Use Datadog to send or query telemetry, manage monitors and incidents, and inspect observability data from a workflow. The actions below also cover dashboards, SLOs, synthetic tests, and security signals.
Integrate Datadog monitoring into workflows. Submit metrics, manage monitors, query logs, create events, handle downtimes, and more.
Submit custom metrics to Datadog. Use for tracking application performance, business metrics, or custom monitoring data.
| Parameter | Type | Required | Description |
|---|
series | string | Yes | JSON array of metric series to submit. Each entry needs "metric" and "points" (objects with "timestamp" in POSIX seconds and a numeric "value"); timestamps cannot be more than 10 minutes in the future or 1 hour in the past. Optional per entry: "type" ("count", "rate", or "gauge"; omit to let Datadog infer), "interval" in seconds (required by Datadog for count and rate), "tags", "unit", "sourceTypeName", and "resources". |
apiKey | string | Yes | Datadog API key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the metrics were submitted successfully |
errors | array | Any errors that occurred during submission |
Query metric timeseries data from Datadog. Use for analyzing trends, creating reports, or retrieving metric values.
| Parameter | Type | Required | Description |
|---|
query | string | Yes | Datadog metrics query (e.g., "avg:system.cpu.user{*}", "sum:nginx.requests{env:prod}.as_count()") |
from | number | Yes | Start time as Unix timestamp in seconds (e.g., 1705320000) |
to | number | Yes | End time as Unix timestamp in seconds (e.g., 1705323600) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
series | array | Array of timeseries data with metric name, tags, and data points |
↳ metric | string | Metric name |
↳ tags | array | Tags attached to the series |
↳ points | array | Data points |
↳ timestamp | number | Point timestamp (Unix seconds) |
↳ value | number | Point value |
status | string | Query status |
Post an event to the Datadog event stream. Use for deployment notifications, alerts, or any significant occurrences.
| Parameter | Type | Required | Description |
|---|
title | string | Yes | Event title |
text | string | Yes | Event body/description. Supports markdown. |
alertType | string | No | Alert type: error, warning, info, success, user_update, recommendation, or snapshot |
priority | string | No | Event priority: normal or low |
host | string | No | Host name to associate with this event (e.g., "web-server-01", "prod-api-1") |
tags | string | No | Comma-separated list of tags (e.g., "env:production,service:api", "team:backend,priority:high") |
aggregationKey | string | No | Key to aggregate events together |
sourceTypeName | string | No | Source type name for the event |
dateHappened | number | No | Unix timestamp in seconds when the event occurred (e.g., 1705320000, defaults to now). Datadog limits this to events no older than 18 hours. |
apiKey | string | Yes | Datadog API key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
event | object | The created event details |
↳ id | number | Event ID |
↳ title | string | Event title |
↳ text | string | Event text |
↳ date_happened | number | Unix timestamp when event occurred |
↳ priority | string | Event priority |
↳ alert_type | string | Alert type |
↳ host | string | Associated host |
↳ tags | array | Event tags |
↳ url | string | URL to view the event in Datadog |
Create a new monitor/alert in Datadog. Monitors can track metrics, service checks, events, and more.
| Parameter | Type | Required | Description |
|---|
name | string | Yes | Monitor name |
type | string | Yes | Monitor type: metric alert, service check, event alert, process alert, log alert, query alert, composite, synthetics alert, slo alert |
query | string | Yes | Monitor query (e.g., "avg(last_5m):avg:system.cpu.idle{*} < 20", "logs("status:error").index("main").rollup("count").last("5m") > 100") |
message | string | No | Message to include with notifications. Can include @-mentions and markdown. |
tags | string | No | Comma-separated list of tags |
priority | number | No | Monitor priority (1-5, where 1 is highest) |
options | string | No | JSON string of monitor options (thresholds, notify_no_data, renotify_interval, etc.) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
monitor | object | The created monitor details |
↳ id | number | Monitor ID |
↳ name | string | Monitor name |
↳ type | string | Monitor type |
↳ query | string | Monitor query |
↳ message | string | Notification message |
↳ tags | array | Monitor tags |
↳ priority | number | Monitor priority |
↳ overall_state | string | Current monitor state |
↳ created | string | Creation timestamp |
↳ modified | string | Last modification timestamp |
↳ options | json | Monitor options (thresholds, notification settings) |
↳ creator | json | Monitor creator (email, handle, name) |
Retrieve details of a specific monitor by ID.
| Parameter | Type | Required | Description |
|---|
monitorId | string | Yes | The ID of the monitor to retrieve (e.g., "12345678") |
groupStates | string | No | Comma-separated group states to include. Valid values are "all", "alert", "warn", and "no data" (e.g., "alert,warn"). |
withDowntimes | boolean | No | Include downtime data with the monitor |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
monitor | object | The monitor details |
↳ id | number | Monitor ID |
↳ name | string | Monitor name |
↳ type | string | Monitor type |
↳ query | string | Monitor query |
↳ message | string | Notification message |
↳ tags | array | Monitor tags |
↳ priority | number | Monitor priority |
↳ overall_state | string | Current monitor state |
↳ created | string | Creation timestamp |
↳ modified | string | Last modification timestamp |
↳ options | json | Monitor options (thresholds, notification settings) |
↳ creator | json | Monitor creator (email, handle, name) |
List all monitors in Datadog with optional filtering by name, tags, or state.
