Datadog

Group cases into buckets by status, priority, assignee, project or any case attribute and get counts per bucket. This is the read that answers 'where is the backlog' in one call rather than by enumerating every case.

Group CI pipeline events into buckets and compute counts or durations per bucket — failure rate by branch, p95 build time by repository. REQUIRES CI VISIBILITY.

Group CI test executions into buckets — failure count by suite, duration percentiles by service. REQUIRES TEST OPTIMIZATION.

Count and group log events instead of retrieving them — 'how many 5xx by service in the last hour' in one call. This is the correct primitive for most counting questions, and it returns bucket counts rather than log bodies, so with no group_by it exposes strictly LESS personal data than Search logs. It shares Datadog's organization-wide log-search rate budget, which is exactly why one aggregate beats N pages of raw search.

Group RUM events into buckets and compute counts or percentiles per bucket — error rate by browser, p95 load time by country, sessions by release. LOWER exposure than searching RUM events for counting questions, because it returns bucket totals rather than session bodies; a group_by on a user-identifying facet still returns that facet's values.

Aggregate RUM long tasks — the main-thread blocks that make a page feel frozen — by page, component or release. PREVIEW endpoint.

Aggregate the problems RUM detected in user sessions — rage clicks, dead clicks, error clusters — grouped for triage. PREVIEW endpoint.

Aggregate the resource-loading waterfall across RUM views: which requests dominate page load, across sessions rather than in one. PREVIEW endpoint.

Count, bucket and compute over APM spans instead of retrieving them — 'p99 duration by resource for checkout-api in the last hour'. The cheap way to ask a trace-level question. Requires the APM module.

Diagnostic read: for a list of monitor ids, report which cannot be deleted and which SLOs or composite monitors depend on them. Agentic Fabriq exposes no monitor delete at all — this is useful as a dependency map: it names what would break if a human deleted the monitor.

Diagnostic read: for a list of SLO ids, report which cannot be deleted and what depends on them. Agentic Fabriq exposes no SLO delete — this is a dependency map.

Convert one existing security detection rule to its JSON representation. Read-scoped and creates nothing — the drafting workflow for a rule change, handed to a human to apply, exactly as Validate a monitor definition is for monitors. REQUIRES CLOUD SIEM or CSM.

Count the cases matching a query without paging through them. The cheap form of Search cases when the question is 'how many' rather than 'which' — one call instead of a full scan.

Declare a Datadog incident with a title and a severity. NOT A SILENT DATA WRITE: depending on this organization's incident settings, declaring an incident can create a Slack channel, page a rotation and open a ticket, and Agentic Fabriq cannot read those settings first because they sit behind a different permission. Agentic Fabriq sends title, severity and customer-impact only — no notification handles, no responders, no timestamps — so every notification that results is the organization's own configured behaviour rather than something the caller aimed. PREVIEW endpoint. REQUIRES INCIDENT MANAGEMENT; creating needs no paid seat, but modifying does. Requires confirm="may-page-on-call" — that exact string, not true. Not because anything is destroyed, but because the call can wake people up and no later call takes that back.

Attach a link to an incident — a postmortem document or a dashboard URL. The attachment is a link STORED on the incident; Datadog does not fetch it, so this is not an outbound request from a caller-chosen destination. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Record an impact on an incident — which service or customer segment was affected, and for how long. Additive and part of the incident record rather than a notification. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Add a task to an incident's task list, optionally assigned to a handle and with a due date. The narrow, additive write an on-call agent should have: it records what still needs doing without changing the incident's own record. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

DESTRUCTIVE — permanently delete an incident and its entire timeline. This destroys the record a postmortem is written from and the data MTTR is computed from, and there is no restore endpoint of any kind. Requires confirm="destroy-incident-timeline"; the connector refuses without that exact string and the refusal names what is lost. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

DESTRUCTIVE — remove an attachment from an incident. Requires confirm="delete-attachment-permanently". PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

DESTRUCTIVE — remove a recorded impact from an incident. Impacts are what a customer-facing postmortem is written from, so removing one narrows the stated blast radius. Requires confirm="narrow-recorded-impact". REQUIRES AN INCIDENT MANAGEMENT SEAT.

DESTRUCTIVE — permanently remove a task from an incident. There is no undo and no trash. Requires confirm="delete-task-permanently". PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Export a set of security detection rules in bulk, by id. Read-scoped — Datadog exposes it as a POST because the id list does not fit in a URL. Creates nothing. REQUIRES CLOUD SIEM or CSM.

