diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index a04387a6880b..77a2549ffafd 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -48659,6 +48659,16 @@ components:
           description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `plain`).
           example: HTTP_AUTH_USERNAME
           type: string
+        valid_tokens:
+          description: |-
+            A list of tokens that are accepted for authenticating incoming HTTP requests. When set,
+            the source rejects any request whose token does not match an enabled entry in this list.
+            Cannot be combined with the `plain` auth strategy.
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidToken"
+          maxItems: 1000
+          minItems: 1
+          type: array
       required:
         - id
         - type
@@ -48684,6 +48694,55 @@ components:
       type: string
       x-enum-varnames:
         - HTTP_SERVER
+    ObservabilityPipelineHttpServerSourceValidToken:
+      description: An accepted token used to authenticate incoming HTTP server requests.
+      properties:
+        enabled:
+          default: true
+          description: |-
+            Whether this token is currently accepted. Disabled tokens are rejected without
+            being removed from the configuration.
+          example: true
+          type: boolean
+        field_to_add:
+          $ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd"
+        path_to_token:
+          $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToToken"
+        token_key:
+          description: Name of the environment variable or secret that holds the expected token value.
+          example: HTTP_SERVER_TOKEN
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+      required:
+        - token_key
+      type: object
+    ObservabilityPipelineHttpServerSourceValidTokenPathToToken:
+      description: |-
+        Specifies where the worker extracts the token from in the incoming HTTP request.
+        Either a built-in location (`path` or `address`) or an HTTP header object.
+      oneOf:
+        - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation"
+        - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader"
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader:
+      description: Extract the token from a specific HTTP request header.
+      properties:
+        header:
+          description: The name of the HTTP header that carries the token.
+          example: X-Token
+          type: string
+      required:
+        - header
+      type: object
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation:
+      description: Built-in token location on the incoming HTTP request.
+      enum:
+        - path
+        - address
+      example: path
+      type: string
+      x-enum-varnames:
+        - PATH
+        - ADDRESS
     ObservabilityPipelineKafkaDestination:
       description: |-
         The `kafka` destination sends logs to Apache Kafka topics.
@@ -50707,6 +50766,27 @@ components:
       type: string
       x-enum-varnames:
         - SOCKET
+    ObservabilityPipelineSourceValidTokenFieldToAdd:
+      description: |-
+        An optional metadata field that is attached to every event authenticated by the
+        associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+      properties:
+        key:
+          description: The metadata field name to add to incoming events.
+          example: token_name
+          maxLength: 256
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+        value:
+          description: The metadata field value to add to incoming events.
+          example: my_token
+          maxLength: 1024
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+      required:
+        - key
+        - value
+      type: object
     ObservabilityPipelineSpec:
       description: Input schema representing an observability pipeline configuration. Used in create and validate requests.
       properties:
@@ -50903,6 +50983,15 @@ components:
           $ref: "#/components/schemas/ObservabilityPipelineTls"
         type:
           $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceType"
+        valid_tokens:
+          description: |-
+            A list of tokens that are accepted for authenticating incoming HEC requests. When set, the source
+            rejects any request whose HEC token does not match an enabled entry in this list.
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceValidToken"
+          maxItems: 1000
+          minItems: 1
+          type: array
       required:
         - id
         - type
