diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index a04387a688..77a2549ffa 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -48659,6 +48659,16 @@ components:
           description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `plain`).
           example: HTTP_AUTH_USERNAME
           type: string
+        valid_tokens:
+          description: |-
+            A list of tokens that are accepted for authenticating incoming HTTP requests. When set,
+            the source rejects any request whose token does not match an enabled entry in this list.
+            Cannot be combined with the `plain` auth strategy.
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidToken"
+          maxItems: 1000
+          minItems: 1
+          type: array
       required:
         - id
         - type
@@ -48684,6 +48694,55 @@ components:
       type: string
       x-enum-varnames:
         - HTTP_SERVER
+    ObservabilityPipelineHttpServerSourceValidToken:
+      description: An accepted token used to authenticate incoming HTTP server requests.
+      properties:
+        enabled:
+          default: true
+          description: |-
+            Whether this token is currently accepted. Disabled tokens are rejected without
+            being removed from the configuration.
+          example: true
+          type: boolean
+        field_to_add:
+          $ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd"
+        path_to_token:
+          $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToToken"
+        token_key:
+          description: Name of the environment variable or secret that holds the expected token value.
+          example: HTTP_SERVER_TOKEN
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+      required:
+        - token_key
+      type: object
+    ObservabilityPipelineHttpServerSourceValidTokenPathToToken:
+      description: |-
+        Specifies where the worker extracts the token from in the incoming HTTP request.
+        Either a built-in location (`path` or `address`) or an HTTP header object.
+      oneOf:
+        - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation"
+        - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader"
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader:
+      description: Extract the token from a specific HTTP request header.
+      properties:
+        header:
+          description: The name of the HTTP header that carries the token.
+          example: X-Token
+          type: string
+      required:
+        - header
+      type: object
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation:
+      description: Built-in token location on the incoming HTTP request.
+      enum:
+        - path
+        - address
+      example: path
+      type: string
+      x-enum-varnames:
+        - PATH
+        - ADDRESS
     ObservabilityPipelineKafkaDestination:
       description: |-
         The `kafka` destination sends logs to Apache Kafka topics.
@@ -50707,6 +50766,27 @@ components:
       type: string
       x-enum-varnames:
         - SOCKET
+    ObservabilityPipelineSourceValidTokenFieldToAdd:
+      description: |-
+        An optional metadata field that is attached to every event authenticated by the
+        associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+      properties:
+        key:
+          description: The metadata field name to add to incoming events.
+          example: token_name
+          maxLength: 256
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+        value:
+          description: The metadata field value to add to incoming events.
+          example: my_token
+          maxLength: 1024
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+      required:
+        - key
+        - value
+      type: object
     ObservabilityPipelineSpec:
       description: Input schema representing an observability pipeline configuration. Used in create and validate requests.
       properties:
@@ -50903,6 +50983,15 @@ components:
           $ref: "#/components/schemas/ObservabilityPipelineTls"
         type:
           $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceType"
+        valid_tokens:
+          description: |-
+            A list of tokens that are accepted for authenticating incoming HEC requests. When set, the source
+            rejects any request whose HEC token does not match an enabled entry in this list.
+          items:
+            $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceValidToken"
+          maxItems: 1000
+          minItems: 1
+          type: array
       required:
         - id
         - type
@@ -50917,6 +51006,26 @@ components:
       type: string
       x-enum-varnames:
         - SPLUNK_HEC
+    ObservabilityPipelineSplunkHecSourceValidToken:
+      description: An accepted HEC token used to authenticate incoming Splunk HEC requests.
+      properties:
+        enabled:
+          default: true
+          description: |-
+            Whether this token is currently accepted. Disabled tokens are rejected without
+            being removed from the configuration.
+          example: true
+          type: boolean
+        field_to_add:
+          $ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd"
+        token_key:
+          description: Name of the environment variable or secret that holds the expected HEC token value.
+          example: SPLUNK_HEC_TOKEN
+          pattern: "^[A-Za-z0-9_]+$"
+          type: string
+      required:
+        - token_key
+      type: object
     ObservabilityPipelineSplunkTcpSource:
       description: |-
         The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP.
diff --git a/docs/datadog_api_client.v2.model.rst b/docs/datadog_api_client.v2.model.rst
index 437bc71be0..e379d70e9a 100644
--- a/docs/datadog_api_client.v2.model.rst
+++ b/docs/datadog_api_client.v2.model.rst
@@ -21074,6 +21074,34 @@ datadog\_api\_client.v2.model.observability\_pipeline\_http\_server\_source\_typ
    :members:
    :show-inheritance:
 