Fetch uptime percentages for a set of Synthetics tests over a time window. The SLA read: 'was the checkout flow up last week', in one call, with no test configuration in the response.

Ask Datadog to generate a description for one cost tag key from its observed values. A GET that computes rather than stores — nothing is written until the separate upsert, which is not exposed.

Ask Datadog to draft a postmortem for one incident from its own timeline. A POST that reads: it returns a draft and writes nothing to the incident. Datadog gates it behind incident_write rather than incident_read, which is why it appears here. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Get one on-demand agentless AWS scan task in full — its target, its status and its completion time. REQUIRES CLOUD SECURITY MANAGEMENT.

Get one case in full — title, description, status, priority, assignee, project, custom attributes and its links to incidents and Jira issues. The detail read behind a Search cases hit.

Get one case automation rule in full — its trigger, its conditions and what it does. Read-only; Agentic Fabriq never creates, edits, enables or disables one.

Get one Case Management project in full, including its key and configuration.

Get one saved case view, including the query behind it, so the same filter can be reproduced through Search cases.

Read the account filters on one cloud account — which parts of that account's spend Datadog includes. Explains a cost figure that looks too low.

How much of current spend is covered by commitments, as a single number. PREVIEW endpoint.

Commitment coverage over time, as a series. The trend behind the scalar. PREVIEW endpoint.

Total savings realised from commitments, as a single number. PREVIEW endpoint.

Commitment savings over time, as a series. PREVIEW endpoint.

How much of the purchased commitment is actually being used, as a single number — the read that finds money already spent and wasted. PREVIEW endpoint.

Commitment utilization over time, as a series. PREVIEW endpoint.

The on-demand spend not covered by any commitment, broken down — where a new commitment would pay for itself. PREVIEW endpoint.

Get the description of one cost tag key.

Get one cost tag key with its values and metadata.

Read the currency cost figures are reported in. Small, and without it every number in this family is ambiguous. PREVIEW endpoint.

Get one custom compliance framework — the controls the organization defined and the rules mapped to each. The read behind a compliance posture number. REQUIRES CLOUD SECURITY MANAGEMENT.

Get one Datadog dashboard including every widget definition. The widget queries are the fastest way to learn which metrics a team actually watches, so this is often a better starting point than datadog_list_metrics.

Get one dashboard list's name and dashboard count.

Last-viewed and last-edited timestamps for one dashboard. PREVIEW endpoint.

Get one DORA deployment event in full — service, version, commit and timestamps.

Get one DORA failure event in full, including its start and resolution timestamps.

Get one downtime in full — its message, creator, scope, monitor_identifier, current status and schedule. The pre-flight for Unmute monitor: it answers 'is this a planned maintenance window, and did this agent create it?'.

Get one escalation policy: who is paged, in what order, and after how long. Requires the On-Call module.

Get one event in full — its title, text, tags, source and timestamps. The follow-up to a promising row in List events or Search events.

Read the organization's flaky-test management policies — when a test is auto-quarantined and when it is auto-unquarantined. A read that Datadog exposes as a POST; it creates nothing. REQUIRES TEST OPTIMIZATION.

Get one Datadog Agent's version, host, configuration state and installed integrations.

Get one Fleet Automation deployment's status and per-host outcome.

Get one Fleet Automation schedule in full.

Get the historical-metrics (backfill) configuration for one metric. PREVIEW endpoint.

Get one historical-detection signal in full. PREVIEW endpoint. Requires Cloud SIEM.

Total host counts — up, active and total. One number instead of paging the whole inventory.

Open one incident: its fields, customer impact, declared and resolved timestamps, commander and linked resources. List incidents can only say an incident exists. PREVIEW endpoint.

Get one custom incident field definition. PREVIEW endpoint.

Get one incident responder's role and assignment. PREVIEW endpoint.

Get one incident follow-up task in full. PREVIEW endpoint.

Get one incident type's definition — the template that decides which fields an incident of that type carries. PREVIEW endpoint.

Get one log archive's destination, query and rehydration state.

Get one log index in full, including its filter, retention and exclusion filters.

Get the order log indexes are evaluated in. Order decides which index a log lands in, and therefore its retention.

Get one log-based metric's filter, compute and group-by.

Get one log pipeline including every processor, in order.

Get the order log pipelines run in. Reordering alone can disable every downstream processor, which is why the write is excluded and this read matters.

Get one log restriction query. PREVIEW endpoint.

