Use this API endpoint to aggregate CI Visibility pipeline events into buckets of computed metrics and timeseries.

The API endpoint to aggregate CI Visibility test events into buckets of computed metrics and timeseries.

The API endpoint to aggregate events into buckets and compute metrics and timeseries.

Get all aggregated connections.

Get all aggregated DNS traffic.

The API endpoint to aggregate RUM events into buckets of computed metrics and timeseries.

The API endpoint to aggregate spans into buckets and compute metrics and timeseries. This endpoint is rate limited to 300 requests per hour.

Check if the given monitors can be deleted.

Check if an SLO can be safely deleted. For example, assure an SLO can be deleted without disrupting a dashboard.

Create a new Action Connection. This API requires a registered application key.

Activate Agentless scan options for an AWS account.

Trigger the scan of an AWS resource with a high priority. Agentless scanning must be activated for the AWS account containing the resource to scan.

Create an API key.

Create a metric based on your ingested spans in your organization. Returns the span-based metric object from the request body when the request is successful.

Create a retention filter to index spans in your organization. Returns the retention filter definition when the request is successful.

Publish an app for use by other users. To ensure the app is accessible to the correct users, you also need to set a Restriction Policy on the app if a policy does not yet exist.

Create a new app, returning the app ID.

Create an application key with a given name.

Create an AuthN Mapping.

Archive case

Assign case to a user

Update case attributes

Update case priority

Create a Case

Create a project.

Update case status

Unarchive case

Unassign case

Create or update entities in Software Catalog.

Create or update kinds in Software Catalog.

Submit a list of Service Checks.

Notes:

• A valid API key is required.

• Service checks can be submitted up to 10 minutes in the past.

Send your pipeline event to your Datadog platform over HTTP. For details about how pipeline executions are modeled and what execution types we support, see Pipeline Data Model And Execution Types.

Pipeline events can be submitted with a timestamp that is up to 18 hours in the past.

Create a custom framework.

Create a Cloud Cost Management account for an AWS CUR config.

Create a Cloud Cost Management account for an Azure config.

Create a Cloud Cost Management account for an GCP Usage Cost config.

Create an application key for current user

Add dashboards to an existing dashboard list.

Create an empty dashboard list.

Send emails to specified email addresses containing links to access a given authenticated shared dashboard. Email addresses must already belong to the authenticated shared dashboard's share_list.

Share a specified private dashboard, generating a URL at which it can be publicly viewed.

Create a dashboard using the specified options. When defining queries in your widgets, take note of which queries should have the as_count() or as_rate() modifiers appended. Refer to the following documentation for more information on these modifiers.

Create a dashboard

Use this API endpoint to provide data about deployments for DORA metrics.

This is necessary for:

• Deployment Frequency

• Change Lead Time

• Change Failure Rate

Use this API endpoint to get a list of deployment events.

Use this API endpoint to provide failure data for DORA metrics.

This is necessary for:

• Change Failure Rate

• Time to Restore

Use this API endpoint to get a list of failure events.

Schedule a downtime.

This endpoint allows you to post events to the stream. Tag them, set priority and event aggregate them with other events.

Creates a new embeddable graph.

Note: If an embed already exists for the exact same query in a given organization, the older embed is returned instead of creating a new embed.

If you are interested in using template variables, see Embeddable Graphs with Template Variables.

Create a Datadog-Amazon Web Services integration. Using the POST method updates your integration configuration by adding your new configuration to the existing one in your Datadog organization. A unique AWS Account ID for role based authentication.

Create an Amazon EventBridge source.

Set an AWS tag filter.

Attach the Lambda ARN of the Lambda created for the Datadog-AWS log collection to your AWS account ID to enable log collection.

Test if permissions are present to add a log-forwarding triggers for the given services and AWS account. The input is the same as for Enable an AWS service log collection. Subsequent requests will always repeat the above, so this endpoint can be polled intermittently instead of blocking.

• Returns a status of 'created' when it's checking if the Lambda exists in the account.

• Returns a status of 'waiting' while checking.

• Returns a status of 'checked and ok' if the Lambda exists.

• Returns a status of 'error' if the Lambda does not exist.

Enable automatic log collection for a list of services. This should be run after running CreateAWSLambdaARN to save the configuration.

Test if permissions are present to add log-forwarding triggers for the given services and AWS account. Input is the same as for EnableAWSLogServices. Done async, so can be repeatedly polled in a non-blocking fashion until the async request completes.

• Returns a status of created when it's checking if the permissions exists in the AWS account.

• Returns a status of waiting while checking.

• Returns a status of checked and ok if the Lambda exists.

• Returns a status of error if the Lambda does not exist.

Update the defined list of host filters for a given Datadog-Azure integration.

Create a Datadog-Azure integration.

Using the POST method updates your integration configuration by adding your new configuration to the existing one in your Datadog organization.

Using the PUT method updates your integration configuration by replacing your current configuration with the new one sent to your Datadog organization.

Create a new entry within Datadog for your STS enabled service account.

Create a Datadog GCP principal.

Create a tenant-based handle in the Datadog Microsoft Teams integration.

Create a Workflows webhook handle in the Datadog Microsoft Teams integration.

Create a new service object in the Opsgenie integration.

Create a new service object in the PagerDuty integration.

Create a Cloudflare account.

Create a Confluent resource for the account associated with the provided ID.

Create a Confluent account.

Create a Fastly account.

Create a Fastly service for an account.

