Datadog Toolkit

The Datadog toolkit connects a Datadog organization to agents and workflows using an API key and Application key and lets you list and search monitors, mute or unmute alerting, manage incidents, query metrics, search logs, inspect hosts, and read dashboards.

Prerequisites

• An active Datadog organization on a supported site: US1, US3, US5, EU1, or AP1.
• A Datadog API key and Application key — go to Organization Settings → API Keys and Organization Settings → Application Keys in Datadog.
• Datadog permissions appropriate for the actions you intend to use. Incident Management must be enabled on the account for incident actions.
• Prefer a dedicated service account and a scoped Application key over a personal administrator's keys.

경고

Both the API key and the Application key are required for every action. The Application key inherits the creating user's full Datadog permissions — scope it to the minimum required. Mute Monitor, Unmute Monitor, Create Incident, and Update Incident change live Datadog data immediately. Never expose keys in prompts, chat, tickets, screenshots, or documentation.

Setup

1. Create Datadog API and Application keys

   In Datadog, go to Organization Settings → API Keys and create or copy an API key. Then go to Organization Settings → Application Keys, create an Application key, and copy it immediately — Datadog may not show it again. Scope the Application key to the minimum permissions needed.

2. Open an agent or workflow

   Open an agent and add the Datadog toolkit under Toolkits, or add a Datadog step to a workflow.

3. Create a saved connection

   In the Datadog step, choose + New under Select saved connection. Enter a Connection Name, the API Key, the Application Key, and the Datadog Site that matches your organization (US1 is the default). Save the connection.

4. Enable only the tools you need

   Start with read-only actions. Enable Mute Monitor, Create Incident, and Update Incident only for approved workflows.

5. Test the connection

   Run Validate API Key first to confirm the API key is accepted. Then run List Monitors as a fuller smoke test — this also validates the Application key and site.

Available tools

Authentication

Tool	Description
Validate API Key	Checks that the API key is accepted. Does not validate the Application key. Run this first after connecting.

Monitors

Tool	Description
List Monitors	Lists monitors with optional query, page, and page size filters.
Get Monitor	Returns one monitor by ID including thresholds, options, and creator.
Search Monitors	Searches monitors by Datadog monitor search syntax.
Mute Monitor	Mutes a monitor to stop alerts. Write action — changes live data immediately.
Unmute Monitor	Clears a mute to restore alerting. Write action — changes live data immediately.

Incidents

Tool	Description
List Incidents	Lists incidents with page size and offset. Requires Datadog Incident Management.
Get Incident	Returns one incident including summary, root cause, and detection method.
Create Incident	Creates an incident with a title, severity, and optional customer-impacted flag. Write action.
Update Incident	Updates an incident's title, severity, or status. Write action.
Search Incidents	Searches incidents using Datadog incident query syntax (e.g. status:active).

Metrics

Tool	Description
List Metrics	Lists metric names active in a lookback window. Returns up to 50 names.
Query Metrics	Queries a Datadog metric expression over a time window and returns series data.
Get Metric Summary	Returns type, unit, and description for a specific metric name.

Hosts

Tool	Description
List Hosts	Lists hosts reporting to Datadog with optional tag and status filters.
Get Host	Returns details for a single host including tags, apps, and mute state.

Logs

Tool	Description
Search Logs	Searches log events using Datadog log query syntax (e.g. service:my-app status:error).

Dashboards

Tool	Description
List Dashboards	Lists dashboards with offset pagination.
Get Dashboard	Returns a dashboard including widget layout and titles.

Use cases

• Summarize monitors in Alert or Warn state before a standup or incident review.
• Query CPU or latency metrics over the last hour and return the result to a workflow step.
• Search recent error logs for a service and surface the top messages in chat.
• Open a Datadog incident from an approved workflow when a threshold is breached.
• Mute a noisy monitor during an approved maintenance window and unmute it afterward.

Troubleshooting

Symptom	Likely cause	Fix
No API key or Application key available	The connection is missing one or both keys.	Select a saved connection or provide both API Key, Application Key, and Datadog Site on the step.
401 Unauthorized or 403 Forbidden	Keys are incomplete, revoked, or the wrong site was selected.	Confirm both keys are complete and match the Datadog site. Wait a few seconds after creating new keys before retrying.
Validate API Key succeeds but other actions fail	Validate API Key only checks the API key, not the Application key or permissions.	Replace or re-scope the Application key and confirm it has the required permissions for the failing action.
Incident actions return 404 or permission error	Datadog Incident Management is not enabled on the account, or the Application key lacks incident access.	Confirm Incident Management is available on the Datadog account and the Application key has incident permissions.
List Monitors returns an empty list	The Application key cannot see any monitors, or the wrong site is selected.	Confirm the site matches the Datadog login and the Application key has monitor read permission.
429 Too Many Requests	The Datadog rate limit for the endpoint was exceeded.	Wait for the rate-limit window to reset. Avoid polling loops.
Wrong site — actions fail or return data from the wrong org	The Datadog Site in the connection does not match the login host.	Update the connection to match the correct site (US1, US3, US5, EU1, or AP1).