MCP Datadog Server

Add a security signal to an incident. This makes it possible to search for signals by incident within the signal explorer and to view the signals on the incident timeline.

Adds a user to a role.

Add a user to a team.

Attach the Lambda ARN of the Lambda created for the Datadog-AWS log collection to your AWS account ID to enable log collection.

Add dashboards to an existing dashboard list.

The API endpoint to aggregate events into buckets and compute metrics and timeseries.

Delete (or partially delete) multiple service level objective objects.

This endpoint facilitates deletion of one or more thresholds for one or more service level objective objects. If all thresholds are deleted, the service level objective object is deleted as well.

Cancel a downtime.

Change the related incidents for a security signal.

Change the triage state of a security signal.

Check if the given monitors can be deleted.

Check if an SLO can be safely deleted. For example, assure an SLO can be deleted without disrupting a dashboard.

Test if permissions are present to add log-forwarding triggers for the given services and AWS account. Input is the same as for EnableAWSLogServices. Done async, so can be repeatedly polled in a non-blocking fashion until the async request completes.

• Returns a status of created when it's checking if the permissions exists in the AWS account.
• Returns a status of waiting while checking.
• Returns a status of checked and ok if the Lambda exists.
• Returns a status of error if the Lambda does not exist.

Test if permissions are present to add a log-forwarding triggers for the given services and AWS account. The input is the same as for Enable an AWS service log collection. Subsequent requests will always repeat the above, so this endpoint can be polled intermittently instead of blocking.

• Returns a status of 'created' when it's checking if the Lambda exists in the account.
• Returns a status of 'waiting' while checking.
• Returns a status of 'checked and ok' if the Lambda exists.
• Returns a status of 'error' if the Lambda does not exist.

Create and define a list of queryable tag keys for a set of existing count, gauge, rate, and distribution metrics. Metrics are selected by passing a metric name prefix. Use the Delete method of this API path to remove tag configurations. Results can be sent to a set of account email addresses, just like the same operation in the Datadog web app. If multiple calls include the same metric, the last configuration applied (not by submit order) is used, do not expect deterministic ordering of concurrent calls. The exclude_tags_mode value will set all metrics that match the prefix to the same exclusion state, metric tag configurations do not support mixed inclusion and exclusion for tags on the same metric. Can only be used with application keys of users with the Manage Tags for Metrics permission.

Convert a rule that doesn't (yet) exist from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.

Convert an existing rule from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.

Create a Synthetic browser test.

Create a custom destination in your organization.

Create a custom framework.

Create an empty dashboard list.

Create a detection rule.

Create a Synthetic global variable.

Create a metric based on your ingested logs in your organization. Returns the log-based metric object from the request body when the request is successful.

Create a Synthetic mobile test.

Create a monitor using the specified options.

Monitor Types

The type of monitor chosen from:

• anomaly: query alert
• APM: query alert or trace-analytics alert
• composite: composite
• custom: service check
• forecast: query alert
• host: service check
• integration: query alert or service check
• live process: process alert
• logs: log alert
• metric: query alert
• network: service check
• outlier: query alert
• process: service check
• rum: rum alert
• SLO: slo alert
• watchdog: event-v2 alert
• event-v2: event-v2 alert
• audit: audit alert
• error-tracking: error-tracking alert
• database-monitoring: database-monitoring alert
• network-performance: network-performance alert
• cloud cost: cost alert

Notes:

• Synthetic monitors are created through the Synthetics API. See the Synthetics API documentation for more information.
• Log monitors require an unscoped App Key.

Query Types

Metric Alert Query

Example: time_aggr(time_window):space_aggr:metric{tags} [by {key}] operator #

• time_aggr: avg, sum, max, min, change, or pct_change
• time_window: last_#m (with # between 1 and 10080 depending on the monitor type) or last_#h(with # between 1 and 168 depending on the monitor type) or last_1d, or last_1w
• space_aggr: avg, sum, min, or max
• tags: one or more tags (comma-separated), or *
• key: a 'key' in key:value tag syntax; defines a separate alert for each tag in the group (multi-alert)
• operator: <, <=, >, >=, ==, or !=
• #: an integer or decimal number used to set the threshold

If you are using the _change_ or _pct_change_ time aggregator, instead use change_aggr(time_aggr(time_window), timeshift):space_aggr:metric{tags} [by {key}] operator # with:

