Update ListAssetsSBOMs spec - require asset_type on first page, add ServerlessFunction asset type

.generator/schemas/v2/openapi.yaml

@@ -10502,6 +10502,7 @@ components:
         - Host
         - HostImage
         - Image
+        - ServerlessFunction
       example: Repository
       type: string
       x-enum-varnames:
@@ -10510,6 +10511,7 @@ components:
         - HOST
         - HOSTIMAGE
         - IMAGE
+        - SERVERLESSFUNCTION
     AssetVersion:
       description: Asset version.
       properties:
@@ -175616,6 +175618,11 @@ paths:
       description: |-
         Get a list of assets SBOMs for an organization.
 
+        The `filter[asset_type]` parameter is required for initial requests (when no `page[token]` is provided).
+        Subsequent pages encode the asset type in the pagination token, so `filter[asset_type]` is not required
+        for paginated requests. Mixing infrastructure asset types (`Host`, `HostImage`, `Image`, `ServerlessFunction`)
+        with code asset types (`Repository`, `Service`) in the same request is not supported and returns a 400 error.
+
         ### Pagination
 
         Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint.
@@ -175645,7 +175652,8 @@ paths:
             format: int64
             minimum: 1
             type: integer
-        - description: The type of the assets for the SBOM request.
+        - description: >-
+            The type of the assets for the SBOM request. Required for initial requests (when no `page[token]` is provided). Infrastructure types (`Host`, `HostImage`, `Image`, `ServerlessFunction`) and code types (`Repository`, `Service`) cannot be mixed in the same request.
           example: Repository
           in: query
           name: filter[asset_type]

src/datadog_api_client/v2/api/security_monitoring_api.py

@@ -6630,6 +6630,11 @@ def list_assets_sbo_ms(
 
         Get a list of assets SBOMs for an organization.
 
+        The ``filter[asset_type]`` parameter is required for initial requests (when no ``page[token]`` is provided).
+        Subsequent pages encode the asset type in the pagination token, so ``filter[asset_type]`` is not required
+        for paginated requests. Mixing infrastructure asset types ( ``Host`` , ``HostImage`` , ``Image`` , ``ServerlessFunction`` )
+        with code asset types ( ``Repository`` , ``Service`` ) in the same request is not supported and returns a 400 error.
+
         **Pagination**
 
         Please review the `Pagination section <#pagination>`_ for the "List Vulnerabilities" endpoint.
@@ -6646,7 +6651,7 @@ def list_assets_sbo_ms(
         :type page_token: str, optional
         :param page_number: The page number to be retrieved. It should be equal to or greater than 1.
         :type page_number: int, optional
-        :param filter_asset_type: The type of the assets for the SBOM request.
+        :param filter_asset_type: The type of the assets for the SBOM request. Required for initial requests (when no ``page[token]`` is provided). Infrastructure types ( ``Host`` , ``HostImage`` , ``Image`` , ``ServerlessFunction`` ) and code types ( ``Repository`` , ``Service`` ) cannot be mixed in the same request.
         :type filter_asset_type: AssetType, optional
         :param filter_asset_name: The name of the asset for the SBOM request.
         :type filter_asset_name: str, optional

src/datadog_api_client/v2/model/asset_type.py

@@ -16,7 +16,7 @@ class AssetType(ModelSimple):
     """
     The asset type
 
-    :param value: Must be one of ["Repository", "Service", "Host", "HostImage", "Image"].
+    :param value: Must be one of ["Repository", "Service", "Host", "HostImage", "Image", "ServerlessFunction"].
     :type value: str
     """
 
@@ -26,12 +26,14 @@ class AssetType(ModelSimple):
         "Host",
         "HostImage",
         "Image",
+        "ServerlessFunction",
     }
     REPOSITORY: ClassVar["AssetType"]
     SERVICE: ClassVar["AssetType"]
     HOST: ClassVar["AssetType"]
     HOSTIMAGE: ClassVar["AssetType"]
     IMAGE: ClassVar["AssetType"]
+    SERVERLESSFUNCTION: ClassVar["AssetType"]
 
     @cached_property
     def openapi_types(_):
@@ -45,3 +47,4 @@ def openapi_types(_):
 AssetType.HOST = AssetType("Host")
 AssetType.HOSTIMAGE = AssetType("HostImage")
 AssetType.IMAGE = AssetType("Image")
+AssetType.SERVERLESSFUNCTION = AssetType("ServerlessFunction")

tests/v2/cassettes/test_scenarios/test_list_assets_sboms_returns_bad_request_invalid_pagination_token_response.frozen

@@ -1 +1 @@
-2026-07-06T19:25:16.964Z
+2026-07-07T14:35:06.517Z

tests/v2/cassettes/test_scenarios/test_list_assets_sboms_returns_bad_request_invalid_pagination_token_response.yaml

@@ -5,11 +5,10 @@ interactions:
       accept:
       - application/json
     method: GET
-    uri: https://api.datadoghq.com/api/v2/security/sboms?page%5Btoken%5D=unknown&page%5Bnumber%5D=1
+    uri: https://api.datadoghq.com/api/v2/security/sboms?page%5Btoken%5D=SERVICE%3Aunknown&page%5Bnumber%5D=1
   response:
     body:
-      string: '{"errors":[{"status":"400","title":"Bad request: asset_type","detail":"asset_type
-        filter is required"}]}'
+      string: '{"errors":[{"status":"400","title":"Unexpected internal error"}]}'
     headers:
       content-type:
       - application/vnd.api+json

tests/v2/cassettes/test_scenarios/test_list_assets_sboms_returns_ok_response.frozen

@@ -1 +1 @@
-2026-01-20T08:27:19.760Z
+2026-07-07T14:35:10.638Z

tests/v2/features/security_monitoring.feature

@@ -2369,7 +2369,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-vm
   Scenario: List assets SBOMs returns "Bad request: Invalid pagination token." response
     Given new "ListAssetsSBOMs" request
-    And request contains "page[token]" parameter with value "unknown"
+    And request contains "page[token]" parameter with value "SERVICE:unknown"
     And request contains "page[number]" parameter with value 1
     When the request is sent
     Then the response status is 400 Bad request: Invalid pagination token.