Add a channel to your Datadog-Slack integration.

Create an Okta account.

Creates an endpoint with the name <CUSTOM_VARIABLE_NAME>.

Creates an endpoint with the name <WEBHOOK_NAME>.

Adds a read role to an archive. (Roles API)

Create an archive in your organization.

Create a custom destination in your organization.

Creates a new index. Returns the Index object passed in the request body when the request is successful.

Create a metric based on your ingested logs in your organization. Returns the log-based metric object from the request body when the request is successful.

Create a pipeline in your organization.

Create and define a list of queryable tag keys for a set of existing count, gauge, rate, and distribution metrics. Metrics are selected by passing a metric name prefix. Use the Delete method of this API path to remove tag configurations. Results can be sent to a set of account email addresses, just like the same operation in the Datadog web app. If multiple calls include the same metric, the last configuration applied (not by submit order) is used, do not expect deterministic ordering of concurrent calls. The exclude_tags_mode value will set all metrics that match the prefix to the same exclusion state, metric tag configurations do not support mixed inclusion and exclusion for tags on the same metric. Can only be used with application keys of users with the Manage Tags for Metrics permission.

Create and define a list of queryable tag keys for an existing count/gauge/rate/distribution metric. Optionally, include percentile aggregations on any distribution metric. By setting exclude_tags_mode to true, the behavior is changed from an allow-list to a deny-list, and tags in the defined list are not queryable. Can only be used with application keys of users with the Manage Tags for Metrics permission.

Create a monitor using the specified options.

Monitor Types

The type of monitor chosen from:

• anomaly: query alert

• APM: query alert or trace-analytics alert

• composite: composite

• custom: service check

• forecast: query alert

• host: service check

• integration: query alert or service check

• live process: process alert

• logs: log alert

• metric: query alert

• network: service check

• outlier: query alert

• process: service check

• rum: rum alert

• SLO: slo alert

• watchdog: event-v2 alert

• event-v2: event-v2 alert

• audit: audit alert

• error-tracking: error-tracking alert

• database-monitoring: database-monitoring alert

• network-performance: network-performance alert

• cloud cost: cost alert

Notes:

• Synthetic monitors are created through the Synthetics API. See the Synthetics API documentation for more information.

• Log monitors require an unscoped App Key.

Query Types

Metric Alert Query

Example: time_aggr(time_window):space_aggr:metric{tags} [by {key}] operator #

• time_aggr: avg, sum, max, min, change, or pct_change

• time_window: last_#m (with # between 1 and 10080 depending on the monitor type) or last_#h(with # between 1 and 168 depending on the monitor type) or last_1d, or last_1w

• space_aggr: avg, sum, min, or max

• tags: one or more tags (comma-separated), or *

• key: a 'key' in key:value tag syntax; defines a separate alert for each tag in the group (multi-alert)

• operator: <, <=, >, >=, ==, or !=

• #: an integer or decimal number used to set the threshold

If you are using the _change_ or _pct_change_ time aggregator, instead use change_aggr(time_aggr(time_window), timeshift):space_aggr:metric{tags} [by {key}] operator # with:

• change_aggr change, pct_change

• time_aggr avg, sum, max, min Learn more

• time_window last_#m (between 1 and 2880 depending on the monitor type), last_#h (between 1 and 48 depending on the monitor type), or last_#d (1 or 2)

• timeshift #m_ago (5, 10, 15, or 30), #h_ago (1, 2, or 4), or 1d_ago

Use this to create an outlier monitor using the following query: avg(last_30m):outliers(avg:system.cpu.user{role:es-events-data} by {host}, 'dbscan', 7) > 0

Service Check Query

Example: "check".over(tags).last(count).by(group).count_by_status()

• check name of the check, for example datadog.agent.up

• tags one or more quoted tags (comma-separated), or "*". for example: .over("env:prod", "role:db"); over cannot be blank.

• count must be at greater than or equal to your max threshold (defined in the options). It is limited to 100. For example, if you've specified to notify on 1 critical, 3 ok, and 2 warn statuses, count should be at least 3.

• group must be specified for check monitors. Per-check grouping is already explicitly known for some service checks. For example, Postgres integration monitors are tagged by db, host, and port, and Network monitors by host, instance, and url. See Service Checks documentation for more information.

Event Alert Query

Note: The Event Alert Query has been replaced by the Event V2 Alert Query. For more information, see the Event Migration guide.

Event V2 Alert Query

Example: events(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• rollup_method The stats roll-up method - supports count, avg and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

Process Alert Query

Example: processes(search).over(tags).rollup('count').last(timeframe) operator #

• search free text search string for querying processes. Matching processes match results on the Live Processes page.

• tags one or more tags (comma-separated)

• timeframe the timeframe to roll up the counts. Examples: 10m, 4h. Supported timeframes: s, m, h and d

• operator <, <=, >, >=, ==, or !=

• # an integer or decimal number used to set the threshold

Logs Alert Query

Example: logs(query).index(index_name).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• index_name For multi-index organizations, the log index in which the request is performed.

• rollup_method The stats roll-up method - supports count, avg and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

Composite Query

Example: 12345 && 67890, where 12345 and 67890 are the IDs of non-composite monitors

• name [required, default = dynamic, based on query]: The name of the alert.

• message [required, default = dynamic, based on query]: A message to include with notifications for this monitor. Email notifications can be sent to specific users by using the same '@username' notation as events.