• change_aggr change, pct_change
• time_aggr avg, sum, max, min Learn more
• time_window last_#m (between 1 and 2880 depending on the monitor type), last_#h (between 1 and 48 depending on the monitor type), or last_#d (1 or 2)
• timeshift #m_ago (5, 10, 15, or 30), #h_ago (1, 2, or 4), or 1d_ago

Use this to create an outlier monitor using the following query: avg(last_30m):outliers(avg:system.cpu.user{role:es-events-data} by {host}, 'dbscan', 7) > 0

Service Check Query

Example: "check".over(tags).last(count).by(group).count_by_status()

• check name of the check, for example datadog.agent.up
• tags one or more quoted tags (comma-separated), or "*". for example: .over("env:prod", "role:db"); over cannot be blank.
• count must be at greater than or equal to your max threshold (defined in the options). It is limited to 100.

For example, if you've specified to notify on 1 critical, 3 ok, and 2 warn statuses, count should be at least 3.

• group must be specified for check monitors. Per-check grouping is already explicitly known for some service checks.

For example, Postgres integration monitors are tagged by db, host, and port, and Network monitors by host, instance, and url. See Service Checks documentation for more information.

Event Alert Query

Note: The Event Alert Query has been replaced by the Event V2 Alert Query. For more information, see the Event Migration guide.

Event V2 Alert Query

Example: events(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• rollup_method The stats roll-up method - supports count, avg and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

Process Alert Query

Example: processes(search).over(tags).rollup('count').last(timeframe) operator #

• search free text search string for querying processes.

Matching processes match results on the Live Processes page.

• tags one or more tags (comma-separated)
• timeframe the timeframe to roll up the counts. Examples: 10m, 4h. Supported timeframes: s, m, h and d
• operator <, <=, >, >=, ==, or !=
• # an integer or decimal number used to set the threshold

Logs Alert Query

Example: logs(query).index(index_name).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• index_name For multi-index organizations, the log index in which the request is performed.
• rollup_method The stats roll-up method - supports count, avg and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

Composite Query

Example: 12345 && 67890, where 12345 and 67890 are the IDs of non-composite monitors

• name [*required*, *default* = dynamic, based on query]: The name of the alert.
• message [*required*, *default* = dynamic, based on query]: A message to include with notifications for this monitor.

Email notifications can be sent to specific users by using the same '@username' notation as events.

• tags [*optional*, *default* = empty list]: A list of tags to associate with your monitor.

When getting all monitor details via the API, use the monitor_tags argument to filter results by these tags. It is only available via the API and isn't visible or editable in the Datadog UI.

SLO Alert Query

Example: error_budget("slo_id").over("time_window") operator #

• slo_id: The alphanumeric SLO ID of the SLO you are configuring the alert for.
• time_window: The time window of the SLO target you wish to alert on. Valid options: 7d, 30d, 90d.
• operator: >= or >

Audit Alert Query

Example: audits(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• rollup_method The stats roll-up method - supports count, avg and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

CI Pipelines Alert Query

Example: ci-pipelines(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• rollup_method The stats roll-up method - supports count, avg, and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

CI Tests Alert Query

Example: ci-tests(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• rollup_method The stats roll-up method - supports count, avg, and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

Error Tracking Alert Query

"New issue" example: error-tracking(query).source(issue_source).new().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator # "High impact issue" example: error-tracking(query).source(issue_source).impact().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator #

• query The search query - following the Log search syntax.
• issue_source The issue source - supports all, browser, mobile and backend and defaults to all if omitted.
• rollup_method The stats roll-up method - supports count, avg, and cardinality and defaults to count if omitted.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• group by Comma-separated list of attributes to group by - should contain at least issue.id.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

Database Monitoring Alert Query

Example: database-monitoring(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• rollup_method The stats roll-up method - supports count, avg, and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

Network Performance Alert Query

Example: network-performance(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.
• rollup_method The stats roll-up method - supports count, avg, and cardinality.
• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.
• time_window #m (between 1 and 2880), #h (between 1 and 48).
• operator <, <=, >, >=, ==, or !=.
• # an integer or decimal number used to set the threshold.