@@ -50917,6 +51006,26 @@ components:
       type: string
       x-enum-varnames:
         - SPLUNK_HEC
+    ObservabilityPipelineSplunkHecSourceValidToken:
+      description: An accepted HEC token used to authenticate incoming Splunk HEC requests.
+      properties:
+        enabled:
+          default: true
+          description: |-
+            Whether this token is currently accepted. Disabled tokens are rejected without
+            being removed from the configuration.
+          example: true
+          type: boolean
+        field_to_add:
+          $ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd"
+        token_key:
+          description: Name of the environment variable or secret that holds the expected HEC token value.
+          example: SPLUNK_HEC_TOKEN
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+      required:
+        - token_key
+      type: object
     ObservabilityPipelineSplunkTcpSource:
       description: |-
         The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.
diff --git a/lib/datadog_api_client/inflector.rb b/lib/datadog_api_client/inflector.rb
index 392c822b590f..69c321ee3656 100644
--- a/lib/datadog_api_client/inflector.rb
+++ b/lib/datadog_api_client/inflector.rb
@@ -4098,6 +4098,10 @@ def overrides
           "v2.observability_pipeline_http_server_source" => "ObservabilityPipelineHttpServerSource",
           "v2.observability_pipeline_http_server_source_auth_strategy" => "ObservabilityPipelineHttpServerSourceAuthStrategy",
           "v2.observability_pipeline_http_server_source_type" => "ObservabilityPipelineHttpServerSourceType",
+          "v2.observability_pipeline_http_server_source_valid_token" => "ObservabilityPipelineHttpServerSourceValidToken",
+          "v2.observability_pipeline_http_server_source_valid_token_path_to_token" => "ObservabilityPipelineHttpServerSourceValidTokenPathToToken",
+          "v2.observability_pipeline_http_server_source_valid_token_path_to_token_header" => "ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader",
+          "v2.observability_pipeline_http_server_source_valid_token_path_to_token_location" => "ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation",
           "v2.observability_pipeline_kafka_destination" => "ObservabilityPipelineKafkaDestination",
           "v2.observability_pipeline_kafka_destination_compression" => "ObservabilityPipelineKafkaDestinationCompression",
           "v2.observability_pipeline_kafka_destination_encoding" => "ObservabilityPipelineKafkaDestinationEncoding",
@@ -4223,6 +4227,7 @@ def overrides
           "v2.observability_pipeline_socket_source_framing_octet_counting_method" => "ObservabilityPipelineSocketSourceFramingOctetCountingMethod",
           "v2.observability_pipeline_socket_source_mode" => "ObservabilityPipelineSocketSourceMode",
           "v2.observability_pipeline_socket_source_type" => "ObservabilityPipelineSocketSourceType",
+          "v2.observability_pipeline_source_valid_token_field_to_add" => "ObservabilityPipelineSourceValidTokenFieldToAdd",
           "v2.observability_pipeline_spec" => "ObservabilityPipelineSpec",
           "v2.observability_pipeline_spec_data" => "ObservabilityPipelineSpecData",
           "v2.observability_pipeline_split_array_processor" => "ObservabilityPipelineSplitArrayProcessor",
@@ -4234,6 +4239,7 @@ def overrides
           "v2.observability_pipeline_splunk_hec_destination_type" => "ObservabilityPipelineSplunkHecDestinationType",
           "v2.observability_pipeline_splunk_hec_source" => "ObservabilityPipelineSplunkHecSource",
           "v2.observability_pipeline_splunk_hec_source_type" => "ObservabilityPipelineSplunkHecSourceType",
+          "v2.observability_pipeline_splunk_hec_source_valid_token" => "ObservabilityPipelineSplunkHecSourceValidToken",
           "v2.observability_pipeline_splunk_tcp_source" => "ObservabilityPipelineSplunkTcpSource",
           "v2.observability_pipeline_splunk_tcp_source_type" => "ObservabilityPipelineSplunkTcpSourceType",
           "v2.observability_pipeline_sumo_logic_destination" => "ObservabilityPipelineSumoLogicDestination",
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source.rb b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source.rb
index 2416c612d24d..ffc654591e78 100644
--- a/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source.rb
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source.rb
@@ -50,6 +50,11 @@ class ObservabilityPipelineHttpServerSource
     # Name of the environment variable or secret that holds the username (used when `auth_strategy` is `plain`).
     attr_accessor :username_key
 