| Parameter | Type | Required | Description |
|---|
groupStates | string | No | Comma-separated group states to filter by. Valid values are "all", "alert", "warn", and "no data" (e.g., "alert,warn"). |
name | string | No | Filter monitors by name with partial match (e.g., "CPU", "Production") |
tags | string | No | Comma-separated list of tags to filter by (e.g., "env:prod,team:backend") |
monitorTags | string | No | Comma-separated list of monitor tags to filter by (e.g., "service:api,priority:high") |
withDowntimes | boolean | No | Include downtime data with monitors |
page | number | No | Page to start paginating from (0-indexed, e.g., 0, 1, 2). Datadog returns every monitor in the org without pagination when this is not specified, so set it to bound the response. Setting Page Size alone implies page 0. |
pageSize | number | No | Number of monitors per page (e.g., 50, max: 1000). Datadog only applies this when a page is specified — otherwise it returns all monitors with no page size limit — so setting this alone sends page 0. With a page but no page size, Datadog defaults to 100. |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
monitors | array | List of monitors |
↳ id | number | Monitor ID |
↳ name | string | Monitor name |
↳ type | string | Monitor type |
↳ query | string | Monitor query |
↳ message | string | Notification message |
↳ overall_state | string | Current state |
↳ tags | array | Tags |
↳ priority | number | Monitor priority |
↳ options | json | Monitor options (thresholds, notification settings) |
↳ created | string | Creation timestamp |
↳ modified | string | Last modification timestamp |
↳ creator | json | Monitor creator (email, handle, name) |
Mute a monitor to temporarily suppress its notifications. Use Unmute Monitor to reverse it, or schedule a downtime instead when you want a planned, auditable maintenance window.
| Parameter | Type | Required | Description |
|---|
monitorId | string | Yes | The ID of the monitor to mute (e.g., "12345678") |
scope | string | No | Scope to mute (e.g., "host:myhost", "env:prod"). If not specified, mutes all scopes. |
end | number | No | Unix timestamp in seconds when the mute should end (e.g., 1705323600). If not specified, the monitor stays muted until it is unmuted. |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the monitor was successfully muted |
monitorId | number | ID of the muted monitor |
name | string | Name of the muted monitor |
overallState | string | Monitor state after muting |
Unmute a monitor so it resumes sending notifications. Reverses Mute Monitor, either for one scope or for every scope at once.
| Parameter | Type | Required | Description |
|---|
monitorId | string | Yes | The ID of the monitor to unmute (e.g., "12345678") |
scope | string | No | Scope to unmute (e.g., "host:myhost"). Leave blank to unmute the monitor itself rather than a single scope. |
allScopes | boolean | No | Clear the mute settings for every scope on this monitor |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the monitor was successfully unmuted |
monitorId | number | ID of the unmuted monitor |
name | string | Name of the unmuted monitor |
overallState | string | Monitor state after unmuting |
Search and retrieve logs from Datadog. Use for troubleshooting, analysis, or monitoring.
| Parameter | Type | Required | Description |
|---|
query | string | Yes | Log search query using Datadog query syntax (e.g., "service:web-app status:error", "host:prod-* @http.status_code:500") |
from | string | Yes | Start time in ISO-8601 format or relative time (e.g., "now-1h", "now-15m", "2024-01-15T10:00:00Z") |
to | string | Yes | End time in ISO-8601 format or relative time (e.g., "now", "now-5m", "2024-01-15T12:00:00Z") |
limit | number | No | Maximum number of logs to return (e.g., 50, 100, max: 1000) |
cursor | string | No | Pagination cursor from a previous call, taken from its nextLogId output. Omit for the first page. |
sort | string | No | Sort order: "timestamp" for oldest first, "-timestamp" for newest first |
indexes | string | No | Comma-separated list of log indexes to search |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
logs | array | List of log entries |
↳ id | string | Log ID |
↳ content | object | Log content |
↳ timestamp | string | Log timestamp |
↳ host | string | Host name |
↳ service | string | Service name |
↳ message | string | Log message |
↳ status | string | Log status/level |
↳ attributes | json | Free-form log attributes |
↳ tags | array | Log tags |
nextLogId | string | Cursor for pagination |
Send log entries to Datadog for centralized logging and analysis.
| Parameter | Type | Required | Description |
|---|
logs | string | Yes | JSON array of log entries. Each entry should have message and optionally ddsource, ddtags, hostname, service. Sim fills in ddsource="custom" when an entry omits it — that is a Sim default, not a Datadog one; set ddsource yourself to have Datadog apply the matching integration log pipeline. |
apiKey | string | Yes | Datadog API key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the logs were sent successfully |
Schedule a downtime to suppress monitor notifications during maintenance windows.