• tags [optional, default = empty list]: A list of tags to associate with your monitor. When getting all monitor details via the API, use the monitor_tags argument to filter results by these tags. It is only available via the API and isn't visible or editable in the Datadog UI.

SLO Alert Query

Example: error_budget("slo_id").over("time_window") operator #

• slo_id: The alphanumeric SLO ID of the SLO you are configuring the alert for.

• time_window: The time window of the SLO target you wish to alert on. Valid options: 7d, 30d, 90d.

• operator: >= or >

Audit Alert Query

Example: audits(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• rollup_method The stats roll-up method - supports count, avg and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

CI Pipelines Alert Query

Example: ci-pipelines(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• rollup_method The stats roll-up method - supports count, avg, and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

CI Tests Alert Query

Example: ci-tests(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• rollup_method The stats roll-up method - supports count, avg, and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

Error Tracking Alert Query

"New issue" example: error-tracking(query).source(issue_source).new().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator # "High impact issue" example: error-tracking(query).source(issue_source).impact().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator #

• query The search query - following the Log search syntax.

• issue_source The issue source - supports all, browser, mobile and backend and defaults to all if omitted.

• rollup_method The stats roll-up method - supports count, avg, and cardinality and defaults to count if omitted.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• group by Comma-separated list of attributes to group by - should contain at least issue.id.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

Database Monitoring Alert Query

Example: database-monitoring(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• rollup_method The stats roll-up method - supports count, avg, and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

Network Performance Alert Query

Example: network-performance(query).rollup(rollup_method[, measure]).last(time_window) operator #

• query The search query - following the Log search syntax.

• rollup_method The stats roll-up method - supports count, avg, and cardinality.

• measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.

• time_window #m (between 1 and 2880), #h (between 1 and 48).

• operator <, <=, >, >=, ==, or !=.

• # an integer or decimal number used to set the threshold.

Cost Alert Query

Example: formula(query).timeframe_type(time_window).function(parameter) operator #

• query The search query - following the Log search syntax.

• timeframe_type The timeframe type to evaluate the cost - for forecast supports current - for change, anomaly, threshold supports last

• time_window - supports daily roll-up e.g. 7d

• function - [optional, defaults to threshold monitor if omitted] supports change, anomaly, forecast

• parameter Specify the parameter of the type

  • for change:

    • supports relative, absolute

    • [optional] supports #, where # is an integer or decimal number used to set the threshold

  • for anomaly:

    • supports direction=both, direction=above, direction=below

    • [optional] supports threshold=#, where # is an integer or decimal number used to set the threshold

• operator

  • for threshold supports <, <=, >, >=, ==, or !=

  • for change supports >, <

  • for anomaly supports >=

  • for forecast supports >

• # an integer or decimal number used to set the threshold.

Creates a monitor notification rule.

Create a monitor configuration policy.

Create a monitor

Create a notebook using the specified options.

Create a new on-call escalation policy

Create a new on-call schedule

Only available for MSP customers. Removes a child organization from the hierarchy of the master organization and places the child organization on a 30-day trial.

Create a child organization.

This endpoint requires the multi-organization account feature and must be enabled by contacting support.

Once a new child organization is created, you can interact with it by using the org.public_id, api_key.key, and application_key.hash provided in the response.

Create a powerpack.

Create a new WAF custom rule with the given parameters.

Create a new WAF exclusion filter with the given parameters.

A request matched by an exclusion filter will be ignored by the Application Security WAF product. Go to https://app.datadoghq.com/security/appsec/passlist to review existing exclusion filters (also called passlist entries).

Create a new Workload Protection agent rule with the given parameters.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Create a new Workload Protection policy with the given parameters.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Updates the restriction policy associated with a resource.

Supported resources

Restriction policies can be applied to the following resources:

• Connections: connection

• Dashboards: dashboard

• Notebooks: notebook

• Security Rules: security-rule

• Service Level Objectives: slo

Supported relations for resources

Clone an existing role

Adds a permission to a role.

Create a new role for your organization.

Adds a user to a role.

Create a RUM retention filter for a RUM application. Returns RUM retention filter objects from the request body when the request is successful.

Create a new RUM application in your organization.

Create a metric based on your organization's RUM data. Returns the rum-based metric object from the request body when the request is successful.

Endpoint for uploading IdP metadata for SAML setup.

Use this endpoint to upload or replace IdP metadata for SAML login configuration.

Create a new agent rule with the given parameters.

Note: This endpoint should only be used for the Government (US1-FED) site.

Create a security filter.

See the security filter guide for more examples.

Create a new suppression rule.

Get the list of suppressions that would affect a rule.

Validate a suppression rule.

Create a detection rule.

Convert a rule that doesn't (yet) exist from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.

Test a rule.

Validate a detection rule.

Test an existing rule.

Create a new notification rule for security signals and return the created rule.

Create a new notification rule for security vulnerabilities and return the created rule.

Create a scanning group. The request MAY include a configuration relationship. A rules relationship can be omitted entirely, but if it is included it MUST be null or an empty array (rules cannot be created at the same time). The new group will be ordered last within the configuration.

Create a scanning rule in a sensitive data scanner group, ordered last. The posted rule MUST include a group relationship. It MUST include either a standard_pattern relationship or a regex attribute, but not both. If included_attributes is empty or missing, we will scan all attributes except excluded_attributes. If both are missing, we will scan the whole event.

Create an application key for this service account.

Create a service account for your organization.

Create or update service definition in the Datadog Service Catalog.

