Add role policy type to org group policies

.generator/schemas/v2/openapi.yaml

@@ -1394,6 +1394,16 @@ components:
       schema:
         example: monitor_timezone
         type: string
+    OrgGroupPolicyFilterPolicyType:
+      description: Filter policies by policy type. Supported values are `org_config` and `role`.
+      in: query
+      name: filter[policy_type]
+      required: false
+      schema:
+        $ref: "#/components/schemas/OrgGroupPolicyFilterPolicyTypeValue"
+        x-enum-varnames:
+          - ORG_CONFIG
+          - ROLE
     OrgGroupPolicyId:
       description: The ID of the org group policy.
       in: path
@@ -79520,7 +79530,8 @@ components:
       properties:
         content:
           additionalProperties: {}
-          description: The policy content as key-value pairs.
+          description: >-
+            The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
           example:
             value: "UTC"
           type: object
@@ -79532,7 +79543,8 @@ components:
           format: date-time
           type: string
         policy_name:
-          description: The name of the policy.
+          description: >-
+            The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role).
           example: "monitor_timezone"
           type: string
         policy_type:
@@ -79612,18 +79624,20 @@ components:
         - ORG_GROUP_POLICY_CONFIGS
     OrgGroupPolicyCreateAttributes:
       description: >-
-        Attributes for creating an org group policy. If `policy_type` or `enforcement_tier` are not provided, they default to `org_config` and `DEFAULT` respectively.
+        Attributes for creating an org group policy. If `policy_type` is not provided, it defaults to `org_config`. `enforcement_tier` is optional; if not provided, the resulting value depends on `policy_type` and is otherwise unspecified.
       properties:
         content:
           additionalProperties: {}
-          description: The policy content as key-value pairs.
+          description: >-
+            The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
           example:
             value: "UTC"
           type: object
         enforcement_tier:
           $ref: "#/components/schemas/OrgGroupPolicyEnforcementTier"
         policy_name:
-          description: The name of the policy.
+          description: >-
+            The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role).
           example: "monitor_timezone"
           type: string
         policy_type:
@@ -79682,9 +79696,8 @@ components:
         - attributes
       type: object
     OrgGroupPolicyEnforcementTier:
-      default: OVERRIDE_ALLOWED
       description: >-
-        The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value.
+        The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value. `role` policies only support `GROUP_MANAGED` and `DELEGATE` — `OVERRIDE_ALLOWED` is rejected for this policy type. Transitioning a `role` policy to `DELEGATE` (disabling it) is one-way — the policy cannot be transitioned back to `GROUP_MANAGED` afterward.
       enum:
         - OVERRIDE_ALLOWED
         - GROUP_MANAGED
@@ -79695,6 +79708,17 @@ components:
         - OVERRIDE_ALLOWED
         - GROUP_MANAGED
         - DELEGATE
+    OrgGroupPolicyFilterPolicyTypeValue:
+      description: >-
+        The type of the policy to filter by. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role.
+      enum:
+        - org_config
+        - role
+      example: org_config
+      type: string
+      x-enum-varnames:
+        - ORG_CONFIG
+        - ROLE
     OrgGroupPolicyListResponse:
       description: Response containing a list of org group policies.
       properties:
@@ -79909,13 +79933,15 @@ components:
     OrgGroupPolicyPolicyType:
       default: org_config
       description: >-
-        The type of the policy. Only `org_config` is supported, indicating a policy backed by an organization configuration setting.
+        The type of the policy. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role.
       enum:
         - org_config
+        - role
       example: org_config
       type: string
       x-enum-varnames:
         - ORG_CONFIG
+        - ROLE
     OrgGroupPolicyRelationshipToOne:
       description: Relationship to a single org group policy.
       properties:
@@ -80056,16 +80082,23 @@ components:
       x-enum-varnames:
         - ORG_GROUP_POLICIES
     OrgGroupPolicyUpdateAttributes:
-      description: Attributes for updating an org group policy.
+      description: >-
+        Attributes for updating an org group policy. `policy_name`, `content`, and `enforcement_tier` may be omitted individually to leave them unchanged.
       properties:
         content:
           additionalProperties: {}
-          description: The policy content as key-value pairs.
+          description: >-
+            The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
           example:
             value: "UTC"
           type: object
         enforcement_tier:
           $ref: "#/components/schemas/OrgGroupPolicyEnforcementTier"
+        policy_name:
+          description: >-
+            The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role). Omit to leave unchanged.
+          example: "monitor_timezone"
+          type: string