| Parameter | Type | Required | Description |
|---|
scope | string | Yes | Scope to apply downtime to (e.g., "host:myhost", "env:production", or "*" for all) |
message | string | No | Message to display during downtime |
start | number | No | Unix timestamp for downtime start in seconds (e.g., 1705320000, defaults to now) |
end | number | No | Unix timestamp for downtime end in seconds (e.g., 1705323600) |
timezone | string | No | Timezone for the downtime (e.g., "America/New_York", "UTC", "Europe/London") |
monitorId | string | No | Specific monitor ID to mute (e.g., "12345678") |
monitorTags | string | No | Comma-separated monitor tags to match (e.g., "team:backend,priority:high") |
muteFirstRecoveryNotification | boolean | No | Mute the first recovery notification |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
downtime | object | The created downtime details |
↳ id | string | Downtime UUID |
↳ scope | array | Downtime scope |
↳ message | string | Downtime message |
↳ start | number | Start time (Unix timestamp) |
↳ end | number | End time (Unix timestamp) |
↳ timezone | string | Display timezone for the downtime |
↳ active | boolean | Whether downtime is currently active |
↳ created | number | Creation time (Unix timestamp) |
↳ modified | number | Last modification time (Unix timestamp) |
List all scheduled downtimes in Datadog.
| Parameter | Type | Required | Description |
|---|
currentOnly | boolean | No | Only return currently active downtimes |
limit | number | No | Number of downtimes to return per page. Datadog defaults to 30 and declares no maximum; keep this at 100 or below to stay within the bound Sim recommends. |
offset | number | No | Index of the first downtime to return (e.g., 0, 30, 60) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
totalCount | number | Total number of downtimes matching the filter, across all pages |
downtimes | array | List of downtimes |
↳ id | string | Downtime UUID |
↳ scope | array | Downtime scope |
↳ message | string | Downtime message |
↳ start | number | Start time (Unix timestamp) |
↳ end | number | End time (Unix timestamp) |
↳ timezone | string | Display timezone for the downtime |
↳ active | boolean | Whether downtime is currently active |
↳ created | number | Creation time (Unix timestamp) |
↳ modified | number | Last modification time (Unix timestamp) |
Cancel a scheduled downtime.
| Parameter | Type | Required | Description |
|---|
downtimeId | string | Yes | The ID of the downtime to cancel (e.g., "abc123def456") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the downtime was successfully canceled |
List incidents for the organization. Requires the Incident Management incident_read permission; the Incidents API is in public beta.
| Parameter | Type | Required | Description |
|---|
include | string | No | Comma-separated related resources to include: "users" and/or "attachments" |
pageSize | number | No | Number of incidents to return per page (default: 10, max: 100) |
pageOffset | number | No | Index of the first incident to return (e.g., 0, 10, 20) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
incidents | array | List of incidents |
↳ id | string | Incident UUID |
↳ type | string | Resource type (incidents) |
↳ attributes | object | Incident attributes |
↳ title | string | Incident title |
↳ state | string | Incident state |
↳ severity | string | Incident severity |
↳ public_id | number | Incremental public incident ID |
↳ customer_impacted | boolean | Whether customers were impacted |
↳ created | string | Creation timestamp |
↳ modified | string | Last modification timestamp |
↳ resolved | string | Resolution timestamp |
nextOffset | number | Offset to use for the next page of results |
Get the details of a single incident by ID. Requires the Incident Management incident_read permission; the Incidents API is in public beta.
| Parameter | Type | Required | Description |
|---|
incidentId | string | Yes | The UUID of the incident (e.g., "00000000-0000-0000-1234-000000000000") |
include | string | No | Comma-separated related resources to include (e.g., "users", "attachments") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
incident | object | The incident |
↳ id | string | Incident UUID |
↳ type | string | Resource type (incidents) |
↳ attributes | object | Incident attributes |
↳ title | string | Incident title |
↳ state | string | Incident state |
↳ severity | string | Incident severity |
↳ public_id | number | Incremental public incident ID |
↳ customer_impacted | boolean | Whether customers were impacted |
↳ customer_impact_scope | string | Summary of the customer impact |
↳ created | string | Creation timestamp |
↳ modified | string | Last modification timestamp |
↳ resolved | string | Resolution timestamp |
↳ time_to_resolve | number | Seconds from creation to resolution |
Declare a new incident. Requires the Incident Management incident_write permission; the Incidents API is in public beta.