Read the order archives are evaluated in. A log line goes to the FIRST archive whose filter matches, so the order decides where it lands — this is the read that explains an archive nothing ever arrives in. Wave 1 recorded it as a plain oversight rather than a principled exclusion; this closes it. Costs no new scope: logs_read_config was already requested.

Get a metric's type, unit, description and per-unit — the information needed to read its values correctly. A gauge and a count with the same name mean different things.

Report per-tag cardinality for one metric — the number of distinct values behind each tag key. This is the read that tells you, before you group by something, whether that group-by is about to explode.

Get the tag configuration for one metric — which tags are kept for querying, and which aggregations are available on it.

List the tag indexing rule exemptions granted to one metric. PREVIEW endpoint.

Get one Datadog monitor's full definition — its query, thresholds, notification targets, tags and current state. Use datadog_list_monitors to find the id.

Get one monitor configuration policy in full.

Get one monitor notification rule in full, including its filter and its recipients.

Get one saved monitor template. PREVIEW endpoint — Datadog may change the response shape without notice.

Get one notebook including every cell. This is how an agent finds 'how did we fix this last time' in the organization's own words.

Get one on-call schedule's layers, rotations and restrictions. Requires the On-Call module.

Get one powerpack including its widget definitions and template variables.

Get a pruned form of one distributed trace — the critical path rather than every span, for traces too large to read whole. PREVIEW endpoint. Requires the APM module.

SECURITY AUDIT READ — given a public share token, return the sharing configuration behind it: which dashboard it exposes, its share type, and any global time or template-variable restrictions. Read-only counterpart to the share-creation endpoints, which Agentic Fabriq never exposes.

Read which cloud resources are excluded from posture evaluation. The counterpart of the security filters read, for CSM rather than logs: it is how a resource ends up with no findings because nobody is looking at it. REQUIRES CLOUD SECURITY MANAGEMENT.

Get the log restriction query applied to one role. PREVIEW endpoint.

Get the repository and commit a RUM service's uploaded source maps were built from. PREVIEW endpoint. The link from a browser error back to the line of source that produced it.

Get the source-map upload records matching a filter — service, version and upload time. PREVIEW endpoint. Read-only; the source-map DELETE carries rum_delete_data and is never requested.

Return the responders currently on call on one schedule, with their shift windows. Requires the On-Call module.

Get one security filter in full — its query, its exclusions and whether it is enabled.

Get one historical-detection job: whether the retroactive run of a detection rule finished, and what it produced. PREVIEW endpoint. REQUIRES CLOUD SIEM.

For one security signal, get the log queries Datadog suggests running to investigate it. Turns a signal into the next read, rather than into a guess. Datadog requires BOTH security_monitoring_rules_read AND security_monitoring_signals_read for this endpoint; Agentic Fabriq records the rules permission and requests both. REQUIRES CLOUD SIEM.

Get one security detection rule in full — its query, its thresholds, its severity mapping and its notification targets. REQUIRES CLOUD SIEM or CSM.

Read the version history of one security detection rule — every edit, when, and by whom. A security-AUDIT read: it is how you find out that a detection was narrowed. PREVIEW endpoint. REQUIRES CLOUD SIEM or CSM.

Get one security signal in full — the rule that fired, the matching events and the entities involved. Requires Cloud SIEM.

List the users, hosts and cloud resources one security signal implicates. PREVIEW endpoint. Requires Cloud SIEM.

For one security signal, get the remediation actions Datadog suggests. Read-only — it returns advice, and Agentic Fabriq exposes nothing that executes it. Requires BOTH the rules and the signals permission, as above. REQUIRES CLOUD SIEM.

Get one service's definition: its owning TEAM, contacts, on-call links, repositories, docs and tier. This is the routing primitive — it is what turns 'checkout-api is alerting' into 'page the payments team'.

Get one service level objective in full, including the query or monitor_ids it is computed from. List SLOs returns a page of names and statuses; without this an agent can report an SLO is unhealthy but cannot say what it measures.

List the corrections applied to one SLO — the windows deliberately excluded from its error budget, such as planned maintenance. An SLO number without its corrections is misleading.

Error-budget burn-down for one SLO: the series behind the number — how much budget is left, how fast it is being spent, and whether the current window will breach. This is the one SLO question an agent can actually add value to.

The v2 status read for one SLO. PREVIEW endpoint — Datadog may change the response shape without notice.

Get one span-based metric's definition, including its filter and group-by. Requires the APM module.