+datadog\_api\_client.v2.model.observability\_pipeline\_http\_server\_source\_valid\_token module
+------------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token
+   :members:
+   :show-inheritance:
+
+datadog\_api\_client.v2.model.observability\_pipeline\_http\_server\_source\_valid\_token\_path\_to\_token module
+-----------------------------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token
+   :members:
+   :show-inheritance:
+
+datadog\_api\_client.v2.model.observability\_pipeline\_http\_server\_source\_valid\_token\_path\_to\_token\_header module
+-------------------------------------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token_header
+   :members:
+   :show-inheritance:
+
+datadog\_api\_client.v2.model.observability\_pipeline\_http\_server\_source\_valid\_token\_path\_to\_token\_location module
+---------------------------------------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token_location
+   :members:
+   :show-inheritance:
+
 datadog\_api\_client.v2.model.observability\_pipeline\_kafka\_destination module
 --------------------------------------------------------------------------------
 
@@ -21949,6 +21977,13 @@ datadog\_api\_client.v2.model.observability\_pipeline\_socket\_source\_type modu
    :members:
    :show-inheritance:
 
+datadog\_api\_client.v2.model.observability\_pipeline\_source\_valid\_token\_field\_to\_add module
+--------------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_source_valid_token_field_to_add
+   :members:
+   :show-inheritance:
+
 datadog\_api\_client.v2.model.observability\_pipeline\_spec module
 ------------------------------------------------------------------
 
@@ -22026,6 +22061,13 @@ datadog\_api\_client.v2.model.observability\_pipeline\_splunk\_hec\_source\_type
    :members:
    :show-inheritance:
 
+datadog\_api\_client.v2.model.observability\_pipeline\_splunk\_hec\_source\_valid\_token module
+-----------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_valid_token
+   :members:
+   :show-inheritance:
+
 datadog\_api\_client.v2.model.observability\_pipeline\_splunk\_tcp\_source module
 ---------------------------------------------------------------------------------
 
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_config_source_item.py b/src/datadog_api_client/v2/model/observability_pipeline_config_source_item.py
index 7302bcfada..e0cbf5ed38 100644
--- a/src/datadog_api_client/v2/model/observability_pipeline_config_source_item.py
+++ b/src/datadog_api_client/v2/model/observability_pipeline_config_source_item.py
@@ -73,6 +73,11 @@ def __init__(self, **kwargs):
         :param username_key: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `basic`).
         :type username_key: str, optional
 
+        :param valid_tokens: A list of tokens that are accepted for authenticating incoming HTTP requests. When set,
+            the source rejects any request whose token does not match an enabled entry in this list.
+            Cannot be combined with the `plain` auth strategy.
+        :type valid_tokens: [ObservabilityPipelineHttpServerSourceValidToken], optional
+
         :param bootstrap_servers_key: Name of the environment variable or secret that holds the Kafka bootstrap servers list.
         :type bootstrap_servers_key: str, optional
 
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_http_server_source.py b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source.py
index 98bd75c057..f5dcf1f913 100644
--- a/src/datadog_api_client/v2/model/observability_pipeline_http_server_source.py
+++ b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source.py
@@ -3,7 +3,7 @@
 # Copyright 2019-Present Datadog, Inc.
 from __future__ import annotations
 
