean: Whether the critical asset is enabled.
      - `query` string: The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer.
      - `rule_query` string: The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to.
      - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical' | 'increase' | 'decrease' | 'no-op': Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op).
      - `tags` string[]: List of tags associated with the critical asset.
      - `update_author_id` integer: ID of user who updated the critical asset.
      - `update_date` integer: A Unix millisecond timestamp given the update date of the critical asset.
      - `updater` SecurityMonitoringUser: A user.
        - `handle` string: The handle of the user.
        - `name` string, nullable: The name of the user.
      - `version` integer: The version of the critical asset; it starts at 1, and is incremented at each update.
    - `id` string: The ID of the critical asset.
    - `type` 'critical_assets': The type of the resource. The value should always be `critical_assets`.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)