+    # A list of tokens that are accepted for authenticating incoming HTTP requests. When set,
+    # the source rejects any request whose token does not match an enabled entry in this list.
+    # Cannot be combined with the `plain` auth strategy.
+    attr_reader :valid_tokens
+
     attr_accessor :additional_properties
 
     # Attribute mapping from ruby-style variable name to JSON key.
@@ -64,7 +69,8 @@ def self.attribute_map
         :'password_key' => :'password_key',
         :'tls' => :'tls',
         :'type' => :'type',
-        :'username_key' => :'username_key'
+        :'username_key' => :'username_key',
+        :'valid_tokens' => :'valid_tokens'
       }
     end
 
@@ -80,7 +86,8 @@ def self.openapi_types
         :'password_key' => :'String',
         :'tls' => :'ObservabilityPipelineTls',
         :'type' => :'ObservabilityPipelineHttpServerSourceType',
-        :'username_key' => :'String'
+        :'username_key' => :'String',
+        :'valid_tokens' => :'Array<ObservabilityPipelineHttpServerSourceValidToken>'
       }
     end
 
@@ -137,6 +144,12 @@ def initialize(attributes = {})
       if attributes.key?(:'username_key')
         self.username_key = attributes[:'username_key']
       end
+
+      if attributes.key?(:'valid_tokens')
+        if (value = attributes[:'valid_tokens']).is_a?(Array)
+          self.valid_tokens = value
+        end
+      end
     end
 
     # Check to see if the all the properties in the model are valid
@@ -147,6 +160,8 @@ def valid?
       return false if @decoding.nil?
       return false if @id.nil?
       return false if @type.nil?
+      return false if !@valid_tokens.nil? && @valid_tokens.length > 1000
+      return false if !@valid_tokens.nil? && @valid_tokens.length < 1
       true
     end
 
@@ -190,6 +205,19 @@ def type=(type)
       @type = type
     end
 
+    # Custom attribute writer method with validation
+    # @param valid_tokens [Object] Object to be assigned
+    # @!visibility private
+    def valid_tokens=(valid_tokens)
+      if !valid_tokens.nil? && valid_tokens.length > 1000
+        fail ArgumentError, 'invalid value for "valid_tokens", number of items must be less than or equal to 1000.'
+      end
+      if !valid_tokens.nil? && valid_tokens.length < 1
+        fail ArgumentError, 'invalid value for "valid_tokens", number of items must be greater than or equal to 1.'
+      end
+      @valid_tokens = valid_tokens
+    end
+
     # Returns the object in the form of hash, with additionalProperties support.
     # @return [Hash] Returns the object in the form of hash
     # @!visibility private
@@ -225,6 +253,7 @@ def ==(o)
           tls == o.tls &&
           type == o.type &&
           username_key == o.username_key &&
+          valid_tokens == o.valid_tokens &&
           additional_properties == o.additional_properties
     end
 