Cost Alert Query

Example: formula(query).timeframe_type(time_window).function(parameter) operator #

• query The search query - following the Log search syntax.
• timeframe_type The timeframe type to evaluate the cost
• for forecast supports current
• for change, anomaly, threshold supports last
• time_window - supports daily roll-up e.g. 7d
• function - [optional, defaults to threshold monitor if omitted] supports change, anomaly, forecast
• parameter Specify the parameter of the type
• for change:
• supports relative, absolute
• [optional] supports #, where # is an integer or decimal number used to set the threshold
• for anomaly:
• supports direction=both, direction=above, direction=below
• [optional] supports threshold=#, where # is an integer or decimal number used to set the threshold
• operator
• for threshold supports <, <=, >, >=, ==, or !=
• for change supports >, <
• for anomaly supports >=
• for forecast supports >
• # an integer or decimal number used to set the threshold.

Create a monitor configuration policy.

Creates a monitor notification rule.

Create a dashboard using the specified options. When defining queries in your widgets, take note of which queries should have the as_count() or as_rate() modifiers appended. Refer to the following documentation for more information on these modifiers.

Clone an existing role

Create a new notification rule for security signals and return the created rule.

Create a new notification rule for security vulnerabilities and return the created rule.

Create a pipeline in your organization.

Create a new Synthetic private location.

Create a retention filter to index spans in your organization. Returns the retention filter definition when the request is successful.

Create a metric based on your organization's RUM data. Returns the rum-based metric object from the request body when the request is successful.

Create a security filter.

See the security filter guide for more examples.

Create a service account for your organization.

Share a specified private dashboard, generating a URL at which it can be publicly viewed.

Create a metric based on your ingested spans in your organization. Returns the span-based metric object from the request body when the request is successful.

Create a new suppression rule.

Create and define a list of queryable tag keys for an existing count/gauge/rate/distribution metric. Optionally, include percentile aggregations on any distribution metric. By setting exclude_tags_mode to true, the behavior is changed from an allow-list to a deny-list, and tags in the defined list are not queryable. Can only be used with application keys of users with the Manage Tags for Metrics permission.

Create a new team. User IDs passed through the users relationship field are added to the team.

Add a new link to a team.

Create a user for your organization.

Create a Synthetic API test.

Create an application key for this service account.

Create an archive in your organization.

Creates a new index. Returns the Index object passed in the request body when the request is successful.

Create an SLO Correction.

Create a service level objective object.

Create a new Datadog dashboard with widgets and layout configuration.

Schedule a Datadog downtime to suppress alerts for specific scopes.

Create a new Datadog monitor for alerting on metrics, services, events, or logs.

Create or update entities in Software Catalog.

Create or update kinds in Software Catalog.

Create or update service definition in the Datadog Service Catalog.

Create a new role for your organization.

Create a new Datadog team.

Create a tenant-based handle in the Datadog Microsoft Teams integration.

Create a new Datadog user with email and role.

Create a Workflows webhook handle in the Datadog Microsoft Teams integration.

Delete a specific custom destination in your organization.

Delete a custom framework.

Delete a dashboard using the specified ID.

Delete a dashboard list.

Delete a Synthetic global variable.

Delete a specific log-based metric from your organization.

Delete the specified monitor

Delete a monitor configuration policy.

Deletes a monitor notification rule by rule_id.

Delete a given pipeline from your organization. This endpoint takes no JSON arguments.

Delete a Synthetic private location.

Delete a specific retention filter from your organization.

Delete a specific rum-based metric from your organization.

Delete a specific security filter.

Delete a notification rule for security signals.

Delete a single entity in Software Catalog.

Delete a single kind in Software Catalog.

Delete a single service definition in the Datadog Service Catalog.

Delete a specific span-based metric from your organization.

Delete a specific suppression rule.

Deletes a metric's tag configuration. Can only be used with application keys from users with the Manage Tags for Metrics permission.

Delete a notification rule for security vulnerabilities.

Delete an application key owned by this service account.

Delete a given archive from your organization.

Delete a Datadog-AWS logs configuration by removing the specific Lambda ARN associated with a given AWS account.

Delete an existing rule. Default rules cannot be deleted.

Delete an existing index from your organization. Index deletions are permanent and cannot be reverted. You cannot recreate an index with the same name as deleted ones.

Permanently delete the specified service level objective object.

If an SLO is used in a dashboard, the DELETE /v1/slo/ endpoint returns a 409 conflict error because the SLO is referenced in a dashboard.

Permanently delete the specified SLO correction object.

Delete a Datadog dashboard permanently.

Delete dashboards using the specified IDs. If there are any failures, no dashboards will be deleted (partial success is not allowed).

Cancel a Datadog downtime.

