diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index 8444b52dbdac..fdafbd6b9d51 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -44920,6 +44920,9 @@ components:
           description: Name of the API key.
           example: "API Key for submitting metrics"
           type: string
+        private_action_runner_enroll_enabled:
+          description: Whether the API key can enroll a Private Action Runner.
+          type: boolean
         remote_config_read_enabled:
           description: The remote config read enabled status.
           type: boolean
@@ -84281,6 +84284,9 @@ components:
           description: Name of the API key.
           example: "API Key for submitting metrics"
           type: string
+        private_action_runner_enroll_enabled:
+          description: Whether the API key can enroll a Private Action Runner.
+          type: boolean
         remote_config_read_enabled:
           description: The remote config read enabled status.
           type: boolean
@@ -136793,7 +136799,9 @@ paths:
         **Note**: This endpoint is in preview and is subject to change.
         If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
     post:
-      description: Trigger a new Bits AI investigation based on a monitor alert.
+      description: |-
+        Trigger a new Bits AI investigation based on a monitor alert.
+        The `monitors_read` permission is required when the trigger type is `monitor_alert_trigger`.
       operationId: TriggerInvestigation
       requestBody:
         content:
@@ -136842,14 +136850,16 @@ paths:
           appKeyAuth: []
         - AuthZ:
             - bits_investigations_write
+            - monitors_read
       summary: Trigger a Bits AI investigation
       tags:
         - Bits AI
       x-codegen-request-body-name: body
       "x-permission":
-        operator: OR
+        operator: AND
         permissions:
           - bits_investigations_write
+          - monitors_read
       x-unstable: |-
         **Note**: This endpoint is in preview and is subject to change.
         If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
diff --git a/services/bits_ai/src/v2/BitsAIApi.ts b/services/bits_ai/src/v2/BitsAIApi.ts
index f4a22991c9f3..302ca4dc85eb 100644
--- a/services/bits_ai/src/v2/BitsAIApi.ts
+++ b/services/bits_ai/src/v2/BitsAIApi.ts
@@ -607,6 +607,7 @@ export class BitsAIApi {
 
   /**
    * Trigger a new Bits AI investigation based on a monitor alert.
+   * The `monitors_read` permission is required when the trigger type is `monitor_alert_trigger`.
    * @param param The request object
    */
   public triggerInvestigation(
diff --git a/services/key_management/src/v2/models/FullAPIKeyAttributes.ts b/services/key_management/src/v2/models/FullAPIKeyAttributes.ts
index 2f3549c7e116..ddc609968c84 100644
--- a/services/key_management/src/v2/models/FullAPIKeyAttributes.ts
+++ b/services/key_management/src/v2/models/FullAPIKeyAttributes.ts
@@ -32,6 +32,10 @@ export class FullAPIKeyAttributes {
    * Name of the API key.
    */
   "name"?: string;
+  /**
+   * Whether the API key can enroll a Private Action Runner.
+   */
+  "privateActionRunnerEnrollEnabled"?: boolean;
   /**
    * The remote config read enabled status.
    */
@@ -82,6 +86,10 @@ export class FullAPIKeyAttributes {
       baseName: "name",
       type: "string",
     },
+    privateActionRunnerEnrollEnabled: {
+      baseName: "private_action_runner_enroll_enabled",
+      type: "boolean",
+    },
     remoteConfigReadEnabled: {
       baseName: "remote_config_read_enabled",
       type: "boolean",
diff --git a/services/key_management/src/v2/models/PartialAPIKeyAttributes.ts b/services/key_management/src/v2/models/PartialAPIKeyAttributes.ts
index 41c2f34f0783..1d611ac3cb6d 100644
--- a/services/key_management/src/v2/models/PartialAPIKeyAttributes.ts
+++ b/services/key_management/src/v2/models/PartialAPIKeyAttributes.ts
@@ -28,6 +28,10 @@ export class PartialAPIKeyAttributes {
    * Name of the API key.
    */
   "name"?: string;
+  /**
+   * Whether the API key can enroll a Private Action Runner.
+   */
+  "privateActionRunnerEnrollEnabled"?: boolean;
   /**
    * The remote config read enabled status.
    */
@@ -72,6 +76,10 @@ export class PartialAPIKeyAttributes {
       baseName: "name",
       type: "string",
     },
+    privateActionRunnerEnrollEnabled: {
+      baseName: "private_action_runner_enroll_enabled",
+      type: "boolean",
+    },
     remoteConfigReadEnabled: {
       baseName: "remote_config_read_enabled",
       type: "boolean",