| Parameter | Type | Required | Description |
|---|
title | string | Yes | Title of the incident summarizing what happened |
customerImpacted | boolean | Yes | Whether the incident caused customer impact |
severity | string | No | Incident severity: UNKNOWN, SEV-0, SEV-1, SEV-2, SEV-3, SEV-4, or SEV-5 |
customerImpactScope | string | No | Summary of the customer impact. Required when customerImpacted is true |
incidentTypeUuid | string | No | UUID of the incident type. The default incident type is used when omitted |
isTest | boolean | No | Whether this is a test incident |
fields | string | No | JSON object of user-defined incident fields, e.g. {"severity": {"type": "dropdown", "value": "SEV-2"}} |
notificationHandles | string | No | Comma-separated handles to notify on creation (e.g., "@slack-incidents,@user@example.com") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
incident | object | The created incident |
↳ id | string | Incident UUID |
↳ type | string | Resource type (incidents) |
↳ attributes | object | Incident attributes |
↳ title | string | Incident title |
↳ public_id | number | Incremental public incident ID |
↳ customer_impacted | boolean | Whether customers were impacted |
↳ created | string | Creation timestamp |
↳ modified | string | Last modification timestamp |
Partially update an existing incident. Requires the Incident Management incident_write permission; the Incidents API is in public beta.
| Parameter | Type | Required | Description |
|---|
incidentId | string | Yes | The UUID of the incident to update |
title | string | No | New title for the incident |
severity | string | No | Incident severity: UNKNOWN, SEV-0, SEV-1, SEV-2, SEV-3, SEV-4, or SEV-5 |
customerImpacted | boolean | No | Whether the incident caused customer impact |
customerImpactScope | string | No | Summary of the customer impact |
customerImpactStart | string | No | ISO-8601 timestamp when customers began being impacted |
customerImpactEnd | string | No | ISO-8601 timestamp when customers were no longer impacted |
detected | string | No | ISO-8601 timestamp when the incident was detected |
fields | string | No | JSON object of user-defined incident fields to update, e.g. {"state": {"type": "dropdown", "value": "resolved"}} |
notificationHandles | string | No | Comma-separated handles to notify about the update |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
incident | object | The updated incident |
↳ id | string | Incident UUID |
↳ type | string | Resource type (incidents) |
↳ attributes | object | Incident attributes |
↳ title | string | Incident title |
↳ state | string | Incident state |
↳ severity | string | Incident severity |
↳ modified | string | Last modification timestamp |
↳ resolved | string | Resolution timestamp |
Add a follow-up task (todo) to an incident. Requires the Incident Management incident_write permission; the Incidents API is in public beta.
| Parameter | Type | Required | Description |
|---|
incidentId | string | Yes | The UUID of the incident the todo belongs to |
content | string | Yes | The follow-up task content (e.g., "Restore lost data") |
assignees | string | Yes | Comma-separated assignee handles (e.g., "@jane@example.com,@on-call"). Datadog requires at least one assignee |
dueDate | string | No | ISO-8601 timestamp for when the todo should be completed |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
todo | object | The created incident todo |
↳ id | string | Todo UUID |
↳ type | string | Resource type (incident_todos) |
↳ attributes | object | Todo attributes |
↳ content | string | Task content |
↳ assignees | array | Assignee handles |
↳ due_date | string | Due date |
↳ completed | string | Completion timestamp |
↳ incident_id | string | UUID of the parent incident |
List service level objectives, optionally filtered by IDs, name, tags, or underlying metrics query.
| Parameter | Type | Required | Description |
|---|
ids | string | No | Comma-separated SLO IDs to fetch (e.g., "id1,id2") |
query | string | No | Filter results by SLO name (e.g., "checkout latency") |
tagsQuery | string | No | Filter results by a single SLO tag (e.g., "env:prod") |
metricsQuery | string | No | Filter results by SLO numerator and denominator (e.g., "aws.elb.request_count") |
limit | number | No | Number of SLOs to return (default: 1000) |
offset | number | No | Offset of the first SLO returned (e.g., 0, 50) |
isDeleted | boolean | No | Return only deleted SLOs |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
slos | array | List of service level objectives |
↳ id | string | SLO ID |
↳ name | string | SLO name |
↳ type | string | SLO type: metric, monitor, or time_slice |
↳ description | string | SLO description |
↳ tags | array | SLO tags |
↳ thresholds | array | Timeframe targets and warnings |
↳ target_threshold | number | Primary target threshold |
↳ warning_threshold | number | Primary warning threshold |
↳ timeframe | string | Primary timeframe |
↳ monitor_ids | array | Monitor IDs for monitor-based SLOs |
↳ created_at | number | Creation timestamp (Unix seconds) |
↳ modified_at | number | Modification timestamp (Unix seconds) |
Get the configuration of a single service level objective by ID.
| Parameter | Type | Required | Description |
|---|
sloId | string | Yes | The ID of the service level objective |
withConfiguredAlertIds | boolean | No | Include the IDs of SLO monitors that reference this SLO |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
slo | object | The service level objective |
↳ id | string | SLO ID |
↳ name | string | SLO name |
↳ type | string | SLO type: metric, monitor, or time_slice |
↳ description | string | SLO description |
↳ tags | array | SLO tags |
↳ thresholds | array | Timeframe targets and warnings |
↳ target_threshold | number | Primary target threshold |
↳ warning_threshold | number | Primary warning threshold |
↳ timeframe | string | Primary timeframe |
↳ monitor_ids | array | Monitor IDs for monitor-based SLOs |
↳ groups | array | Monitor groups narrowing the SLO scope |
↳ configured_alert_ids | array | SLO monitor IDs referencing this SLO |
↳ created_at | number | Creation timestamp (Unix seconds) |
↳ modified_at | number | Modification timestamp (Unix seconds) |
Create a service level objective from a metric query, monitors, or a time-slice condition.