Delete (or partially delete) multiple service level objective objects.

This endpoint facilitates deletion of one or more thresholds for one or more service level objective objects. If all thresholds are deleted, the service level objective object is deleted as well.

Create an SLO Correction.

Create a service level objective object.

Create a new Synthetic private location.

Save new value for on-demand concurrency cap.

Create a Synthetic API test.

Create a Synthetic browser test.

Delete multiple Synthetic tests by ID.

Create a Synthetic mobile test.

Trigger a set of Synthetic tests for continuous integration.

Trigger a set of Synthetic tests.

Fetch uptime for multiple Synthetic tests by ID.

Create a Synthetic global variable.

This endpoint allows you to add new tags to a host, optionally specifying where these tags come from.

Add a new link to a team.

Add a user to a team.

Create a new team. User IDs passed through the users relationship field are added to the team.

Sends emails to one or more users inviting them to join the organization.

Create a user for your organization.

Execute the given workflow. This API requires a registered application key.

Create a new workflow, returning the workflow ID. This API requires a registered application key.

Unregister an App Key

Delete an existing Action Connection. This API requires a registered application key. Alternatively, you can configure these permissions in the UI.

Delete Agentless scan options for an AWS account.

Delete an API key.

Delete a specific span-based metric from your organization.

Delete a specific retention filter from your organization.

Delete a single app.

Unpublish an app, removing the live version of the app. Unpublishing creates a new instance of a deployment object on the app, with a nil app_version_id (00000000-0000-0000-0000-000000000000). The app can still be updated and published again in the future.

Delete multiple apps in a single request from a list of app IDs.

Delete an application key

Delete an AuthN Mapping specified by AuthN Mapping UUID.

Remove a project using the project's id.

Delete a single entity in Software Catalog.

Delete a single kind in Software Catalog.

Delete a custom framework.

Archive a Cloud Cost Management Account.

Archive a Cloud Cost Management Account.

Delete a budget.

Delete the specified Custom Costs file.

Archive a Cloud Cost Management account.

Delete an application key owned by current user

Delete a dashboard using the specified ID.

Delete a dashboard list.

Delete dashboards from an existing dashboard list.

Revoke the public URL for a dashboard (rendering it private) associated with the specified token.

Revoke previously sent invitation emails and active sessions used to access a given shared dashboard for specific email addresses.

Delete dashboards using the specified IDs. If there are any failures, no dashboards will be deleted (partial success is not allowed).

Delete a dashboard

Cancel a downtime.

Delete a Datadog-AWS integration matching the specified account_id and role_name parameters.

Delete an Amazon EventBridge source.

Delete a tag filtering entry.

Delete a Datadog-AWS logs configuration by removing the specific Lambda ARN associated with a given AWS account.

Delete a given Datadog-Azure integration from your Datadog account.

Delete an STS enabled GCP account from within Datadog.

Delete a tenant-based handle from the Datadog Microsoft Teams integration.

Delete a Workflows webhook handle from the Datadog Microsoft Teams integration.

Delete a single service object in the Datadog Opsgenie integration.

Delete a single service object in the Datadog-PagerDuty integration.

Delete a Cloudflare account.

Delete a Confluent account with the provided account ID.

Delete a Confluent resource with the provided resource id for the account associated with the provided account ID.

Delete a Fastly account.

Delete a Fastly service for an account.

Remove a channel from your Datadog-Slack integration.

Delete an Okta account.

Deletes the endpoint with the name <CUSTOM_VARIABLE_NAME>.

Deletes the endpoint with the name <WEBHOOK NAME>.

Delete a given archive from your organization.

Removes a role from an archive. (Roles API)

Delete a specific custom destination in your organization.

Delete an existing index from your organization. Index deletions are permanent and cannot be reverted. You cannot recreate an index with the same name as deleted ones.

Delete a specific log-based metric from your organization.

Delete a given pipeline from your organization. This endpoint takes no JSON arguments.

Delete all custom lists of queryable tag keys for a set of existing count, gauge, rate, and distribution metrics. Metrics are selected by passing a metric name prefix. Results can be sent to a set of account email addresses, just like the same operation in the Datadog web app. Can only be used with application keys of users with the Manage Tags for Metrics permission.

Deletes a metric's tag configuration. Can only be used with application keys from users with the Manage Tags for Metrics permission.

Delete the specified monitor

Deletes a monitor notification rule by rule_id.

Delete a monitor configuration policy.

Delete a monitor

Delete a notebook using the specified ID.

Delete an on-call escalation policy

Delete an on-call schedule

Delete a powerpack.

Delete a specific WAF custom rule.

Delete a specific WAF exclusion filter using its identifier.

Delete a specific Workload Protection agent rule.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Delete a specific Workload Protection policy.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Deletes the restriction policy associated with a specified resource.

Disables a role.

Removes a permission from a role.

Removes a user from a role.

Delete an existing RUM application in your organization.

Delete a RUM retention filter for a RUM application.

Delete a specific rum-based metric from your organization.

Delete a specific agent rule.

Note: This endpoint should only be used for the Government (US1-FED) site.

Delete a specific security filter.

Delete a specific suppression rule.

Delete an existing rule. Default rules cannot be deleted.

Delete a notification rule for security signals.

Delete a notification rule for security vulnerabilities.

Delete a given group.

Delete a given rule.

Delete an application key owned by this service account.

Delete a single service definition in the Datadog Service Catalog.

Permanently delete the specified service level objective object.