@@ -232,7 +261,7 @@ def ==(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [address_key, auth_strategy, custom_key, decoding, id, password_key, tls, type, username_key, additional_properties].hash
+      [address_key, auth_strategy, custom_key, decoding, id, password_key, tls, type, username_key, valid_tokens, additional_properties].hash
     end
   end
 end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token.rb b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token.rb
new file mode 100644
index 000000000000..8fda2736619f
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token.rb
@@ -0,0 +1,162 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # An accepted token used to authenticate incoming HTTP server requests.
+  class ObservabilityPipelineHttpServerSourceValidToken
+    include BaseGenericModel
+
+    # Whether this token is currently accepted. Disabled tokens are rejected without
+    # being removed from the configuration.
+    attr_accessor :enabled
+
+    # An optional metadata field that is attached to every event authenticated by the
+    # associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+    attr_accessor :field_to_add
+
+    # Specifies where the worker extracts the token from in the incoming HTTP request.
+    # Either a built-in location (`path` or `address`) or an HTTP header object.
+    attr_accessor :path_to_token
+
+    # Name of the environment variable or secret that holds the expected token value.
+    attr_reader :token_key
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'enabled' => :'enabled',
+        :'field_to_add' => :'field_to_add',
+        :'path_to_token' => :'path_to_token',
+        :'token_key' => :'token_key'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'enabled' => :'Boolean',
+        :'field_to_add' => :'ObservabilityPipelineSourceValidTokenFieldToAdd',
+        :'path_to_token' => :'ObservabilityPipelineHttpServerSourceValidTokenPathToToken',
+        :'token_key' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceValidToken` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'enabled')
+        self.enabled = attributes[:'enabled']
+      end
+
+      if attributes.key?(:'field_to_add')
+        self.field_to_add = attributes[:'field_to_add']
+      end
+
+      if attributes.key?(:'path_to_token')
+        self.path_to_token = attributes[:'path_to_token']
+      end
+
+      if attributes.key?(:'token_key')
+        self.token_key = attributes[:'token_key']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @token_key.nil?
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      return false if @token_key !~ pattern
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param token_key [Object] Object to be assigned
+    # @!visibility private
+    def token_key=(token_key)
+      if token_key.nil?
+        fail ArgumentError, 'invalid value for "token_key", token_key cannot be nil.'
+      end
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      if token_key !~ pattern
+        fail ArgumentError, "invalid value for \"token_key\", must conform to the pattern #{pattern}."
+      end
+      @token_key = token_key
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          enabled == o.enabled &&
+          field_to_add == o.field_to_add &&
+          path_to_token == o.path_to_token &&
+          token_key == o.token_key &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [enabled, field_to_add, path_to_token, token_key, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token.rb b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token.rb
new file mode 100644
index 000000000000..252a3e00e9f1
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token.rb
@@ -0,0 +1,64 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Specifies where the worker extracts the token from in the incoming HTTP request.
+  # Either a built-in location (`path` or `address`) or an HTTP header object.
+  module ObservabilityPipelineHttpServerSourceValidTokenPathToToken
+    class << self
+      include BaseOneOfModel
+      include BaseOneOfModelNoDiscriminator
+
+      # List of class defined in oneOf (OpenAPI v3)
+      def openapi_one_of
+        [
+          :'ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation',
+          :'ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader'
+        ]
+      end
+      # Builds the object
+      # @param data [Mixed] Data to be matched against the list of oneOf items
+      # @return [Object] Returns the model or the data itself
+      def build(data)
+        # Go through the list of oneOf items and attempt to identify the appropriate one.
+        # Note:
+        # - We do not attempt to check whether exactly one item matches.
+        # - No advanced validation of types in some cases (e.g. "x: { type: string }" will happily match { x: 123 })
+        #   due to the way the deserialization is made in the base_object template (it just casts without verifying).
+        # - TODO: scalar values are de facto behaving as if they were nullable.
+        # - TODO: logging when debugging is set.
+        openapi_one_of.each do |klass|
+          begin
+            next if klass == :AnyType # "nullable: true"
+            typed_data = find_and_cast_into_type(klass, data)
+            next if typed_data.respond_to?(:_unparsed) && typed_data._unparsed
+            return typed_data if typed_data
+          rescue # rescue all errors so we keep iterating even if the current item lookup raises
+          end
+        end