-from typing import Union, TYPE_CHECKING
+from typing import List, Union, TYPE_CHECKING
 
 from datadog_api_client.model_utils import (
     ModelNormal,
@@ -22,9 +22,19 @@
     from datadog_api_client.v2.model.observability_pipeline_http_server_source_type import (
         ObservabilityPipelineHttpServerSourceType,
     )
+    from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token import (
+        ObservabilityPipelineHttpServerSourceValidToken,
+    )
 
 
 class ObservabilityPipelineHttpServerSource(ModelNormal):
+    validations = {
+        "valid_tokens": {
+            "max_items": 1000,
+            "min_items": 1,
+        },
+    }
+
     @cached_property
     def openapi_types(_):
         from datadog_api_client.v2.model.observability_pipeline_http_server_source_auth_strategy import (
@@ -35,6 +45,9 @@ def openapi_types(_):
         from datadog_api_client.v2.model.observability_pipeline_http_server_source_type import (
             ObservabilityPipelineHttpServerSourceType,
         )
+        from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token import (
+            ObservabilityPipelineHttpServerSourceValidToken,
+        )
 
         return {
             "address_key": (str,),
@@ -46,6 +59,7 @@ def openapi_types(_):
             "tls": (ObservabilityPipelineTls,),
             "type": (ObservabilityPipelineHttpServerSourceType,),
             "username_key": (str,),
+            "valid_tokens": ([ObservabilityPipelineHttpServerSourceValidToken],),
         }
 
     attribute_map = {
@@ -58,6 +72,7 @@ def openapi_types(_):
         "tls": "tls",
         "type": "type",
         "username_key": "username_key",
+        "valid_tokens": "valid_tokens",
     }
 
     def __init__(
@@ -71,6 +86,7 @@ def __init__(
         password_key: Union[str, UnsetType] = unset,
         tls: Union[ObservabilityPipelineTls, UnsetType] = unset,
         username_key: Union[str, UnsetType] = unset,
+        valid_tokens: Union[List[ObservabilityPipelineHttpServerSourceValidToken], UnsetType] = unset,
         **kwargs,
     ):
         """
@@ -104,6 +120,11 @@ def __init__(
 
         :param username_key: Name of the environment variable or secret that holds the username (used when ``auth_strategy`` is ``plain`` ).
         :type username_key: str, optional
+
+        :param valid_tokens: A list of tokens that are accepted for authenticating incoming HTTP requests. When set,
+            the source rejects any request whose token does not match an enabled entry in this list.
+            Cannot be combined with the ``plain`` auth strategy.
+        :type valid_tokens: [ObservabilityPipelineHttpServerSourceValidToken], optional
         """
         if address_key is not unset:
             kwargs["address_key"] = address_key
@@ -115,6 +136,8 @@ def __init__(
             kwargs["tls"] = tls
         if username_key is not unset:
             kwargs["username_key"] = username_key
+        if valid_tokens is not unset:
+            kwargs["valid_tokens"] = valid_tokens
         super().__init__(kwargs)
 