       type: object
     OrgGroupPolicyUpdateData:
       description: Data for updating an org group policy.
@@ -182060,6 +182093,7 @@ paths:
       parameters:
         - $ref: "#/components/parameters/OrgGroupPolicyFilterOrgGroupId"
         - $ref: "#/components/parameters/OrgGroupPolicyFilterPolicyName"
+        - $ref: "#/components/parameters/OrgGroupPolicyFilterPolicyType"
         - $ref: "#/components/parameters/OrgGroupPageNumber"
         - $ref: "#/components/parameters/OrgGroupPageSize"
         - $ref: "#/components/parameters/PolicySort"
@@ -182140,7 +182174,7 @@ paths:
         content:
           application/json:
             examples:
-              default:
+              org_config:
                 value:
                   data:
                     attributes:
@@ -182155,6 +182189,22 @@ paths:
                           id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
                           type: org_groups
                     type: org_group_policies
+              role:
+                value:
+                  data:
+                    attributes:
+                      content:
+                        permissions:
+                          - "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                      enforcement_tier: "GROUP_MANAGED"
+                      policy_name: "finance_read_only"
+                      policy_type: "role"
+                    relationships:
+                      org_group:
+                        data:
+                          id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
+                          type: org_groups
+                    type: org_group_policies
             schema:
               $ref: "#/components/schemas/OrgGroupPolicyCreateRequest"
         required: true
@@ -182180,6 +182230,24 @@ paths:
                             id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
                             type: org_groups
                       type: org_group_policies
+                role:
+                  value:
+                    data:
+                      attributes:
+                        content:
+                          permissions:
+                            - "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                        enforcement_tier: "GROUP_MANAGED"
+                        modified_at: "2024-01-15T10:30:00Z"
+                        policy_name: "finance_read_only"
+                        policy_type: "role"
+                      id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                      relationships:
+                        org_group:
+                          data:
+                            id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
+                            type: org_groups
+                      type: org_group_policies
               schema:
                 $ref: "#/components/schemas/OrgGroupPolicyResponse"
           description: Created
@@ -182336,13 +182404,25 @@ paths:
         content:
           application/json:
             examples:
-              default:
+              org_config:
                 value:
                   data:
                     attributes:
                       content:
                         value: "US/Eastern"
                       enforcement_tier: "GROUP_MANAGED"
+                      policy_name: "monitor_timezone"
+                    id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                    type: org_group_policies
+              role:
+                value:
+                  data:
+                    attributes:
+                      content:
+                        permissions:
+                          - "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                          - "2b3c4d5e-6f78-90ab-cdef-0123456789ab"
+                      enforcement_tier: "GROUP_MANAGED"
                     id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
                     type: org_group_policies
             schema:
@@ -182370,6 +182450,25 @@ paths:
                             id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
                             type: org_groups
                       type: org_group_policies
+                role:
+                  value:
+                    data:
+                      attributes:
+                        content:
+                          permissions:
+                            - "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                            - "2b3c4d5e-6f78-90ab-cdef-0123456789ab"
+                        enforcement_tier: "GROUP_MANAGED"
+                        modified_at: "2024-01-16T14:00:00Z"
+                        policy_name: "finance_read_only"
+                        policy_type: "role"
+                      id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789"
+                      relationships:
+                        org_group:
+                          data:
+                            id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789"
+                            type: org_groups
+                      type: org_group_policies
               schema:
                 $ref: "#/components/schemas/OrgGroupPolicyResponse"
           description: OK