Get the status and per-test results of one Synthetics CI batch — the group of tests a pipeline triggered. Answers 'did the synthetic checks pass for this deploy' without reading any test's configuration. REQUIRES SYNTHETIC MONITORING, which Datadog bills per test run.

Get one Synthetics downtime in full — its window, scope and the tests it covers.

Get the result of one Synthetics fast test by id — the quick single-run check, with its outcome and timings.

The reverse lookup: which multistep Synthetics tests use this test as a subtest. Answers 'what else breaks if this step breaks'.

List the subtests of one multistep Synthetics API test — the steps a single test walks through. Returns step metadata; it does not return any step's request configuration, which is why it ships where the test-configuration reads do not.

Get one Synthetics NETWORK test — a TCP, ICMP, DNS or traceroute check. This one test type ships where every other test read does not: a network test has no HTTP request block, so its configuration carries no basicAuth, no client certificate and no headers.

Get one Synthetics test suite: its name, its tags and which tests belong to it.

List the suites one Synthetics test belongs to — the reverse lookup, for working out what else runs when this test runs.

Get the metadata of one version of a Synthetics test — its author, its timestamp and what changed at a summary level.

Get one metric tag indexing rule. PREVIEW endpoint.

Get one team's name, handle, description and links.

Get one parent/child team relationship.

Retrieves one link attached to a Datadog team -- its label and destination URL. Team links are the pointers a team hangs off its page (runbooks, dashboards, on-call rotas, chat channels), so this answers "where does this team say to look" for a given link id. Read-only.

Get one team notification rule.

Return who is currently on call for a team, and who is next. The single most useful On-Call read: it turns an alert into a name. Requires the On-Call module.

Get the rules that decide which escalation policy a team's pages follow. Requires the On-Call module.

Get the configuration that syncs Datadog teams from an external identity source.

Read the Test Optimization settings for one service — whether flaky management and test impact analysis are on. A read Datadog exposes as a POST; it creates nothing. REQUIRES TEST OPTIMIZATION.

Get one full distributed trace by id — every span in the request, in order. The deepest read Datadog offers for a single slow or failing request. PREVIEW endpoint. Requires the APM module.

Get one of a user's page-notification channels. Requires the On-Call module.

Get one of a user's page-notification rules. Requires the On-Call module.

List the tags and aggregations that have actually been queried on this metric recently, as opposed to the ones merely configured.

List metric names that have reported since a given timestamp, optionally narrowed by host or tag. Complements List metrics: this one answers 'is this metric still arriving', which is the first question when a graph goes flat.

List the on-demand agentless AWS scan tasks and their status — whether a requested vulnerability scan finished and what it found. Read-only: the task CREATE carries security_monitoring_findings_write, which is never requested. REQUIRES CLOUD SECURITY MANAGEMENT.

List Datadog audit events — every configuration change and every read of sensitive data, by user, in a time window. This is the read that answers 'who changed this monitor', and it is also the read that shows what Agentic Fabriq itself did. ADMIN PERMISSION: audit_logs_read is in Datadog's Audit Trail group and returns every action every user in the organization took, so granting it is a decision about the whole organization, not about one integration.

List the automation rules on a case project — the rules that assign, re-prioritise or close cases without a human. Read-only, and the read that explains why a case changed with nobody touching it.

List every custom attribute definition configured for cases across the organization — the names, types and allowed values a case's custom fields can carry.

List the links between cases — duplicates, blockers and parent relationships. Turns a single case into the cluster of work it belongs to.

Read the notification rules on a case project — who gets told when a case in this project changes. A configuration AUDIT read: Agentic Fabriq exposes no create, update or delete for these rules, because a notification rule is a standing rule that acts without the agent.

List Case Management projects — the containers cases live in, usually one per team or service. A project key is the argument several other case reads need.

Read one case's timeline: every status change, comment, assignment and attribute edit in order, with who made it. The audit trail of what a team already tried before the agent was asked.

List the custom attribute definitions attached to ONE case type. Narrower than the organization-wide list, and the one that explains why a particular case has the fields it has.

List the organization's case types. A case type decides which fields and workflow a case gets, so this is what makes a case id interpretable.

List the saved case views the organization has defined — the filters teams actually use, which is a better starting query than one an agent invents.

List the users watching one case — who is already following this piece of work. Read-only: Agentic Fabriq exposes no watch or unwatch, because subscribing a colleague to notifications acts on a person.