         self_.auth_strategy = auth_strategy
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token.py b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token.py
new file mode 100644
index 0000000000..50664ca1f4
--- /dev/null
+++ b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token.py
@@ -0,0 +1,95 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+from typing import Union, TYPE_CHECKING
+
+from datadog_api_client.model_utils import (
+    ModelNormal,
+    cached_property,
+    unset,
+    UnsetType,
+)
+
+
+if TYPE_CHECKING:
+    from datadog_api_client.v2.model.observability_pipeline_source_valid_token_field_to_add import (
+        ObservabilityPipelineSourceValidTokenFieldToAdd,
+    )
+    from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token import (
+        ObservabilityPipelineHttpServerSourceValidTokenPathToToken,
+    )
+    from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token_header import (
+        ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader,
+    )
+
+
+class ObservabilityPipelineHttpServerSourceValidToken(ModelNormal):
+    validations = {
+        "token_key": {},
+    }
+
+    @cached_property
+    def openapi_types(_):
+        from datadog_api_client.v2.model.observability_pipeline_source_valid_token_field_to_add import (
+            ObservabilityPipelineSourceValidTokenFieldToAdd,
+        )
+        from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token import (
+            ObservabilityPipelineHttpServerSourceValidTokenPathToToken,
+        )
+
+        return {
+            "enabled": (bool,),
+            "field_to_add": (ObservabilityPipelineSourceValidTokenFieldToAdd,),
+            "path_to_token": (ObservabilityPipelineHttpServerSourceValidTokenPathToToken,),
+            "token_key": (str,),
+        }
+
+    attribute_map = {
+        "enabled": "enabled",
+        "field_to_add": "field_to_add",
+        "path_to_token": "path_to_token",
+        "token_key": "token_key",
+    }
+
+    def __init__(
+        self_,
+        token_key: str,
+        enabled: Union[bool, UnsetType] = unset,
+        field_to_add: Union[ObservabilityPipelineSourceValidTokenFieldToAdd, UnsetType] = unset,
+        path_to_token: Union[
+            ObservabilityPipelineHttpServerSourceValidTokenPathToToken,
+            str,
+            ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader,
+            UnsetType,
+        ] = unset,
+        **kwargs,
+    ):
+        """
+        An accepted token used to authenticate incoming HTTP server requests.
+
+        :param enabled: Whether this token is currently accepted. Disabled tokens are rejected without
+            being removed from the configuration.
+        :type enabled: bool, optional
+
+        :param field_to_add: An optional metadata field that is attached to every event authenticated by the
+            associated token. Both ``key`` and ``value`` must match ``^[A-Za-z0-9_]+$``.
+        :type field_to_add: ObservabilityPipelineSourceValidTokenFieldToAdd, optional
+
+        :param path_to_token: Specifies where the worker extracts the token from in the incoming HTTP request.
+            Either a built-in location ( ``path`` or ``address`` ) or an HTTP header object.
+        :type path_to_token: ObservabilityPipelineHttpServerSourceValidTokenPathToToken, optional
+
+        :param token_key: Name of the environment variable or secret that holds the expected token value.
+        :type token_key: str
+        """
+        if enabled is not unset:
+            kwargs["enabled"] = enabled
+        if field_to_add is not unset:
+            kwargs["field_to_add"] = field_to_add
+        if path_to_token is not unset:
+            kwargs["path_to_token"] = path_to_token
+        super().__init__(kwargs)
+
+        self_.token_key = token_key
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token.py b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token.py
new file mode 100644
index 0000000000..67fd6aeb1a
--- /dev/null
+++ b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token.py
@@ -0,0 +1,42 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelComposed,
+    cached_property,
+)
+
+
+class ObservabilityPipelineHttpServerSourceValidTokenPathToToken(ModelComposed):
+    def __init__(self, **kwargs):
+        """
+        Specifies where the worker extracts the token from in the incoming HTTP request.
+        Either a built-in location ( ``path`` or ``address`` ) or an HTTP header object.
+
+        :param header: The name of the HTTP header that carries the token.
+        :type header: str
+        """
+        super().__init__(kwargs)
+
+    @cached_property
+    def _composed_schemas(_):
+        # we need this here to make our import statements work
+        # we must store _composed_schemas in here so the code is only run
+        # when we invoke this method. If we kept this at the class
+        # level we would get an error because the class level
+        # code would be run when this module is imported, and these composed
+        # classes don't exist yet because their module has not finished
+        # loading
+        from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token_header import (
+            ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader,
+        )
+
+        return {
+            "oneOf": [
+                str,
+                ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader,
+            ],
+        }
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token_header.py b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token_header.py
new file mode 100644
index 0000000000..88606ad14f
--- /dev/null
+++ b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token_header.py
@@ -0,0 +1,33 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelNormal,
+    cached_property,
+)
+
+
+class ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader(ModelNormal):
+    @cached_property
+    def openapi_types(_):
+        return {
+            "header": (str,),
+        }
+
+    attribute_map = {
+        "header": "header",
+    }
+
+    def __init__(self_, header: str, **kwargs):
+        """
+        Extract the token from a specific HTTP request header.
+
+        :param header: The name of the HTTP header that carries the token.
+        :type header: str
+        """
+        super().__init__(kwargs)
+
+        self_.header = header
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token_location.py b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token_location.py
new file mode 100644
index 0000000000..7b7b1dbd12
--- /dev/null
+++ b/src/datadog_api_client/v2/model/observability_pipeline_http_server_source_valid_token_path_to_token_location.py
@@ -0,0 +1,42 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelSimple,
+    cached_property,
+)
+
+from typing import ClassVar
+
+
+class ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation(ModelSimple):
+    """
+    Built-in token location on the incoming HTTP request.
+
+    :param value: Must be one of ["path", "address"].
+    :type value: str
+    """
+
+    allowed_values = {
+        "path",
+        "address",
+    }
+    PATH: ClassVar["ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation"]
+    ADDRESS: ClassVar["ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation"]
+
+    @cached_property
+    def openapi_types(_):
+        return {
+            "value": (str,),
+        }
+
+
+ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation.PATH = (
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation("path")
+)
+ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation.ADDRESS = (
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation("address")
+)
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_source_valid_token_field_to_add.py b/src/datadog_api_client/v2/model/observability_pipeline_source_valid_token_field_to_add.py
new file mode 100644
index 0000000000..8bbb817970
--- /dev/null
+++ b/src/datadog_api_client/v2/model/observability_pipeline_source_valid_token_field_to_add.py
@@ -0,0 +1,49 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelNormal,
+    cached_property,
+)
+
+
+class ObservabilityPipelineSourceValidTokenFieldToAdd(ModelNormal):
+    validations = {
+        "key": {
+            "max_length": 256,
+        },
+        "value": {
+            "max_length": 1024,
+        },
+    }
+
+    @cached_property
+    def openapi_types(_):
+        return {
+            "key": (str,),
+            "value": (str,),
+        }
+
+    attribute_map = {
+        "key": "key",
+        "value": "value",
+    }
+
+    def __init__(self_, key: str, value: str, **kwargs):
+        """
+        An optional metadata field that is attached to every event authenticated by the
+        associated token. Both ``key`` and ``value`` must match ``^[A-Za-z0-9_]+$``.
+
+        :param key: The metadata field name to add to incoming events.
+        :type key: str
+
+        :param value: The metadata field value to add to incoming events.
+        :type value: str
+        """
+        super().__init__(kwargs)
+
+        self_.key = key
+        self_.value = value
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source.py b/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source.py
index 5415e4879d..b5b45eb175 100644
--- a/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source.py
+++ b/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source.py
@@ -3,7 +3,7 @@
 # Copyright 2019-Present Datadog, Inc.
 from __future__ import annotations
 