Delete dashboards from an existing dashboard list.

Delete a Datadog monitor permanently.

Disables a role.

Delete all custom lists of queryable tag keys for a set of existing count, gauge, rate, and distribution metrics. Metrics are selected by passing a metric name prefix. Results can be sent to a set of account email addresses, just like the same operation in the Datadog web app. Can only be used with application keys of users with the Manage Tags for Metrics permission.

Delete a Datadog team.

Delete a tenant-based handle from the Datadog Microsoft Teams integration.

Delete multiple Synthetic tests by ID.

Delete a Datadog user.

Delete a Workflows webhook handle from the Datadog Microsoft Teams integration.

Disable a user. Can only be used with an application key belonging to an administrator user.

Edit the configuration of a Synthetic browser test.

Edit a Synthetic global variable.

Edit the configuration of a Synthetic Mobile test.

Edit the specified monitor.

Edit a monitor configuration policy.

Edit a Synthetic private location.

Edit the configuration of a Synthetic API test.

Edit an application key owned by this service account.

Edit metadata of a specific metric. Find out more about supported types.

Enable automatic log collection for a list of services. This should be run after running CreateAWSLambdaARN to save the configuration.

Fetch uptime for multiple Synthetic tests by ID.

Get the detailed configuration (including steps) associated with a Synthetic browser test.

Get a specific full result from a given Synthetic browser test.

Get the last 150 test results summaries for a given Synthetic browser test.

Get a specific custom destination in your organization.

Get a custom framework.

Get a dashboard using the specified ID.

Fetch an existing dashboard list's definition.

Use this API endpoint to get a deployment event.

Get downtime detail by downtime_id.

Use this API endpoint to get a failure event.

Get an APM retention filter.

Get the detailed configuration of a global variable.

Use this API endpoint to get a list of deployment events.

Get a list of entities from Software Catalog.

Get a list of entity kinds from Software Catalog.

Get a list of entity relations from Software Catalog.

List endpoint returns events that match an events search query. Results are paginated similarly to logs.

Use this endpoint to see your latest events.

Use this API endpoint to get a list of failure events.

List endpoint returns logs that match a log search query. [Results are paginated][1].

Use this endpoint to see your latest logs.

If you are considering archiving logs for your organization, consider use of the Datadog archive capabilities instead of the log list API. See [Datadog Logs Archive documentation][2].

[1]: /logs/guide/collect-multiple-logs-with-pagination [2]: https://docs.datadoghq.com/logs/archives

Returns all metrics that can be configured in the Metrics Summary page or with Metrics without Limits™ (matching additional filters if specified). Optionally, paginate by using the page[cursor] and/or page[size] query parameters. To fetch the first page, pass in a query parameter with either a valid page[size] or an empty cursor like page[cursor]=. To fetch the next page, pass in the next_cursor value from the response as the new page[cursor] value. Once the meta.pagination.next_cursor value is null, all pages have been retrieved.

Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.

Get a specific log-based metric from your organization.

Get the detailed configuration associated with a Synthetic Mobile test.

Get a monitor configuration policy by policy_id.

Returns a monitor notification rule by rule_id.

Get details about the specified monitor from your organization.

Get a specific pipeline from your organization. This endpoint takes no JSON arguments.

Get a Synthetic private location.

The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.

Get a role in the organization specified by the role’s role_id.

Get a rule's details.

Get a specific rum-based metric from your organization.

Get the details of a specific security filter.

See the security filter guide for more examples.

Fetch an existing shared dashboard's sharing metadata associated with the specified token.

Get a signal's details.

Get a single service definition from the Datadog Service Catalog.

Get a specific span-based metric from your organization.

Get the details of a specific suppression rule.

Get a single team using the team's id.

Get a single link for a team.

Get the detailed configuration associated with a Synthetic test.

Returns a single user invitation by its UUID.

Get a user organization. Returns the user information and all organizations joined by this user.

Get a user permission set. Returns a list of the user’s permissions granted by the associated user's roles.

Get all active downtimes for the specified monitor.

Get the list of actively reporting metrics from a given time until now.

Get all aggregated connections.

Get all aggregated DNS traffic.

Get the list of configured logs archives with their definitions.

Get the list of configured custom destinations in your organization with their definitions.

Fetch all of your existing dashboard list definitions.

Get all dashboards.

Note: This query will only return custom created or cloned dashboards. This query will not return preset dashboards.