List Software Catalog entities — services, datastores, queues and systems — with their owners, relations and schemas. The successor to the service-definition reads: a service definition describes one service, an entity describes the whole estate and how it fits together. SCOPE NOTE: Datadog's OpenAPI documents declare no permission for this endpoint at all. Agentic Fabriq requests it under apm_service_catalog_read, the documented Software Catalog read permission, which is already requested — so this costs no additional grant. That attribution is inference from the product, not a declaration in Datadog's contract, and it is unverified against a live account.

List the Software Catalog entity KINDS defined in this organization — service, datastore, queue, system and any custom kind. The vocabulary the entity list is filtered by. Same scope caveat as List catalog entities.

List the relations between Software Catalog entities — what depends on what, and who owns what. This is the dependency graph an agent needs to answer 'if this datastore is down, which services are affected and which team do I tell'. Same scope caveat as List catalog entities.

List CI pipeline events — every build and deploy job, with its status, duration, branch and commit. Next to List events this is the 'did the deploy break it' read: the pipeline that ran immediately before an alert, by name and commit. REQUIRES CI VISIBILITY.

List CI test events — individual test executions with pass/fail, duration and the commit they ran against. The read behind 'which test started failing, and on what change'. REQUIRES TEST OPTIMIZATION.

List the AWS Cost and Usage Report configurations Datadog ingests billing data from — which account, which bucket, and whether the ingest is healthy. The first read when cloud cost data is missing or stale. Read-only: every Cloud Cost WRITE carries cloud_cost_management_write, which is never requested, because it rewires which billing account Datadog reads.

List the Azure usage-cost configurations Datadog ingests billing data from, and their status.

List the organization's cloud commitments — reserved instances and savings plans, with their terms. PREVIEW endpoint.

List the Google Cloud usage-cost configurations Datadog ingests billing data from, and their status.

List the Oracle Cloud cost configurations Datadog ingests billing data from, and their status.

List the human descriptions attached to cost tag keys — what 'team' actually means in this organization's tagging scheme.

List where each cost tag key comes from — the cloud provider, Datadog's own enrichment, or a custom rule. PREVIEW endpoint.

List the cost tag KEYS — the dimensions spend can be broken down by (team, service, environment).

List the metadata Datadog holds about cost tags — coverage, sources and freshness. PREVIEW endpoint.

List the cost metrics available for tag-based queries. PREVIEW endpoint.

List the months for which cost data exists. The bounds check before asking for a window that has no data. PREVIEW endpoint.

List the container orchestrators Datadog attributes cost through — which Kubernetes clusters are in the cost model. PREVIEW endpoint.

List the cost-allocation tags available for grouping cloud spend. The vocabulary every other cost query is written in.

List the custom-cost files uploaded to Datadog — third-party spend the customer added by hand. Read-only; the upload is a write and is not exposed.

List the dashboards inside one dashboard list, with their ids and types. The id source for Get dashboard when you are working within a team's folder.

List the organization's dashboard lists — the folders teams group dashboards into. The fastest way to find 'the SRE team's dashboards' rather than all 400 of them.

SECURITY AUDIT READ — answer 'is this dashboard exposed through a public, embed or invite share link?' for one dashboard. This is the audit counterpart to the share-creation operations, all of which are permanently excluded. PREVIEW endpoint.

List when each dashboard was last viewed and last edited. Finds the dashboards nobody looks at, and the ones that are load-bearing. PREVIEW endpoint.

List the Datadog dashboards this connection can see, with each dashboard's id, title, URL and author. Dashboard ids are not guessable, so this is the entry point for datadog_get_dashboard.

List DORA deployment events in a window — what shipped, when, to which service. Read-only. Agentic Fabriq exposes no DORA SUBMIT: POST /api/v2/dora/deployment is one of the fourteen ingest operations Datadog gates with an API key and no permission at all, so an agent able to call it could invent the deployment history its own metrics are computed from.

List DORA failure events in a window — the incidents change-failure rate and MTTR are computed from. Read-only, for the same reason as the deployment list.

List every scheduled and active Datadog downtime in the organization, with each downtime's id, message, creator, scope, monitor and schedule. This is the missing half of Unmute monitor: a downtime id cannot be obtained any other way except from the mute call that created it, so without this an agent cancels a downtime blind. Call it before unmuting.

List events from the Datadog event stream — deploys, alert transitions and integration events. This is the correlation tool: 'what changed just before the alert' is almost always answered here rather than in the metrics.

List the case projects the connected user has favourited. A cheap proxy for 'the projects this account actually works in' when the organization has many.