-from typing import Union, TYPE_CHECKING
+from typing import List, Union, TYPE_CHECKING
 
 from datadog_api_client.model_utils import (
     ModelNormal,
@@ -18,15 +18,28 @@
     from datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_type import (
         ObservabilityPipelineSplunkHecSourceType,
     )
+    from datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_valid_token import (
+        ObservabilityPipelineSplunkHecSourceValidToken,
+    )
 
 
 class ObservabilityPipelineSplunkHecSource(ModelNormal):
+    validations = {
+        "valid_tokens": {
+            "max_items": 1000,
+            "min_items": 1,
+        },
+    }
+
     @cached_property
     def openapi_types(_):
         from datadog_api_client.v2.model.observability_pipeline_tls import ObservabilityPipelineTls
         from datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_type import (
             ObservabilityPipelineSplunkHecSourceType,
         )
+        from datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_valid_token import (
+            ObservabilityPipelineSplunkHecSourceValidToken,
+        )
 
         return {
             "address_key": (str,),
@@ -34,6 +47,7 @@ def openapi_types(_):
             "store_hec_token": (bool,),
             "tls": (ObservabilityPipelineTls,),
             "type": (ObservabilityPipelineSplunkHecSourceType,),
+            "valid_tokens": ([ObservabilityPipelineSplunkHecSourceValidToken],),
         }
 