features/v2/org_groups.feature

@@ -414,7 +414,7 @@ Feature: Org Groups
     Given operation "UpdateOrgGroupPolicy" enabled
     And new "UpdateOrgGroupPolicy" request
     And request contains "org_group_policy_id" parameter from "REPLACE.ME"
-    And body with value {"data": {"attributes": {"content": {"value": "UTC"}, "enforcement_tier": "OVERRIDE_ALLOWED"}, "id": "1a2b3c4d-5e6f-7890-abcd-ef0123456789", "type": "org_group_policies"}}
+    And body with value {"data": {"attributes": {"content": {"value": "UTC"}, "enforcement_tier": "OVERRIDE_ALLOWED", "policy_name": "monitor_timezone"}, "id": "1a2b3c4d-5e6f-7890-abcd-ef0123456789", "type": "org_group_policies"}}
     When the request is sent
     Then the response status is 400 Bad Request
 
@@ -423,7 +423,7 @@ Feature: Org Groups
     Given operation "UpdateOrgGroupPolicy" enabled
     And new "UpdateOrgGroupPolicy" request
     And request contains "org_group_policy_id" parameter from "REPLACE.ME"
-    And body with value {"data": {"attributes": {"content": {"value": "UTC"}, "enforcement_tier": "OVERRIDE_ALLOWED"}, "id": "1a2b3c4d-5e6f-7890-abcd-ef0123456789", "type": "org_group_policies"}}
+    And body with value {"data": {"attributes": {"content": {"value": "UTC"}, "enforcement_tier": "OVERRIDE_ALLOWED", "policy_name": "monitor_timezone"}, "id": "1a2b3c4d-5e6f-7890-abcd-ef0123456789", "type": "org_group_policies"}}
     When the request is sent
     Then the response status is 404 Not Found
 
@@ -432,7 +432,7 @@ Feature: Org Groups
     Given operation "UpdateOrgGroupPolicy" enabled
     And new "UpdateOrgGroupPolicy" request
     And request contains "org_group_policy_id" parameter from "REPLACE.ME"
-    And body with value {"data": {"attributes": {"content": {"value": "UTC"}, "enforcement_tier": "OVERRIDE_ALLOWED"}, "id": "1a2b3c4d-5e6f-7890-abcd-ef0123456789", "type": "org_group_policies"}}
+    And body with value {"data": {"attributes": {"content": {"value": "UTC"}, "enforcement_tier": "OVERRIDE_ALLOWED", "policy_name": "monitor_timezone"}, "id": "1a2b3c4d-5e6f-7890-abcd-ef0123456789", "type": "org_group_policies"}}
     When the request is sent
     Then the response status is 200 OK
 

private/bdd_runner/src/support/scenarios_model_mapping.ts

@@ -14121,6 +14121,10 @@ export const ScenariosModelMappings: { [key: string]: OperationMapping } = {
       type: "string",
       format: "",
     },
+    filterPolicyType: {
+      type: "OrgGroupPolicyFilterPolicyTypeValue",
+      format: "",
+    },
     pageNumber: {
       type: "number",
       format: "int64",