If an SLO is used in a dashboard, the DELETE /v1/slo/ endpoint returns a 409 conflict error because the SLO is referenced in a dashboard.

Permanently delete the specified SLO correction object.

Delete a Synthetic private location.

Delete a Synthetic global variable.

This endpoint allows you to remove all user-assigned tags for a single host.

Remove a team using the team's id.

Remove a link from a team.

Remove a user from a team.

Disable a user. Can only be used with an application key belonging to an administrator user.

Delete a workflow by ID. This API requires a registered application key.

Cancel downtime

Schedule downtime

List downtimes

Returns the estimated cardinality for a metric with a given tag, percentile and number of aggregations configuration using Metrics without Limits&trade;.

List events

Post event

Get an existing App Key Registration

List App Key Registrations

Get an existing Action Connection. This API requires a registered application key.

Fetches the Agentless scan options for an activated account.

Fetches the scan options configured for AWS accounts.

Fetch the data of a specific on demand task.

Fetches the most recent 1000 AWS on demand tasks.

Get an API key.

List all API keys available for your account.

Get a specific span-based metric from your organization.

Get the list of configured span-based metrics with their definitions.

Get an APM retention filter.

Get the list of APM retention filters.

Get the full definition of an app.

List all apps, with optional filters and sorting. This endpoint is paginated. Only basic app information such as the app ID, name, and description is returned by this endpoint.

Get an application key for your org.

List all application keys available for your org

List endpoint returns events that match a Audit Logs search query. Results are paginated.

Use this endpoint to see your latest Audit Logs events.

Get an AuthN Mapping specified by the AuthN Mapping UUID.

List all AuthN Mappings in the org.

Get the details of case by case_id

Search cases.

Get the details of a project by project_id.

Get all projects.

Get a list of entities from Software Catalog.

Get a list of entity kinds from Software Catalog.

Get a list of entity relations from Software Catalog.

List endpoint returns CI Visibility pipeline events that match a search query. Results are paginated similarly to logs.

Use this endpoint to see your latest pipeline events.

List endpoint returns CI Visibility test events that match a search query. Results are paginated similarly to logs.

Use this endpoint to see your latest test events.

Get a custom framework.

List resource filters.

Get all Container Images for your organization.

Get all containers for your organization.

List the AWS CUR configs.

List the Azure configs.

Get a budget.

List budgets.

Get active billing dimensions for cost attribution. Cost data for a given month becomes available no later than the 19th of the following month.

Get monthly cost attribution by tag across multi-org and single root-org accounts. Cost Attribution data for a given month becomes available no later than the 19th of the following month. This API endpoint is paginated. To make sure you receive all records, check if the value of next_record_id is set in the response. If it is, make another request and pass next_record_id as a parameter. Pseudo code example:

response := GetMonthlyCostAttribution(start_month, end_month)
cursor := response.metadata.pagination.next_record_id
WHILE cursor != null BEGIN
  sleep(5 seconds)  # Avoid running into rate limit
  response := GetMonthlyCostAttribution(start_month, end_month, next_record_id=cursor)
  cursor := response.metadata.pagination.next_record_id
END

This endpoint is only accessible for parent-level organizations. This endpoint is not available in the Government (US1-FED) site.

Fetch the specified Custom Costs file.

List the Custom Costs files.

List the GCP Usage Cost configs.

Get the list of all CSM Agents running on your hosts and containers.

Get the CSM Coverage Analysis of your Cloud Accounts. This is calculated based on the number of your Cloud Accounts that are scanned for security issues.

Get the CSM Coverage Analysis of your Hosts and Containers. This is calculated based on the number of agents running on your Hosts and Containers with CSM feature(s) enabled.

Get the CSM Coverage Analysis of your Serverless Resources. This is calculated based on the number of agents running on your Serverless Resources with CSM feature(s) enabled.

Get the list of all CSM Serverless Agents running on your hosts and containers.

Get an application key owned by current user

List all application keys available for current user

Get a dashboard using the specified ID.

Get dashboard by ID

Fetch an existing dashboard list's definition.

Fetch the dashboard list’s dashboard definitions.

Fetch all of your existing dashboard list definitions.

Fetch an existing shared dashboard's sharing metadata associated with the specified token.

Describe the invitations that exist for the given shared dashboard (paginated).

Get all dashboards.

Note: This query will only return custom created or cloned dashboards. This query will not return preset dashboards.

Get the domain allowlist for an organization.

Use this API endpoint to get a deployment event.

Use this API endpoint to get a failure event.

Get downtime detail by downtime_id.

Get all scheduled downtimes.

Retrieve the full details for a specific error tracking issue, including attributes and relationships.

Get the details of an event by event_id.

List endpoint returns events that match an events search query. Results are paginated similarly to logs.

Use this endpoint to see your latest events.

Get the HTML fragment for a previously generated embed with embed_id.

Enable a specified embed.

Revoke a specified embed.

Gets a list of previously created embeddable graphs.

Take graph snapshots. Note: When a snapshot is created, there is some delay before it is available.

This endpoint allows searching for hosts by name, alias, or tag. Hosts live within the past 3 hours are included by default. Retention is 7 days. Results are paginated with a max of 1000 results at a time.

This endpoint returns the total number of active and up hosts in your Datadog account. Active means the host has reported in the past hour, and up means it has reported in the past two hours.

List all Datadog-AWS integrations available in your Datadog organization.