     attribute_map = {
@@ -42,6 +56,7 @@ def openapi_types(_):
         "store_hec_token": "store_hec_token",
         "tls": "tls",
         "type": "type",
+        "valid_tokens": "valid_tokens",
     }
 
     def __init__(
@@ -51,6 +66,7 @@ def __init__(
         address_key: Union[str, UnsetType] = unset,
         store_hec_token: Union[bool, UnsetType] = unset,
         tls: Union[ObservabilityPipelineTls, UnsetType] = unset,
+        valid_tokens: Union[List[ObservabilityPipelineSplunkHecSourceValidToken], UnsetType] = unset,
         **kwargs,
     ):
         """
@@ -73,6 +89,10 @@ def __init__(
 
         :param type: The source type. Always ``splunk_hec``.
         :type type: ObservabilityPipelineSplunkHecSourceType
+
+        :param valid_tokens: A list of tokens that are accepted for authenticating incoming HEC requests. When set, the source
+            rejects any request whose HEC token does not match an enabled entry in this list.
+        :type valid_tokens: [ObservabilityPipelineSplunkHecSourceValidToken], optional
         """
         if address_key is not unset:
             kwargs["address_key"] = address_key
@@ -80,6 +100,8 @@ def __init__(
             kwargs["store_hec_token"] = store_hec_token
         if tls is not unset:
             kwargs["tls"] = tls
+        if valid_tokens is not unset:
+            kwargs["valid_tokens"] = valid_tokens
         super().__init__(kwargs)
 