+
+        if openapi_one_of.include?(:AnyType)
+          data
+        else
+          self._unparsed = true
+          DatadogAPIClient::UnparsedObject.new(data)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token_header.rb b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token_header.rb
new file mode 100644
index 000000000000..83fd6e1dcaa5
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token_header.rb
@@ -0,0 +1,123 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Extract the token from a specific HTTP request header.
+  class ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader
+    include BaseGenericModel
+
+    # The name of the HTTP header that carries the token.
+    attr_reader :header
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'header' => :'header'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'header' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'header')
+        self.header = attributes[:'header']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @header.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param header [Object] Object to be assigned
+    # @!visibility private
+    def header=(header)
+      if header.nil?
+        fail ArgumentError, 'invalid value for "header", header cannot be nil.'
+      end
+      @header = header
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          header == o.header &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [header, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token_location.rb b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token_location.rb
new file mode 100644
index 000000000000..f58640034be1
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_http_server_source_valid_token_path_to_token_location.rb
@@ -0,0 +1,27 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Built-in token location on the incoming HTTP request.
+  class ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation
+    include BaseEnumModel
+
+    PATH = "path".freeze
+    ADDRESS = "address".freeze
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_source_valid_token_field_to_add.rb b/lib/datadog_api_client/v2/models/observability_pipeline_source_valid_token_field_to_add.rb
new file mode 100644
index 000000000000..52a51219ea3e
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_source_valid_token_field_to_add.rb
@@ -0,0 +1,165 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # An optional metadata field that is attached to every event authenticated by the
+  # associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+  class ObservabilityPipelineSourceValidTokenFieldToAdd
+    include BaseGenericModel
+
+    # The metadata field name to add to incoming events.
+    attr_reader :key
+
+    # The metadata field value to add to incoming events.
+    attr_reader :value
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'key' => :'key',
+        :'value' => :'value'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'key' => :'String',
+        :'value' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineSourceValidTokenFieldToAdd` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'key')
+        self.key = attributes[:'key']
+      end
+
+      if attributes.key?(:'value')
+        self.value = attributes[:'value']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @key.nil?
+      return false if @key.to_s.length > 256
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      return false if @key !~ pattern
+      return false if @value.nil?
+      return false if @value.to_s.length > 1024
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      return false if @value !~ pattern
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param key [Object] Object to be assigned
+    # @!visibility private
+    def key=(key)
+      if key.nil?
+        fail ArgumentError, 'invalid value for "key", key cannot be nil.'
+      end
+      if key.to_s.length > 256
+        fail ArgumentError, 'invalid value for "key", the character length must be smaller than or equal to 256.'
+      end
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      if key !~ pattern
+        fail ArgumentError, "invalid value for \"key\", must conform to the pattern #{pattern}."
+      end
+      @key = key
+    end
+
+    # Custom attribute writer method with validation
+    # @param value [Object] Object to be assigned
+    # @!visibility private
+    def value=(value)
+      if value.nil?
+        fail ArgumentError, 'invalid value for "value", value cannot be nil.'
+      end
+      if value.to_s.length > 1024
+        fail ArgumentError, 'invalid value for "value", the character length must be smaller than or equal to 1024.'
+      end
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      if value !~ pattern
+        fail ArgumentError, "invalid value for \"value\", must conform to the pattern #{pattern}."
+      end
+      @value = value
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          key == o.key &&
+          value == o.value &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [key, value, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source.rb b/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source.rb
index c9e70f75ff81..0b9cc36a83b0 100644
--- a/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source.rb
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source.rb
@@ -39,6 +39,10 @@ class ObservabilityPipelineSplunkHecSource
     # The source type. Always `splunk_hec`.
     attr_reader :type
 
