From 455a4f8ee0e05dc68cea468c167d35a50de795cc Mon Sep 17 00:00:00 2001
From: Stephen Rosenthal <stephen.rosenthal@datadoghq.com>
Date: Wed, 29 Jul 2026 10:07:20 -0700
Subject: [PATCH] Send OAuth for logs saved-views create/delete

Server now accepts ValidOAuthAccessToken for POST/DELETE on
/api/v1/logs/views; remove them from OAUTH_EXCLUDED_ENDPOINTS and
add saved_views_write to default_scopes().
---
 src/auth/types.rs |  2 ++
 src/raw_client.rs | 25 +++++++------------------
 2 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/src/auth/types.rs b/src/auth/types.rs
index 6a0d195d..1e18aff5 100644
--- a/src/auth/types.rs
+++ b/src/auth/types.rs
@@ -197,6 +197,7 @@ pub fn default_scopes() -> Vec<&'static str> {
         "logs_read_index_data",
         "logs_write_archives",
         "logs_write_pipelines",
+        "saved_views_write",
         // Metrics
         "metrics_read",
         // Monitors
@@ -343,6 +344,7 @@ mod tests {
         assert!(scopes.contains(&"built_in_features"));
         // Logs
         assert!(scopes.contains(&"logs_write_pipelines"));
+        assert!(scopes.contains(&"saved_views_write"));
     }
 
     #[test]
diff --git a/src/raw_client.rs b/src/raw_client.rs
index 81ad0f9b..b70e4b73 100644
--- a/src/raw_client.rs
+++ b/src/raw_client.rs
@@ -352,16 +352,6 @@ static OAUTH_EXCLUDED_ENDPOINTS: &[EndpointRequirement] = &[
         path: "/api/v1/events",
         method: "POST",
     },
-    // Logs saved views write endpoints accept full API users, not OAuth tokens.
-    // List/get support OAuth, so only create/delete are excluded here.
-    EndpointRequirement {
-        path: "/api/v1/logs/views",
-        method: "POST",
-    },
-    EndpointRequirement {
-        path: "/api/v1/logs/views/",
-        method: "DELETE",
-    },
 ];
 
 // ---------------------------------------------------------------------------
@@ -846,11 +836,11 @@ mod tests {
     }
 
     #[test]
-    fn test_fallback_for_logs_saved_views_writes() {
+    fn test_no_fallback_for_logs_saved_views() {
         assert!(!requires_api_key_fallback("GET", "/api/v1/logs/views"));
         assert!(!requires_api_key_fallback("GET", "/api/v1/logs/views/123"));
-        assert!(requires_api_key_fallback("POST", "/api/v1/logs/views"));
-        assert!(requires_api_key_fallback(
+        assert!(!requires_api_key_fallback("POST", "/api/v1/logs/views"));
+        assert!(!requires_api_key_fallback(
             "DELETE",
             "/api/v1/logs/views/123"
         ));
@@ -887,7 +877,7 @@ mod tests {
 
     #[test]
     fn test_oauth_excluded_count() {
-        assert_eq!(OAUTH_EXCLUDED_ENDPOINTS.len(), 57);
+        assert_eq!(OAUTH_EXCLUDED_ENDPOINTS.len(), 55);
     }
 
     #[test]
@@ -1026,16 +1016,15 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_raw_delete_uses_api_key_fallback() {
+    async fn test_raw_delete_uses_oauth_bearer() {
         let _lock = lock_env().await;
         let mut server = mockito::Server::new_async().await;
         let mut cfg = test_config(&server.url());
         cfg.access_token = Some("token".into());
         let mock = server
             .mock("DELETE", "/api/v1/logs/views/123")
-            .match_header("DD-API-KEY", "test-api-key")
-            .match_header("DD-APPLICATION-KEY", "test-app-key")
-            .match_header("Authorization", mockito::Matcher::Missing)
+            .match_header("Authorization", "Bearer token")
+            .match_header("DD-API-KEY", mockito::Matcher::Missing)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"deleted_logs_saved_view_id":123}"#)