Get all scheduled downtimes.

Get the list of all Synthetic global variables.

This endpoint allows searching for hosts by name, alias, or tag. Hosts live within the past 3 hours are included by default. Retention is 7 days. Results are paginated with a max of 1000 results at a time.

The Index object describes the configuration of a log index. This endpoint returns an array of the LogIndex objects of your organization.

Describe the invitations that exist for the given shared dashboard (paginated).

Get the list of public and private locations available for Synthetic tests. No arguments required.

Get the list of configured log-based metrics with their definitions.

Get all monitor configuration policies.

Returns a list of all monitor notification rules.

Get all monitors from your organization.

Get all pipelines from your organization. This endpoint takes no JSON arguments.

Get the list of configured rum-based metrics with their definitions.

Get the list of configured security filters with their definitions.

Get a list of all service definitions from the Datadog Service Catalog.

Get all Service Level Objective corrections.

Get a list of service level objective objects for your organization.

Get the list of configured span-based metrics with their definitions.

Get the list of all suppression rules.

Get all teams. Can be used to search for teams using the filter[keyword] and filter[me] query parameters.

Get a list of all tenant-based handles from the Datadog Microsoft Teams integration.

Gets all users of a role.

Get a list of all Workflows webhook handles from the Datadog Microsoft Teams integration.

Get the detailed configuration associated with a Synthetic API test.

Get a specific full result from a given Synthetic API test.

Get the last 150 test results summaries for a given Synthetic API test.

Get a specific archive from your organization.

Get the details of an event by event_id.

Get one log index from your organization. This endpoint takes no JSON arguments.

Get an SLO correction.

Get a service level objective object.

Get a specific SLO’s history, regardless of its SLO type.

The detailed history data is structured according to the source data type. For example, metric data is included for event SLOs that use the metric source, and monitor SLO types include the monitor transition history.

Note: There are different response formats for event based and time based SLOs. Examples of both are shown.

Get the current order of your archives. This endpoint takes no JSON arguments.

Get the tenant, team, and channel ID of a channel in the Datadog Microsoft Teams integration.

Get corrections applied to an SLO

Get a specific Datadog dashboard by ID, including all widgets and configuration.

Get the details of a notification rule for security signals.

Get the details of a notification rule for security vulnerabilities.

Get a batch's updated details.

Get a specific Datadog downtime by ID.

Get the current order of your log indexes. This endpoint takes no JSON arguments.

Fetch the dashboard list’s dashboard definitions.

Get all links for a given team.

Get the list of current AWS services that Datadog offers automatic log collection. Use returned service IDs with the services parameter for the Enable an AWS service log collection API endpoint.

Get metadata about a specific metric.

Get a specific Datadog monitor by ID, including full configuration and state.

Get an application key owned by this service account.

Get all permission settings for a given team.

Get the current order of your pipelines. This endpoint takes no JSON arguments.

Get the list of suppressions that affect a specific existing rule by its ID.

Get the list of suppressions that would affect a rule.

Returns the cardinality details of tags for a specific metric.

Get Datadog team details by ID.

Get a paginated list of members for a team

Get the tenant, team, and channel information of a tenant-based handle from the Datadog Microsoft Teams integration.

Get the default locations settings.

Get the device details.

Get the list of all Synthetic tests.

Get the list of devices.

Get the list of interfaces of the device.

Returns the list of notification rules for security signals.

Get the list of tags for a device.

Returns the list of notification rules for security vulnerabilities.

Get the on-demand concurrency cap.

This endpoint returns the total number of active and up hosts in your Datadog account. Active means the host has reported in the past hour, and up means it has reported in the past two hours.

Get Datadog user details by ID.

Get a user in the organization specified by the user’s user_id.

Get a list of memberships for a user

Get the name of a Workflows webhook handle from the Datadog Microsoft Teams integration.

Adds a permission to a role.

Adds a read role to an archive. (Roles API)

List tags and aggregations that are actively queried on dashboards, notebooks, monitors, the Metrics Explorer, and using the API for a given metric name.

Get the list of APM retention filters.

List all Datadog-AWS Logs integrations configured in your Datadog account.

Get the list of all users in the organization. This list includes all users even if they are deactivated or unverified.

List all application keys available for this service account.

List all Datadog dashboards with optional filtering.

List Datadog dashboards with optional filtering by name and tags. Returns dashboard IDs, titles, and direct URLs.