services/org_groups/src/v2/OrgGroupsApi.ts

@@ -33,6 +33,7 @@ import { OrgGroupMembershipSortOption } from "./models/OrgGroupMembershipSortOpt
 import { OrgGroupMembershipUpdateRequest } from "./models/OrgGroupMembershipUpdateRequest";
 import { OrgGroupPolicyConfigListResponse } from "./models/OrgGroupPolicyConfigListResponse";
 import { OrgGroupPolicyCreateRequest } from "./models/OrgGroupPolicyCreateRequest";
+import { OrgGroupPolicyFilterPolicyTypeValue } from "./models/OrgGroupPolicyFilterPolicyTypeValue";
 import { OrgGroupPolicyListResponse } from "./models/OrgGroupPolicyListResponse";
 import { OrgGroupPolicyOverrideCreateRequest } from "./models/OrgGroupPolicyOverrideCreateRequest";
 import { OrgGroupPolicyOverrideListResponse } from "./models/OrgGroupPolicyOverrideListResponse";
@@ -810,6 +811,7 @@ export class OrgGroupsApiRequestFactory extends BaseAPIRequestFactory {
   public async listOrgGroupPolicies(
     filterOrgGroupId: string,
     filterPolicyName?: string,
+    filterPolicyType?: OrgGroupPolicyFilterPolicyTypeValue,
     pageNumber?: number,
     pageSize?: number,
     sort?: OrgGroupPolicySortOption,
@@ -869,6 +871,18 @@ export class OrgGroupsApiRequestFactory extends BaseAPIRequestFactory {
         "",
       );
     }
+    if (filterPolicyType !== undefined) {
+      requestContext.setQueryParam(
+        "filter[policy_type]",
+        serialize(
+          filterPolicyType,
+          TypingInfo,
+          "OrgGroupPolicyFilterPolicyTypeValue",
+          "",
+        ),
+        "",
+      );
+    }
     if (pageNumber !== undefined) {
       requestContext.setQueryParam(
         "page[number]",
@@ -3285,6 +3299,11 @@ export interface OrgGroupsApiListOrgGroupPoliciesRequest {
    * @type string
    */
   filterPolicyName?: string;
+  /**
+   * Filter policies by policy type. Supported values are `org_config` and `role`.
+   * @type OrgGroupPolicyFilterPolicyTypeValue
+   */
+  filterPolicyType?: OrgGroupPolicyFilterPolicyTypeValue;
   /**
    * The page number to return.
    * @type number
@@ -3697,6 +3716,7 @@ export class OrgGroupsApi {
     const requestContextPromise = this.requestFactory.listOrgGroupPolicies(
       param.filterOrgGroupId,
       param.filterPolicyName,
+      param.filterPolicyType,
       param.pageNumber,
       param.pageSize,
       param.sort,

services/org_groups/src/v2/index.ts

@@ -62,6 +62,7 @@ export { OrgGroupPolicyCreateRelationships } from "./models/OrgGroupPolicyCreate
 export { OrgGroupPolicyCreateRequest } from "./models/OrgGroupPolicyCreateRequest";
 export { OrgGroupPolicyData } from "./models/OrgGroupPolicyData";
 export { OrgGroupPolicyEnforcementTier } from "./models/OrgGroupPolicyEnforcementTier";
+export { OrgGroupPolicyFilterPolicyTypeValue } from "./models/OrgGroupPolicyFilterPolicyTypeValue";
 export { OrgGroupPolicyListResponse } from "./models/OrgGroupPolicyListResponse";
 export { OrgGroupPolicyOverrideAttributes } from "./models/OrgGroupPolicyOverrideAttributes";
 export { OrgGroupPolicyOverrideCreateAttributes } from "./models/OrgGroupPolicyOverrideCreateAttributes";

services/org_groups/src/v2/models/OrgGroupPolicyAttributes.ts

@@ -8,23 +8,23 @@ import { OrgGroupPolicyPolicyType } from "./OrgGroupPolicyPolicyType";
  */
 export class OrgGroupPolicyAttributes {
   /**
-   * The policy content as key-value pairs.
+   * The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["<uuid>", ...]}`).
    */
   "content"?: { [key: string]: any };
   /**
-   * The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value.
+   * The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value. `role` policies only support `GROUP_MANAGED` and `DELEGATE` — `OVERRIDE_ALLOWED` is rejected for this policy type. Transitioning a `role` policy to `DELEGATE` (disabling it) is one-way — the policy cannot be transitioned back to `GROUP_MANAGED` afterward.
    */
   "enforcementTier": OrgGroupPolicyEnforcementTier;
   /**
    * Timestamp when the policy was last modified.
    */
   "modifiedAt": Date;
   /**
-   * The name of the policy.
+   * The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role).
    */
   "policyName": string;
   /**
-   * The type of the policy. Only `org_config` is supported, indicating a policy backed by an organization configuration setting.
+   * The type of the policy. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role.
    */
   "policyType": OrgGroupPolicyPolicyType;
   /**