---
title: "Create an entity context sync configuration"
method: POST
path: "/api/v2/security_monitoring/configuration/integration_config"
tags: ["Security Monitoring"]
---

# Create an entity context sync configuration

`POST /api/v2/security_monitoring/configuration/integration_config`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/configuration/integration_config`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `manage_integrations`

Create a new entity context sync configuration so Cloud SIEM can ingest entities from an external
source. The credentials provided in `secrets` are validated against the source before the configuration
is stored and never returned in subsequent responses.

## Request body

- SecurityMonitoringIntegrationConfigCreateRequest: Request body to create an entity context sync configuration.
  - `data` SecurityMonitoringIntegrationConfigCreateData, required: The entity context sync configuration to create.
    - `attributes` SecurityMonitoringIntegrationConfigCreateAttributes, required: The attributes of the entity context sync configuration to create.
      - `domain` string, required: The domain associated with the external entity source.
      - `integration_type` 'GOOGLE_WORKSPACE' | 'OKTA' | 'ENTRA_ID', required: The type of external source that provides entities to Cloud SIEM.
      - `name` string, required: The display name for the entity context sync configuration.
      - `secrets` SecurityMonitoringIntegrationConfigSecrets: The secrets used to authenticate against the external entity source. The accepted keys depend on the source type (for example, `admin_email` for Google Workspace). Not required for source types that do not use secrets (for example, `ENTRA_ID`).
      - `settings` SecurityMonitoringIntegrationConfigSettings: Free-form, non-sensitive settings for the entity context sync. The accepted keys depend on the source type.
    - `type` 'integration_config', required: The type of the resource. The value should always be `integration_config`.

## Response `200`

OK

- SecurityMonitoringIntegrationConfigResponse: Response containing a single entity context sync configuration.
  - `data` SecurityMonitoringIntegrationConfigData, required: An entity context sync configuration.
    - `attributes` SecurityMonitoringIntegrationConfigAttributes, required: The attributes of an entity context sync configuration as returned by the API.
      - `created_at` string, date-time: The time at which the entity context sync configuration was created.
      - `domain` string, required: The domain associated with the external entity source (for example, the customer's identity provider domain).
      - `enabled` boolean, required: Whether the sync is enabled and actively ingesting entities into Cloud SIEM.
      - `integration_type` 'GOOGLE_WORKSPACE' | 'OKTA' | 'ENTRA_ID', required: The type of external source that provides entities to Cloud SIEM.
      - `modified_at` string, date-time: The time at which the entity context sync configuration was last modified.
      - `name` string: The display name of the entity context sync configuration.
      - `settings` SecurityMonitoringIntegrationConfigSettings: Free-form, non-sensitive settings for the entity context sync. The accepted keys depend on the source type.
      - `state` 'valid' | 'invalid' | 'initializing': The state of the credentials configured on the entity context sync.
    - `id` string, required: The unique identifier of the integration configuration.
    - `type` 'integration_config', required: The type of the resource. The value should always be `integration_config`.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)