View distinct metrics volumes for the given metric name.

Custom metrics generated in-app from other products will return null for ingested volumes.

List all Datadog downtimes, optionally filtering to active-only.

List Datadog scheduled downtimes, optionally showing only currently active ones.

List Datadog infrastructure hosts with optional filtering.

List Datadog incidents with optional search filtering and pagination.

List all Datadog monitors with optional filtering by name, tags, and state.

List Datadog monitors with filtering by name, tags, and state. Returns simplified monitor info.

Returns a list of all permissions, including name, description, and ID.

Returns a list of all permissions for a single role.

Returns all read roles a given archive is restricted to.

List resource filters.

Returns all roles, including their names and their unique identifiers.

List rules.

Returns the tag configuration for the given metric name.

View indexed tag key-value pairs for a given metric name over the previous hour.

List all Datadog teams with pagination and filtering.

List all Datadog users with pagination and filtering.

Modify the triage assignee of a security signal.

Search and filter your monitor groups details.

Search and filter your monitors details.

Mute a host. Note: This creates a Downtime V2 for the host.

Mute the specified monitor.

Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.

Patch the configuration of a Synthetic test with partial data.

Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.

Pause or start a Synthetic test by changing the status.

This endpoint allows you to post events to the stream. Tag them, set priority and event aggregate them with other events.

Query Datadog metrics timeseries data. Supports multiple queries with custom time ranges.

Query scalar values (as seen on Query Value, Table, and Toplist widgets). Multiple data sources are supported with the ability to process the data using formulas and functions.

Query timeseries data across various data sources and process the data by applying formulas and functions.

Query timeseries points.

Re-order the execution order of retention filters.

Returns dashboards, monitors, notebooks, and SLOs that a metric is stored in, if any. Updated every 24 hours.

Remove a team using the team's id.

Remove a link from a team.

Removes a user from a role.

Remove a user from a team.

Restore dashboards using the specified IDs. If there are any failures, no dashboards will be restored (partial success is not allowed).

Revoke the public URL for a dashboard (rendering it private) associated with the specified token.

Removes a permission from a role.

Removes a role from an archive. (Roles API)

Revoke previously sent invitation emails and active sessions used to access a given shared dashboard for specific email addresses.

Save new value for on-demand concurrency cap.

Schedule a downtime.

List endpoint returns events that match an events search query. Results are paginated similarly to logs.

Use this endpoint to build complex events filtering and search.

Get a list of service level objective objects for your organization.

Search Datadog logs with a query and time range. Returns a compact digest: counts by status, service and message, plus one flat line per log. Set include_attributes for the full raw payload (much larger).

Search for metrics from the last 24 hours in Datadog.

Search for Synthetic tests and Test Suites.

Use this API endpoint to provide data about deployments for DORA metrics.

This is necessary for:

• Deployment Frequency
• Change Lead Time
• Change Failure Rate

Use this API endpoint to provide failure data for DORA metrics.

This is necessary for:

• Change Failure Rate
• Time to Restore

Sends emails to one or more users inviting them to join the organization.

Send your logs to your Datadog platform over HTTP. Limits per HTTP request are:

• Maximum content size per payload (uncompressed): 5MB
• Maximum size for a single log: 1MB
• Maximum array size if sending multiple logs in an array: 1000 entries

Any log exceeding 1MB is accepted and truncated by Datadog:

• For a single log request, the API truncates the log at 1MB and returns a 2xx.
• For a multi-logs request, the API processes all logs, truncates only logs larger than 1MB, and returns a 2xx.

Datadog recommends sending your logs compressed. Add the Content-Encoding: gzip header to the request when sending compressed logs. Log events can be submitted with a timestamp that is up to 18 hours in the past.

The status codes answered by the HTTP API are:

• 202: Accepted: the request has been accepted for processing
• 400: Bad request (likely an issue in the payload formatting)
• 401: Unauthorized (likely a missing API Key)
• 403: Permission issue (likely using an invalid API Key)
• 408: Request Timeout, request should be retried after some time
• 413: Payload too large (batch is above 5MB uncompressed)
• 429: Too Many Requests, request should be retried after some time
• 500: Internal Server Error, the server encountered an unexpected condition that prevented it from fulfilling the request, request should be retried after some time
• 503: Service Unavailable, the server is not ready to handle the request probably because it is overloaded, request should be retried after some time

Send emails to specified email addresses containing links to access a given authenticated shared dashboard. Email addresses must already belong to the authenticated shared dashboard's share_list.