List all namespace rules for a given Datadog-AWS integration. This endpoint takes no arguments.

Get all Amazon EventBridge sources.

Get all AWS tag filters.

Get all AWS IAM permissions required for the AWS integration.

List all Datadog-AWS Logs integrations configured in your Datadog account.

Get the list of current AWS services that Datadog offers automatic log collection. Use returned service IDs with the services parameter for the Enable an AWS service log collection API endpoint.

List all Datadog-Azure integrations configured in your Datadog account.

List all GCP STS-enabled service accounts configured in your Datadog account.

List your Datadog-GCP STS delegate account configured in your Datadog account.

Get the tenant, team, and channel ID of a channel in the Datadog Microsoft Teams integration.

Get the tenant, team, and channel information of a tenant-based handle from the Datadog Microsoft Teams integration.

Get a list of all tenant-based handles from the Datadog Microsoft Teams integration.

Get the name of a Workflows webhook handle from the Datadog Microsoft Teams integration.

Get a list of all Workflows webhook handles from the Datadog Microsoft Teams integration.

Get a single service from the Datadog Opsgenie integration.

Get a list of all services from the Datadog Opsgenie integration.

Get service name in the Datadog-PagerDuty integration.

Get a Cloudflare account.

List Cloudflare accounts.

Get the Confluent account with the provided account ID.

Get a Confluent resource with the provided resource id for the account associated with the provided account ID.

Get a Confluent resource for the account associated with the provided ID.

List Confluent accounts.

Get a Fastly account.

List Fastly accounts.

List Fastly services for an account.

Get a Fastly service for an account.

Get a list of all channels configured for your Datadog-Slack integration.

Get a channel configured for your Datadog-Slack integration.

Get an Okta account.

List Okta accounts.

Shows the content of the custom variable with the name <CUSTOM_VARIABLE_NAME>.

If the custom variable is secret, the value does not return in the response payload.

Gets the content of the webhook with the name <WEBHOOK_NAME>.

Returns the IP allowlist and its enabled or disabled state.

Get a specific archive from your organization.

Get the current order of your archives. This endpoint takes no JSON arguments.

Returns all read roles a given archive is restricted to.

Get the list of configured logs archives with their definitions.

Get a specific custom destination in your organization.

Get the list of configured custom destinations in your organization with their definitions.

Get one log index from your organization. This endpoint takes no JSON arguments.

The Index object describes the configuration of a log index. This endpoint returns an array of the LogIndex objects of your organization.

Get the current order of your log indexes. This endpoint takes no JSON arguments.

Get a specific log-based metric from your organization.

Get the list of configured log-based metrics with their definitions.

Get a specific pipeline from your organization. This endpoint takes no JSON arguments.

Get the current order of your pipelines. This endpoint takes no JSON arguments.

Get all pipelines from your organization. This endpoint takes no JSON arguments.

List endpoint returns logs that match a log search query. Results are paginated.

Use this endpoint to see your latest logs.

If you are considering archiving logs for your organization, consider use of the Datadog archive capabilities instead of the log list API. See Datadog Logs Archive documentation.

Get metadata about a specific metric.

List tags and aggregations that are actively queried on dashboards, notebooks, monitors, the Metrics Explorer, and using the API for a given metric name.

View indexed tag key-value pairs for a given metric name over the previous hour.

Returns dashboards, monitors, notebooks, and SLOs that a metric is stored in, if any. Updated every 24 hours.

Get the list of actively reporting metrics from a given time until now.

Returns all metrics that can be configured in the Metrics Summary page or with Metrics without Limits™ (matching additional filters if specified). Optionally, paginate by using the page[cursor] and/or page[size] query parameters. To fetch the first page, pass in a query parameter with either a valid page[size] or an empty cursor like page[cursor]=. To fetch the next page, pass in the next_cursor value from the response as the new page[cursor] value. Once the meta.pagination.next_cursor value is null, all pages have been retrieved.

Returns the cardinality details of tags for a specific metric.

Returns the tag configuration for the given metric name.

View distinct metrics volumes for the given metric name.

Custom metrics generated in-app from other products will return null for ingested volumes.

Get details about the specified monitor from your organization.

Get a monitor by ID

Get all active downtimes for the specified monitor.

Returns a monitor notification rule by rule_id.

Returns a list of all monitor notification rules.

Get all monitor configuration policies.

Get a monitor configuration policy by policy_id.

Get all monitors from your organization.

Get the device details.

Get the list of devices.

Get the list of interfaces of the device.

Get the list of tags for a device.

Get a notebook using the specified notebook ID.

Get all notebooks. This can also be used to search for notebooks with a particular query in the notebook name or author handle.

Get an on-call escalation policy

Get an on-call schedule

Retrieves the user who is on-call for the specified schedule at a given time.

Get a team's on-call users at a given time

Get a team's on-call routing rules

Get organization information.

Return the name, description, and value of a specific Org Config.

Returns all Org Configs (name, description, and value).

This endpoint returns data on your top-level organization.

Returns a list of all permissions, including name, description, and ID.

Get a powerpack.

Get a list of all powerpacks.

Get all processes for your organization.

Retrieve a WAF custom rule by ID.

Retrieve a list of WAF custom rule.

Retrieve a specific WAF exclusion filter using its identifier.

Retrieve a list of WAF exclusion filters.