| Parameter | Type | Required | Description |
|---|
name | string | Yes | Name of the SLO (e.g., "Checkout API availability") |
type | string | Yes | SLO type: "metric" (supply query) or "monitor" (supply monitorIds). Time-slice SLOs are not supported here because they need an SLI specification this tool does not send. |
thresholds | string | Yes | JSON array of thresholds, e.g. [{"timeframe": "30d", "target": 99.9, "warning": 99.95}] |
description | string | No | Description of the SLO |
tags | string | No | Comma-separated tags (e.g., "env:prod,team:core") |
query | string | No | For metric SLOs, JSON with numerator and denominator, e.g. {"numerator": "sum:requests{status:ok}.as_count()", "denominator": "sum:requests{*}.as_count()"} |
monitorIds | string | No | For monitor SLOs, comma-separated monitor IDs (e.g., "123,456") |
groups | string | No | For monitor SLOs with a single monitor, comma-separated monitor groups (e.g., "env:prod,role:mysql") |
targetThreshold | number | No | Primary target threshold (e.g., 99.9) |
warningThreshold | number | No | Primary warning threshold, must be greater than the target (e.g., 99.95) |
timeframe | string | No | Primary timeframe: "7d", "30d", or "90d" |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
slo | object | The created service level objective |
↳ id | string | SLO ID |
↳ name | string | SLO name |
↳ type | string | SLO type |
↳ description | string | SLO description |
↳ tags | array | SLO tags |
↳ thresholds | array | Timeframe targets and warnings |
↳ created_at | number | Creation timestamp (Unix seconds) |
↳ modified_at | number | Modification timestamp (Unix seconds) |
Update a service level objective. Reads the current SLO first and applies only the fields you supply, so anything left blank keeps its stored value.
| Parameter | Type | Required | Description |
|---|
sloId | string | Yes | The ID of the service level objective to update |
name | string | No | New name for the SLO. Leave blank to keep the current name. |
type | string | No | SLO type: "metric" or "monitor". Leave blank to keep the current type. Changing type requires supplying the matching query or monitorIds. |
thresholds | string | No | JSON array of thresholds replacing the stored ones, e.g. [{"timeframe": "30d", "target": 99.9, "warning": 99.95}]. Leave blank to keep the current thresholds. |
description | string | No | Description of the SLO |
tags | string | No | Comma-separated tags (e.g., "env:prod,team:core") |
query | string | No | For metric SLOs, JSON with numerator and denominator, e.g. {"numerator": "sum:requests{status:ok}.as_count()", "denominator": "sum:requests{*}.as_count()"} |
monitorIds | string | No | For monitor SLOs, comma-separated monitor IDs (e.g., "123,456") |
groups | string | No | Comma-separated monitor groups (e.g., "env:prod,role:mysql") |
targetThreshold | number | No | Primary target threshold (e.g., 99.9) |
warningThreshold | number | No | Primary warning threshold, must be greater than the target (e.g., 99.95) |
timeframe | string | No | Primary timeframe: "7d", "30d", or "90d" |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
slo | object | The updated service level objective |
↳ id | string | SLO ID |
↳ name | string | SLO name |
↳ type | string | SLO type |
↳ description | string | SLO description |
↳ tags | array | SLO tags |
↳ thresholds | array | Timeframe targets and warnings |
↳ modified_at | number | Modification timestamp (Unix seconds) |
Permanently delete a service level objective. Datadog returns a conflict when the SLO is still referenced by a dashboard.
| Parameter | Type | Required | Description |
|---|
sloId | string | Yes | The ID of the service level objective to delete |
force | boolean | No | Delete even when the SLO is referenced by other resources |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the SLO was deleted |
deletedIds | array | IDs of the deleted service level objectives |
Get an SLO’s history over a time window, including the overall SLI value and remaining error budget.
| Parameter | Type | Required | Description |
|---|
sloId | string | Yes | The ID of the service level objective |
fromTs | number | Yes | Start of the query window as a Unix timestamp in seconds |
toTs | number | Yes | End of the query window as a Unix timestamp in seconds |
target | number | No | SLO target between 0 and 100. When supplied, the response includes the remaining error budget for a custom timeframe |
applyCorrection | boolean | No | Whether to apply SLO corrections (defaults to true) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
history | object | SLO history for the requested window |
↳ from_ts | number | Window start (Unix seconds) |
↳ to_ts | number | Window end (Unix seconds) |
↳ type | string | SLO type |
↳ overall | object | Overall SLI data for the window |
↳ sli_value | number | SLI value over the window |
↳ span_precision | number | Decimal precision of the SLI value |
↳ error_budget_remaining | object | Remaining error budget keyed by timeframe |
↳ groups | array | Per-group SLI data for grouped SLOs |
↳ monitors | array | Per-monitor SLI data for multi-monitor SLOs |
↳ thresholds | object | Thresholds keyed by timeframe |
sliValue | number | Overall SLI value over the window |
List custom created or cloned dashboards. Datadog preset dashboards are not returned.