         self_.id = id
diff --git a/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source_valid_token.py b/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source_valid_token.py
new file mode 100644
index 0000000000..e64f9bed82
--- /dev/null
+++ b/src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_source_valid_token.py
@@ -0,0 +1,72 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+from typing import Union, TYPE_CHECKING
+
+from datadog_api_client.model_utils import (
+    ModelNormal,
+    cached_property,
+    unset,
+    UnsetType,
+)
+
+
+if TYPE_CHECKING:
+    from datadog_api_client.v2.model.observability_pipeline_source_valid_token_field_to_add import (
+        ObservabilityPipelineSourceValidTokenFieldToAdd,
+    )
+
+
+class ObservabilityPipelineSplunkHecSourceValidToken(ModelNormal):
+    validations = {
+        "token_key": {},
+    }
+
+    @cached_property
+    def openapi_types(_):
+        from datadog_api_client.v2.model.observability_pipeline_source_valid_token_field_to_add import (
+            ObservabilityPipelineSourceValidTokenFieldToAdd,
+        )
+
+        return {
+            "enabled": (bool,),
+            "field_to_add": (ObservabilityPipelineSourceValidTokenFieldToAdd,),
+            "token_key": (str,),
+        }
+
+    attribute_map = {
+        "enabled": "enabled",
+        "field_to_add": "field_to_add",
+        "token_key": "token_key",
+    }
+
+    def __init__(
+        self_,
+        token_key: str,
+        enabled: Union[bool, UnsetType] = unset,
+        field_to_add: Union[ObservabilityPipelineSourceValidTokenFieldToAdd, UnsetType] = unset,
+        **kwargs,
+    ):
+        """
+        An accepted HEC token used to authenticate incoming Splunk HEC requests.
+
+        :param enabled: Whether this token is currently accepted. Disabled tokens are rejected without
+            being removed from the configuration.
+        :type enabled: bool, optional
+
+        :param field_to_add: An optional metadata field that is attached to every event authenticated by the
+            associated token. Both ``key`` and ``value`` must match ``^[A-Za-z0-9_]+$``.
+        :type field_to_add: ObservabilityPipelineSourceValidTokenFieldToAdd, optional
+
+        :param token_key: Name of the environment variable or secret that holds the expected HEC token value.
+        :type token_key: str
+        """
+        if enabled is not unset:
+            kwargs["enabled"] = enabled
+        if field_to_add is not unset:
+            kwargs["field_to_add"] = field_to_add
+        super().__init__(kwargs)
+
+        self_.token_key = token_key
diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py
index aa5e453486..497b776c2e 100644
--- a/src/datadog_api_client/v2/models/__init__.py
+++ b/src/datadog_api_client/v2/models/__init__.py
@@ -4208,6 +4208,18 @@
 from datadog_api_client.v2.model.observability_pipeline_http_server_source_type import (
     ObservabilityPipelineHttpServerSourceType,
 )
+from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token import (
+    ObservabilityPipelineHttpServerSourceValidToken,
+)
+from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token import (
+    ObservabilityPipelineHttpServerSourceValidTokenPathToToken,
+)
+from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token_header import (
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader,
+)
+from datadog_api_client.v2.model.observability_pipeline_http_server_source_valid_token_path_to_token_location import (
+    ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation,
+)
 from datadog_api_client.v2.model.observability_pipeline_kafka_destination import ObservabilityPipelineKafkaDestination
 from datadog_api_client.v2.model.observability_pipeline_kafka_destination_compression import (
     ObservabilityPipelineKafkaDestinationCompression,
@@ -4553,6 +4565,9 @@
 )
 from datadog_api_client.v2.model.observability_pipeline_socket_source_mode import ObservabilityPipelineSocketSourceMode
 from datadog_api_client.v2.model.observability_pipeline_socket_source_type import ObservabilityPipelineSocketSourceType
+from datadog_api_client.v2.model.observability_pipeline_source_valid_token_field_to_add import (
+    ObservabilityPipelineSourceValidTokenFieldToAdd,
+)
 from datadog_api_client.v2.model.observability_pipeline_spec import ObservabilityPipelineSpec
 from datadog_api_client.v2.model.observability_pipeline_spec_data import ObservabilityPipelineSpecData
 from datadog_api_client.v2.model.observability_pipeline_split_array_processor import (
@@ -4580,6 +4595,9 @@
 from datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_type import (
     ObservabilityPipelineSplunkHecSourceType,
 )
+from datadog_api_client.v2.model.observability_pipeline_splunk_hec_source_valid_token import (
+    ObservabilityPipelineSplunkHecSourceValidToken,
+)
 from datadog_api_client.v2.model.observability_pipeline_splunk_tcp_source import ObservabilityPipelineSplunkTcpSource
 from datadog_api_client.v2.model.observability_pipeline_splunk_tcp_source_type import (
     ObservabilityPipelineSplunkTcpSourceType,
@@ -10549,6 +10567,10 @@
     "ObservabilityPipelineHttpServerSource",
     "ObservabilityPipelineHttpServerSourceAuthStrategy",
     "ObservabilityPipelineHttpServerSourceType",
+    "ObservabilityPipelineHttpServerSourceValidToken",
+    "ObservabilityPipelineHttpServerSourceValidTokenPathToToken",
+    "ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader",
+    "ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation",
     "ObservabilityPipelineKafkaDestination",
     "ObservabilityPipelineKafkaDestinationCompression",
     "ObservabilityPipelineKafkaDestinationEncoding",
@@ -10674,6 +10696,7 @@
     "ObservabilityPipelineSocketSourceFramingOctetCountingMethod",
     "ObservabilityPipelineSocketSourceMode",
     "ObservabilityPipelineSocketSourceType",
+    "ObservabilityPipelineSourceValidTokenFieldToAdd",
     "ObservabilityPipelineSpec",
     "ObservabilityPipelineSpecData",
     "ObservabilityPipelineSplitArrayProcessor",
@@ -10685,6 +10708,7 @@
     "ObservabilityPipelineSplunkHecDestinationType",
     "ObservabilityPipelineSplunkHecSource",
     "ObservabilityPipelineSplunkHecSourceType",
+    "ObservabilityPipelineSplunkHecSourceValidToken",
     "ObservabilityPipelineSplunkTcpSource",
     "ObservabilityPipelineSplunkTcpSourceType",
     "ObservabilityPipelineSumoLogicDestination",