Get the details of a specific Workload Protection agent rule.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Get the list of Workload Protection agent rules.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Get the list of Workload Protection policies.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Get the details of a specific Workload Protection policy.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

The download endpoint generates a Workload Protection policy file from your currently active Workload Protection agent rules, and downloads them as a .policy file. This file can then be deployed to your agents to update the policy running in your environment.

Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Get information about Datadog IP ranges.

Retrieves the restriction policy associated with a specified resource.

Get a role in the organization specified by the role’s role_id.

Returns a list of all permissions for a single role.

Returns all roles, including their names and their unique identifiers.

Gets all users of a role.

Get the RUM application with given ID in your organization.

Get the list of RUM retention filters for a RUM application.

Get a RUM retention filter for a RUM application.

List all the RUM applications in your organization.

Get a specific rum-based metric from your organization.

Get the list of configured rum-based metrics with their definitions.

List endpoint returns events that match a RUM search query. Results are paginated.

Use this endpoint to see your latest RUM events.

The download endpoint generates a Workload Protection policy file from your currently active Workload Protection agent rules, and downloads them as a .policy file. This file can then be deployed to your agents to update the policy running in your environment.

Note: This endpoint should only be used for the Government (US1-FED) site.

Get the details of a specific agent rule.

Note: This endpoint should only be used for the Government (US1-FED) site.

Get the list of agent rules.

Note: This endpoint should only be used for the Government (US1-FED) site.

Get the details of a specific security filter.

See the security filter guide for more examples.

Get the list of configured security filters with their definitions.

Get the details of a specific suppression rule.

Get the list of all suppression rules.

Get the list of suppressions that affect a specific existing rule by its ID.

Get a rule's details.

Convert an existing rule from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.

List rules.

Get a signal's details.

The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.

Get the details of a notification rule for security signals.

Returns the list of notification rules for security signals.

Get the details of a notification rule for security vulnerabilities.

Returns the list of notification rules for security vulnerabilities.

List all the Scanning groups in your organization.

Returns all standard patterns.

Get an application key owned by this service account.

List all application keys available for this service account.

Get a single service definition from the Datadog Service Catalog.

Get a list of all service definitions from the Datadog Service Catalog.

Get a service level objective object.

Get an SLO correction.

Get all Service Level Objective corrections.

Get corrections applied to an SLO

Get a specific SLO’s history, regardless of its SLO type.

The detailed history data is structured according to the source data type. For example, metric data is included for event SLOs that use the metric source, and monitor SLO types include the monitor transition history.

Note: There are different response formats for event based and time based SLOs. Examples of both are shown.

Get a list of service level objective objects for your organization.

List endpoint returns spans that match a span search query. Results are paginated.

Use this endpoint to see your latest spans. This endpoint is rate limited to 300 requests per hour.

Get a batch's updated details.

Get the list of public and private locations available for Synthetic tests. No arguments required.

Get a Synthetic private location.

Get the default locations settings.

Get the on-demand concurrency cap.

Get a specific full result from a given Synthetic API test.

Get the last 150 test results summaries for a given Synthetic API test.

Get the list of all Synthetic tests.

Get the detailed configuration (including steps) associated with a Synthetic browser test.

Get a specific full result from a given Synthetic browser test.

Get the last 150 test results summaries for a given Synthetic browser test.

Get the detailed configuration associated with a Synthetic Mobile test.

Get the detailed configuration associated with a Synthetic API test.

Get the detailed configuration associated with a Synthetic test.

Get the detailed configuration of a global variable.

Get the list of all Synthetic global variables.

Return the list of tags that apply to a given host.

Return a mapping of tags to hosts for your whole infrastructure.

Get a single team using the team's id.

Get all links for a given team.

Get a single link for a team.

Get a paginated list of members for a team

Get all permission settings for a given team.

Get all teams. Can be used to search for teams using the filter[keyword] and filter[me] query parameters.

Get billable usage across your account.

This endpoint is only accessible for parent-level organizations.

Get a mapping of billing dimensions to the corresponding keys for the supported usage metering public API endpoints. Mapping data is updated on a monthly cadence.

This endpoint is only accessible to parent-level organizations.

Get estimated cost across multi-org and single root-org accounts. Estimated cost data is only available for the current month and previous month and is delayed by up to 72 hours from when it was incurred. To access historical costs prior to this, use the /historical_cost endpoint.

This endpoint is only accessible for parent-level organizations.

Get historical cost across multi-org and single root-org accounts. Cost data for a given month becomes available no later than the 16th of the following month.

This endpoint is only accessible for parent-level organizations.

Get hourly usage attribution. Multi-region data is available starting March 1, 2023.

This API endpoint is paginated. To make sure you receive all records, check if the value of next_record_id is set in the response. If it is, make another request and pass next_record_id as a parameter. Pseudo code example:

response := GetHourlyUsageAttribution(start_month)
cursor := response.metadata.pagination.next_record_id
WHILE cursor != null BEGIN
  sleep(5 seconds)  # Avoid running into rate limit
  response := GetHourlyUsageAttribution(start_month, next_record_id=cursor)
  cursor := response.metadata.pagination.next_record_id
END

Get hourly usage by product family.

Get hourly usage for logs by index.

Get monthly usage attribution. Multi-region data is available starting March 1, 2023.

This API endpoint is paginated. To make sure you receive all records, check if the value of next_record_id is set in the response. If it is, make another request and pass next_record_id as a parameter. Pseudo code example:

response := GetMonthlyUsageAttribution(start_month)
cursor := response.metadata.pagination.next_record_id
WHILE cursor != null BEGIN
  sleep(5 seconds)  # Avoid running into rate limit
  response := GetMonthlyUsageAttribution(start_month, next_record_id=cursor)
  cursor := response.metadata.pagination.next_record_id
END

Get projected cost across multi-org and single root-org accounts. Projected cost data is only available for the current month and becomes available around the 12th of the month.