| Parameter | Type | Required | Description |
|---|
filterShared | boolean | No | Return only shared dashboards |
filterDeleted | boolean | No | Return only deleted dashboards. Incompatible with filterShared |
count | number | No | Maximum number of dashboards to return (default: 100) |
start | number | No | Offset of the first dashboard returned (e.g., 0, 100) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
dashboards | array | List of dashboard summaries |
↳ id | string | Dashboard ID |
↳ title | string | Dashboard title |
↳ description | string | Dashboard description |
↳ layout_type | string | Layout type: ordered or free |
↳ url | string | Dashboard URL path |
↳ author_handle | string | Handle of the dashboard author |
↳ created_at | string | Creation timestamp |
↳ modified_at | string | Modification timestamp |
↳ is_read_only | boolean | Whether the dashboard is read-only |
Get the full definition of a dashboard, including its widgets.
| Parameter | Type | Required | Description |
|---|
dashboardId | string | Yes | The ID of the dashboard (e.g., "abc-def-ghi") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
dashboard | object | The dashboard definition |
↳ id | string | Dashboard ID |
↳ title | string | Dashboard title |
↳ description | string | Dashboard description |
↳ layout_type | string | Layout type: ordered or free |
↳ url | string | Dashboard URL path |
↳ author_handle | string | Handle of the dashboard author |
↳ author_name | string | Name of the dashboard author |
↳ created_at | string | Creation timestamp |
↳ modified_at | string | Modification timestamp |
↳ tags | array | Dashboard tags |
↳ notify_list | array | Handles notified on dashboard changes |
↳ template_variables | array | Template variable definitions |
↳ widgets | array | Widget definitions |
Create a dashboard from a title, layout type, and widget definitions.
| Parameter | Type | Required | Description |
|---|
title | string | Yes | Title of the dashboard |
layoutType | string | Yes | Layout type: "ordered" or "free" |
widgets | string | Yes | JSON array of widget definitions, e.g. [{"definition": {"type": "timeseries", "requests": [{"q": "avg:system.cpu.user{*}"}]}}] |
description | string | No | Description of the dashboard |
notifyList | string | No | Comma-separated user handles to notify on dashboard changes |
templateVariables | string | No | JSON array of template variable definitions, e.g. [{"name": "env", "prefix": "env", "available_values": ["prod"]}] |
tags | string | No | Comma-separated dashboard tags in the form "team:<name>" (max 5) |
reflowType | string | No | Reflow type for ordered layouts: "auto" or "fixed" |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
dashboard | object | The created dashboard |
↳ id | string | Dashboard ID |
↳ title | string | Dashboard title |
↳ layout_type | string | Layout type: ordered or free |
↳ url | string | Dashboard URL path |
↳ author_handle | string | Handle of the dashboard author |
↳ created_at | string | Creation timestamp |
↳ modified_at | string | Modification timestamp |
↳ widgets | array | Widget definitions |
Delete a dashboard by ID.
| Parameter | Type | Required | Description |
|---|
dashboardId | string | Yes | The ID of the dashboard to delete |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether the dashboard was deleted |
deletedDashboardId | string | ID of the deleted dashboard |
List all Synthetic tests (API, browser, and mobile) with their current status.
| Parameter | Type | Required | Description |
|---|
pageSize | number | No | Number of tests returned per page (default: 100) |
pageNumber | number | No | Page to retrieve, starting at zero |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
tests | array | List of Synthetic tests |
↳ public_id | string | Public ID of the test |
↳ name | string | Test name |
↳ status | string | Pause status: live or paused |
↳ type | string | Test type: api, browser, mobile, or network |
↳ subtype | string | Test subtype, such as http or ssl |
↳ message | string | Notification message |
↳ monitor_id | number | Associated monitor ID |
↳ tags | array | Tags attached to the test |
↳ locations | array | Locations the test runs from |
Get the configuration of a Synthetic test by public ID. Browser test steps are not included by this type-agnostic endpoint.
| Parameter | Type | Required | Description |
|---|
publicId | string | Yes | The public ID of the Synthetic test (e.g., "abc-def-ghi") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
test | object | The Synthetic test configuration |
↳ public_id | string | Public ID of the test |
↳ name | string | Test name |
↳ status | string | Pause status: live or paused |
↳ type | string | Test type: api, browser, mobile, or network |
↳ subtype | string | Test subtype, such as http or ssl |
↳ message | string | Notification message |
↳ monitor_id | number | Associated monitor ID |
↳ tags | array | Tags attached to the test |
↳ locations | array | Locations the test runs from |
↳ config | object | Test request, assertions, and variables |
↳ options | object | Scheduling, retry, and monitor options |
↳ creator | object | User who created the test |
Get the latest result summaries (up to the last 150 runs) for a Synthetic API test.