+    # A list of tokens that are accepted for authenticating incoming HEC requests. When set, the source
+    # rejects any request whose HEC token does not match an enabled entry in this list.
+    attr_reader :valid_tokens
+
     attr_accessor :additional_properties
 
     # Attribute mapping from ruby-style variable name to JSON key.
@@ -49,7 +53,8 @@ def self.attribute_map
         :'id' => :'id',
         :'store_hec_token' => :'store_hec_token',
         :'tls' => :'tls',
-        :'type' => :'type'
+        :'type' => :'type',
+        :'valid_tokens' => :'valid_tokens'
       }
     end
 
@@ -61,7 +66,8 @@ def self.openapi_types
         :'id' => :'String',
         :'store_hec_token' => :'Boolean',
         :'tls' => :'ObservabilityPipelineTls',
-        :'type' => :'ObservabilityPipelineSplunkHecSourceType'
+        :'type' => :'ObservabilityPipelineSplunkHecSourceType',
+        :'valid_tokens' => :'Array<ObservabilityPipelineSplunkHecSourceValidToken>'
       }
     end
 
@@ -102,6 +108,12 @@ def initialize(attributes = {})
       if attributes.key?(:'type')
         self.type = attributes[:'type']
       end
+
+      if attributes.key?(:'valid_tokens')
+        if (value = attributes[:'valid_tokens']).is_a?(Array)
+          self.valid_tokens = value
+        end
+      end
     end
 
     # Check to see if the all the properties in the model are valid
@@ -110,6 +122,8 @@ def initialize(attributes = {})
     def valid?
       return false if @id.nil?
       return false if @type.nil?
+      return false if !@valid_tokens.nil? && @valid_tokens.length > 1000
+      return false if !@valid_tokens.nil? && @valid_tokens.length < 1
       true
     end
 
@@ -133,6 +147,19 @@ def type=(type)
       @type = type
     end
 
+    # Custom attribute writer method with validation
+    # @param valid_tokens [Object] Object to be assigned
+    # @!visibility private
+    def valid_tokens=(valid_tokens)
+      if !valid_tokens.nil? && valid_tokens.length > 1000
+        fail ArgumentError, 'invalid value for "valid_tokens", number of items must be less than or equal to 1000.'
+      end
+      if !valid_tokens.nil? && valid_tokens.length < 1
+        fail ArgumentError, 'invalid value for "valid_tokens", number of items must be greater than or equal to 1.'
+      end
+      @valid_tokens = valid_tokens
+    end
+
     # Returns the object in the form of hash, with additionalProperties support.
     # @return [Hash] Returns the object in the form of hash
     # @!visibility private
@@ -164,6 +191,7 @@ def ==(o)
           store_hec_token == o.store_hec_token &&
           tls == o.tls &&
           type == o.type &&
+          valid_tokens == o.valid_tokens &&
           additional_properties == o.additional_properties
     end
 
@@ -171,7 +199,7 @@ def ==(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [address_key, id, store_hec_token, tls, type, additional_properties].hash
+      [address_key, id, store_hec_token, tls, type, valid_tokens, additional_properties].hash
     end
   end
 end
diff --git a/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source_valid_token.rb b/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source_valid_token.rb
new file mode 100644
index 000000000000..81dccca0d911
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_source_valid_token.rb
@@ -0,0 +1,151 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # An accepted HEC token used to authenticate incoming Splunk HEC requests.
+  class ObservabilityPipelineSplunkHecSourceValidToken
+    include BaseGenericModel
+
+    # Whether this token is currently accepted. Disabled tokens are rejected without
+    # being removed from the configuration.
+    attr_accessor :enabled
+
+    # An optional metadata field that is attached to every event authenticated by the
+    # associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+    attr_accessor :field_to_add
+
+    # Name of the environment variable or secret that holds the expected HEC token value.
+    attr_reader :token_key
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'enabled' => :'enabled',
+        :'field_to_add' => :'field_to_add',
+        :'token_key' => :'token_key'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'enabled' => :'Boolean',
+        :'field_to_add' => :'ObservabilityPipelineSourceValidTokenFieldToAdd',
+        :'token_key' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineSplunkHecSourceValidToken` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'enabled')
+        self.enabled = attributes[:'enabled']
+      end
+
+      if attributes.key?(:'field_to_add')
+        self.field_to_add = attributes[:'field_to_add']
+      end
+
+      if attributes.key?(:'token_key')
+        self.token_key = attributes[:'token_key']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @token_key.nil?
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      return false if @token_key !~ pattern
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param token_key [Object] Object to be assigned
+    # @!visibility private
+    def token_key=(token_key)
+      if token_key.nil?
+        fail ArgumentError, 'invalid value for "token_key", token_key cannot be nil.'
+      end
+      pattern = Regexp.new(/^[A-Za-z0-9_]+$/)
+      if token_key !~ pattern
+        fail ArgumentError, "invalid value for \"token_key\", must conform to the pattern #{pattern}."
+      end
+      @token_key = token_key
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          enabled == o.enabled &&
+          field_to_add == o.field_to_add &&
+          token_key == o.token_key &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [enabled, field_to_add, token_key, additional_properties].hash
+    end
+  end
+end