This endpoint is only accessible for parent-level organizations.

Get all usage across your account.

This endpoint is only accessible for parent-level organizations.

Get all custom metrics by hourly average. Use the month parameter to get a month-to-date data resolution or use the day parameter to get a daily resolution. One of the two is required, and only one of the two is allowed.

Get a user in the organization specified by the user’s user_id.

Returns a single user invitation by its UUID.

Get a list of memberships for a user

Get a user organization. Returns the user information and all organizations joined by this user.

Get a user permission set. Returns a list of the user’s permissions granted by the associated user's roles.

Get the list of all users in the organization. This list includes all users even if they are deactivated or unverified.

Get a workflow by ID. This API requires a registered application key.

List all instances of a given workflow. This API requires a registered application key.

Get a specific execution of a given workflow. This API requires a registered application key.

Create incident

Get incident by ID

List incidents

Update incident

List dashboards with optional name/tags filters

List monitors (common filters supported)

Aggregate logs analytics

Search logs (events)

Send logs to intake

Metrics: query scalars

Metrics: query timeseries

Submit metrics (v2 series)

Mute a host. Note: This creates a Downtime V2 for the host.

Mute the specified monitor.

Mute a monitor

Create a notebook

Delete a notebook

Get a notebook by ID

List notebooks

Update a notebook

Query timeseries points.

Query scalar values (as seen on Query Value, Table, and Toplist widgets). Multiple data sources are supported with the ability to process the data using formulas and functions.

Query timeseries data across various data sources and process the data by applying formulas and functions.

Get role by ID

List roles

List endpoint returns Audit Logs events that match an Audit search query. Results are paginated.

Use this endpoint to build complex Audit Logs events filtering and search.

List endpoint returns CI Visibility pipeline events that match a search query. Results are paginated similarly to logs.

Use this endpoint to build complex events filtering and search.

List endpoint returns CI Visibility test events that match a search query. Results are paginated similarly to logs.

Use this endpoint to build complex events filtering and search.

Search issues endpoint allows you to programmatically search for issues within your organization. This endpoint returns a list of issues that match a given search query, following the event search syntax. The search results are limited to a maximum of 100 issues per request.

List endpoint returns events that match an events search query. Results are paginated similarly to logs.

Use this endpoint to build complex events filtering and search.

List endpoint returns logs that match a log search query. Results are paginated.

Use this endpoint to build complex logs filtering and search.

If you are considering archiving logs for your organization, consider use of the Datadog archive capabilities instead of the log list API. See Datadog Logs Archive documentation.

Search and filter your monitor groups details.

Search and filter your monitors details.

Search for metrics from the last 24 hours in Datadog.

List endpoint returns RUM events that match a RUM search query. Results are paginated.

Use this endpoint to build complex RUM events filtering and search.

Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.

Get a list of service level objective objects for your organization.

List endpoint returns spans that match a span search query. Results are paginated.

Use this endpoint to build complex spans filtering and search. This endpoint is rate limited to 300 requests per hour.

Search for Synthetic tests and Test Suites.

Send your logs to your Datadog platform over HTTP. Limits per HTTP request are:

• Maximum content size per payload (uncompressed): 5MB

• Maximum size for a single log: 1MB

• Maximum array size if sending multiple logs in an array: 1000 entries

Any log exceeding 1MB is accepted and truncated by Datadog:

• For a single log request, the API truncates the log at 1MB and returns a 2xx.

• For a multi-logs request, the API processes all logs, truncates only logs larger than 1MB, and returns a 2xx.

Datadog recommends sending your logs compressed. Add the Content-Encoding: gzip header to the request when sending compressed logs. Log events can be submitted with a timestamp that is up to 18 hours in the past.

The status codes answered by the HTTP API are:

• 202: Accepted: the request has been accepted for processing

• 400: Bad request (likely an issue in the payload formatting)

• 401: Unauthorized (likely a missing API Key)

• 403: Permission issue (likely using an invalid API Key)

• 408: Request Timeout, request should be retried after some time

• 413: Payload too large (batch is above 5MB uncompressed)

• 429: Too Many Requests, request should be retried after some time

• 500: Internal Server Error, the server encountered an unexpected condition that prevented it from fulfilling the request, request should be retried after some time

• 503: Service Unavailable, the server is not ready to handle the request probably because it is overloaded, request should be retried after some time

Create SLO

Delete SLO

Get SLO by ID

List Service Level Objectives

Update SLO

The distribution points end-point allows you to post distribution data that can be graphed on Datadog’s dashboards.

The metrics end-point allows you to post time-series data that can be graphed on Datadog’s dashboards. The maximum payload size is 500 kilobytes (512000 bytes). Compressed payloads must have a decompressed size of less than 5 megabytes (5242880 bytes).

If you’re submitting metrics directly to the Datadog API without using DogStatsD, expect:

• 64 bits for the timestamp

• 64 bits for the value

• 20 bytes for the metric names

• 50 bytes for the timeseries

• The full payload is approximately 100 bytes.

Host name is one of the resources in the Resources field.

Create a Synthetics test

Delete a Synthetics test

Get a Synthetics test

List Synthetics tests