| Parameter | Type | Required | Description |
|---|
publicId | string | Yes | The public ID of the Synthetic API test |
fromTs | number | No | Timestamp in milliseconds from which to start querying results |
toTs | number | No | Timestamp in milliseconds up to which to query results |
probeDc | string | No | Comma-separated locations to query results for (e.g., "aws:eu-west-3") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
results | array | Latest test result summaries |
↳ result_id | string | ID of the test result |
↳ check_time | number | Time the test ran |
↳ probe_dc | string | Location the test ran from |
↳ status | number | Monitor status: 0 not triggered, 1 triggered, 2 no data |
↳ result | object | Run outcome |
↳ passed | boolean | Whether the run passed |
↳ timings | object | Request timing breakdown |
lastTimestampFetched | number | Timestamp of the latest test run |
Get the latest result summaries (up to the last 150 runs) for a Synthetic browser test, including step counts and errors.
| Parameter | Type | Required | Description |
|---|
publicId | string | Yes | The public ID of the Synthetic browser test |
fromTs | number | No | Timestamp in milliseconds from which to start querying results |
toTs | number | No | Timestamp in milliseconds up to which to query results |
probeDc | string | No | Comma-separated locations to query results for (e.g., "aws:eu-west-3") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
results | array | Latest browser test result summaries |
↳ result_id | string | ID of the browser test result |
↳ check_time | number | Time the browser test ran |
↳ probe_dc | string | Location the browser test ran from |
↳ status | number | Monitor status: 0 not triggered, 1 triggered, 2 no data |
↳ result | object | Run outcome |
↳ duration | number | Length of the run in milliseconds |
↳ errorCount | number | Number of errors collected in the run |
↳ stepCountCompleted | number | Steps completed before failing |
↳ stepCountTotal | number | Total number of steps |
↳ device | object | Device the run was performed on |
lastTimestampFetched | number | Timestamp of the latest browser test run |
Trigger an immediate run of one or more Synthetic tests by public ID.
| Parameter | Type | Required | Description |
|---|
publicIds | string | Yes | Comma-separated public IDs of the Synthetic tests to trigger |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
batchId | string | Public ID of the triggered batch |
triggeredCheckIds | array | Public IDs of the triggered Synthetic tests |
results | array | Information about each triggered test run |
↳ public_id | string | Public ID of the test |
↳ result_id | string | ID of the run result |
↳ location | number | Location ID of the run |
↳ device | string | Device ID used for browser tests |
locations | array | Locations the tests were triggered from |
↳ id | number | Location ID |
↳ name | string | Location name |
Pause or resume a Synthetic test by setting its status to "paused" or "live".
| Parameter | Type | Required | Description |
|---|
publicId | string | Yes | The public ID of the Synthetic test to update |
newStatus | string | Yes | New status: "live" to start the test or "paused" to pause it |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
success | boolean | Whether Datadog reported the status update as successful |
status | string | The status that was requested: live or paused |
Search Cloud SIEM security signals by query and time range. Requires the security_monitoring_signals_read permission.
| Parameter | Type | Required | Description |
|---|
query | string | No | Signal search query (e.g., "security:attack status:high") |
from | string | No | Minimum timestamp as an ISO-8601 date-time (e.g., "2026-01-02T09:42:36.320Z"). Signal search does not accept relative expressions like "now-1h". |
to | string | No | Maximum timestamp as an ISO-8601 date-time (e.g., "2026-01-03T09:42:36.320Z"). Signal search does not accept relative expressions like "now". |
sort | string | No | Sort order: "timestamp" for oldest first, "-timestamp" for newest first |
cursor | string | No | Pagination cursor returned as nextCursor by a previous call |
limit | number | No | Maximum number of signals to return (default: 10, max: 1000) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
signals | array | List of security signals |
↳ id | string | Signal ID |
↳ type | string | Resource type (signal) |
↳ attributes | object | Signal attributes |
↳ message | string | Message from the detection rule |
↳ timestamp | string | Signal timestamp |
↳ tags | array | Tags on the signal |
↳ custom | object | Signal-specific attributes |
nextCursor | string | Cursor for the next page of signals |
Get the details of a single Cloud SIEM security signal. Requires the security_monitoring_signals_read permission.
| Parameter | Type | Required | Description |
|---|
signalId | string | Yes | The ID of the security signal |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
signal | object | The security signal |
↳ id | string | Signal ID |
↳ type | string | Resource type (signal) |
↳ attributes | object | Signal attributes |
↳ message | string | Message from the detection rule |
↳ timestamp | string | Signal timestamp |
↳ tags | array | Tags on the signal |
↳ custom | object | Signal-specific attributes |
Change the triage state of a Cloud SIEM security signal to open, under_review, or archived. Requires the security_monitoring_signals_write permission.