Submit a list of Service Checks.

Notes:

• A valid API key is required.
• Service checks can be submitted up to 10 minutes in the past.

The distribution points end-point allows you to post distribution data that can be graphed on Datadog’s dashboards.

The metrics end-point allows you to post time-series data that can be graphed on Datadog’s dashboards. The maximum payload size is 500 kilobytes (512000 bytes). Compressed payloads must have a decompressed size of less than 5 megabytes (5242880 bytes).

If you’re submitting metrics directly to the Datadog API without using DogStatsD, expect:

• 64 bits for the timestamp
• 64 bits for the value
• 20 bytes for the metric names
• 50 bytes for the timeseries
• The full payload is approximately 100 bytes.

Host name is one of the resources in the Resources field.

Returns the estimated cardinality for a metric with a given tag, percentile and number of aggregations configuration using Metrics without Limits&trade;.

Test a rule.

Test an existing rule.

Trigger a set of Synthetic tests.

Trigger a set of Synthetic tests for continuous integration.

Unmutes a host. This endpoint takes no JSON arguments.

Unmute the specified monitor.

Update the given fields of a specific custom destination in your organization.

Update a custom framework.

Update a dashboard using the specified ID.

Update the name of a dashboard list.

Update a downtime by downtime_id.

Update a specific log-based metric from your organization. Returns the log-based metric object from the request body when the request is successful.

Updates a monitor notification rule by rule_id.

Update a given pipeline configuration to change it’s processors or their order.

Note: Using this method updates your pipeline configuration by replacing your current configuration with the new one sent to your Datadog organization.

Update a retention filter from your organization.

Edit a role. Can only be used with application keys belonging to administrators.

Update a specific rum-based metric from your organization. Returns the rum-based metric object from the request body when the request is successful.

Update a specific security filter. Returns the security filter object when the request is successful.

Update a shared dashboard associated with the specified token.

Update a specific span-based metric from your organization. Returns the span-based metric object from the request body when the request is successful.

Update a specific suppression rule.

Update the tag configuration of a metric or percentile aggregations of a distribution metric or custom aggregations of a count, rate, or gauge metric. By setting exclude_tags_mode to true the behavior is changed from an allow-list to a deny-list, and tags in the defined list will not be queryable. Can only be used with application keys from users with the Manage Tags for Metrics permission. This endpoint requires a tag configuration to be created first.

Update a team using the team's id. If the team_links relationship is present, the associated links are updated to be in the order they appear in the array, and any existing team links not present are removed.

Update a team link.

Edit a user. Can only be used with an application key belonging to an administrator user.

Update a user's membership attributes on a team.

Update a given archive configuration.

Note: Using this method updates your archive configuration by replacing your current configuration with the new one sent to your Datadog organization.

Update an existing rule. When updating cases, queries or options, the whole field must be included. For example, when modifying a query all queries must be included. Default rules can only be updated to be enabled, to change notifications, or to update the tags (default tags cannot be removed).

Update an index as identified by its name. Returns the Index object passed in the request body when the request is successful.

Using the PUT method updates your index’s configuration by replacing your current configuration with the new one sent to your Datadog organization.

Update the specified service level objective object.

Update the specified SLO correction object.

Update the order of your archives. Since logs are processed sequentially, reordering an archive may change the structure and content of the data processed by other archives.

Note: Using the PUT method updates your archive's order by replacing the current order with the new one.

Update an existing Datadog dashboard.

Update an existing Datadog downtime.

This endpoint updates the index order of your organization. It returns the index order object passed in the request body when the request is successful.

Update dashboards of an existing dashboard list.

Update an existing Datadog monitor configuration.

Update a team permission setting for a given team.

Update the order of your pipelines. Since logs are processed sequentially, reordering a pipeline may change the structure and content of the data processed by other pipelines and their processors.

Note: Using the PUT method updates your pipeline order by replacing your current order with the new one sent to your Datadog organization.

Update resource filters.

Update a Datadog team.

Update a tenant-based handle from the Datadog Microsoft Teams integration.

Update the tags for a device.

Update a Datadog user profile.

Update a Workflows webhook handle from the Datadog Microsoft Teams integration.

Validate a detection rule.

Validate the monitor provided in the request.

Note: Log monitors require an unscoped App Key.

Validate a suppression rule.

Validate the monitor provided in the request.