New scope required on /api/v2/ddsql/query/tabular

What changed

Existing tokens 403. This needs user re-consent, not a code change, so it cannot be fixed by deploying.

Affects POST /api/v2/ddsql/query/tabular. Scopes now: AuthZ. This is the one category you cannot fix by shipping code, so it needs lead time.

requires timeseries_query

Who is affected

Code that calls POST /api/v2/ddsql/query/tabular.

Before and after

Based on Datadog’s published API specification. How severity is decided.