| Parameter | Type | Required | Description |
|---|
signalId | string | Yes | The ID of the security signal |
state | string | Yes | New triage state: "open", "under_review", or "archived" |
archiveReason | string | No | Reason when archiving: none, false_positive, testing_or_maintenance, remediated, investigated_case_opened, true_positive_benign, true_positive_malicious, or other |
archiveComment | string | No | Comment explaining why the signal was archived |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
signal | object | The updated signal triage data |
↳ id | string | Signal ID |
↳ type | string | Resource type of the signal |
↳ state | string | Current triage state |
↳ assignee | object | User the signal is assigned to |
↳ incidentIds | array | IDs of incidents linked to the signal |
↳ archiveReason | string | Archive reason, when archived |
↳ archiveComment | string | Archive comment, when archived |
↳ stateUpdateTimestamp | number | Timestamp of the last state update |
Assign a Cloud SIEM security signal to a Datadog user by UUID. Requires the security_monitoring_signals_write permission.
| Parameter | Type | Required | Description |
|---|
signalId | string | Yes | The ID of the security signal |
assigneeUuid | string | Yes | UUID of the Datadog user to assign the signal to (e.g., "773b045d-ccf8-4808-bd3b-955ef6a8c940") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
signal | object | The updated signal triage data |
↳ id | string | Signal ID |
↳ type | string | Resource type of the signal |
↳ state | string | Current triage state |
↳ assignee | object | User the signal is assigned to |
↳ incidentIds | array | IDs of incidents linked to the signal |
↳ archiveReason | string | Archive reason, when archived |
↳ archiveComment | string | Archive comment, when archived |
↳ stateUpdateTimestamp | number | Timestamp of the last state update |
List Cloud SIEM detection rules. Requires the security_monitoring_rules_read permission.
| Parameter | Type | Required | Description |
|---|
query | string | No | Search query filtering rules by attributes such as type, source, or tags (e.g., "type:log_detection source:cloudtrail") |
sort | string | No | Sort attribute, prefix with "-" for descending: name, creation_date, update_date, enabled, type, highest_severity, or source |
pageSize | number | No | Number of rules per page (default: 10, max: 100) |
pageNumber | number | No | Page to retrieve, starting at zero |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
rules | array | List of detection rules |
↳ id | string | Rule ID |
↳ name | string | Rule name |
↳ type | string | Rule type |
↳ message | string | Message attached to generated signals |
↳ tags | array | Rule tags |
↳ isEnabled | boolean | Whether the rule is enabled |
↳ isDefault | boolean | Whether the rule is a Datadog default rule |
↳ createdAt | number | Creation timestamp in milliseconds |
↳ version | number | Rule version |
Search indexed APM spans using the span query syntax, with cursor pagination.
| Parameter | Type | Required | Description |
|---|
query | string | No | Span search query (e.g., "service:web* AND @http.status_code:[500 TO 599]"). Defaults to "*" |
from | string | No | Minimum time, ISO-8601, date math, or milliseconds (default: "now-15m") |
to | string | No | Maximum time, ISO-8601, date math, or milliseconds (default: "now") |
sort | string | No | Sort order: "timestamp" for oldest first, "-timestamp" for newest first |
cursor | string | No | Pagination cursor returned as nextCursor by a previous call |
limit | number | No | Maximum number of spans to return (default: 10, max: 1000) |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
spans | array | List of matching spans |
↳ id | string | Unique span event ID |
↳ type | string | Resource type (spans) |
↳ attributes | object | Span attributes |
↳ service | string | Service that emitted the span |
↳ resource_name | string | Resource name |
↳ env | string | Environment |
↳ host | string | Host that emitted the span |
↳ type | string | Span type, such as web or db |
↳ trace_id | string | Trace ID |
↳ span_id | string | Span ID |
↳ parent_id | string | Parent span ID |
↳ start_timestamp | string | Span start timestamp |
↳ end_timestamp | string | Span end timestamp |
↳ tags | array | Tags on the span |
↳ custom | object | Custom span data |
nextCursor | string | Cursor for the next page of spans |
elapsed | number | Query time in milliseconds |
List service definitions from the Datadog Service Catalog. Requires the apm_service_catalog_read permission.
| Parameter | Type | Required | Description |
|---|
pageSize | number | No | Number of service definitions per page (default: 10, max: 100) |
pageNumber | number | No | Page to retrieve, starting at zero |
schemaVersion | string | No | Schema version to return (e.g., "v2", "v2.1", "v2.2") |
apiKey | string | Yes | Datadog API key |
applicationKey | string | Yes | Datadog Application key |
site | string | No | Datadog site/region (default: datadoghq.com) |
| Parameter | Type | Description |
|---|
services | array | List of service definitions |
↳ id | string | Service definition ID |
↳ type | string | Resource type (service_definitions) |
↳ schema | object | The service definition schema. Its shape depends on the requested schema version |
↳ meta | object | Ingestion metadata such as origin and last modified time |