List the Datadog Agent versions available and in use across the estate.

List the Datadog Agents installed across the estate with their versions and hosts. Answers 'is this host silent because the Agent is down or out of date'.

List Fleet Automation deployments — Agent upgrades and configuration rollouts — with their status. Read-only; starting one is not exposed.

List the Fleet Automation schedules that upgrade Agents automatically. Read-only.

List the signals one historical-detection job produced. PREVIEW endpoint. Requires Cloud SIEM.

List signals produced by historical (retro-scan) detections. PREVIEW endpoint. Requires Cloud SIEM.

Infrastructure inventory: every host reporting to Datadog, with its up/down state, whether it is MUTED, which apps and integrations report from it, its tags and its last-seen time. The natural companion to metrics and monitors for 'which hosts stopped reporting'.

List the postmortem documents and links attached to one incident — where 'how was this fixed last time' actually lives. PREVIEW endpoint.

List the organization's custom incident fields and their allowed values. Needed to read an incident's fields, which are otherwise opaque keys. PREVIEW endpoint.

List the declared customer impacts on one incident, with their windows and descriptions.

List one incident's integration links — its Slack channel, its ticketing records. Read-only; creating or rebinding them is not exposed. PREVIEW endpoint.

List who is responding to one incident and in what role. Read-only — ADDING a responder notifies a named human and is permanently excluded. PREVIEW endpoint.

READ the manual corrections applied to an incident's detection and resolution times — i.e. see whether the numbers MTTR reporting is computed from have been edited, and by whom. WRITING a timestamp override is permanently excluded: it lets an agent rewrite its own performance record. PREVIEW endpoint.

List the follow-up tasks recorded on one incident. PREVIEW endpoint.

List Datadog incidents newest first, with title, severity, state, commander and timestamps.

List the roles allowed to rehydrate from one log archive. Read-only; granting that access is permanently excluded.

List the organization's log archives — where logs are written for long-term storage, and the id source for List log archive readers. Read-only; every archive write is permanently excluded because it exports logs to a caller-named bucket.

List the organization's log indexes with their retention, daily limit and EXCLUSION FILTERS. This is the read that answers 'why is this log not searchable' — wrong index, or an exclusion filter dropped it.

List the log-based metrics configured in the organization. Read-only — creating one mints a billable custom metric per tag combination and is permanently excluded.

List the log processing pipelines. A pipeline rewrites logs AT INGEST, so a wrong grok rule silently mis-parses everything arriving after it — this read is how that gets diagnosed. Every pipeline WRITE is permanently excluded.

List the log restriction queries — the per-role limits on which logs a user may read. Explains why a log is invisible to one team and visible to another. PREVIEW endpoint.

List the roles a log restriction query applies to. PREVIEW endpoint.

The GET form of log search, for short queries and simple cursor paging. HIGH SENSITIVITY, identically to Search logs: the response is raw production log lines. Prefer Aggregate logs whenever the question is a count. A query is required.

List planned maintenance windows. Distinct from a monitor downtime: a maintenance window is the declared, scheduled change, and it is what tells an agent that an anomaly is expected rather than a regression.

List the tag indexing rules that apply to one metric. PREVIEW endpoint.

List the tag keys and values actually indexed for one metric. The most common reason a metric query returns nothing is a guessed tag key — writing by {service} where the metric is tagged by {svc}. List metrics returns names and never tag keys; this is the missing step between 'the metric exists' and 'the query returns points'.

List Datadog metric names that have reported recently, optionally narrowed by tag. Metric names are not guessable and datadog_query_metrics needs one, so this is the discovery step before any timeseries query. Returns a cursor in meta.pagination.next_cursor.

List the organization's monitor configuration policies — the rules that force tags or fields onto every monitor. Explains why a monitor definition was rejected.

List the downtimes that currently match one monitor — i.e. why this specific monitor is not paging. Narrower and cheaper than listing every downtime in the organization.

List the organization's monitor notification rules — the org-level routing that decides who a monitor actually notifies, which is often not what the monitor's own message says.

List the organization's saved monitor templates. PREVIEW endpoint — Datadog may change the response shape without notice.

List Datadog monitors with their id, name, type, query and current alert state (OK / Alert / Warn / No Data). Start here: a monitor id is an opaque integer and nothing else hands one over. Set with_downtimes=true to also get each monitor's active downtimes, which is where a downtime_id for datadog_unmute_monitor comes from.

List Datadog notebooks — where postmortems, investigation runbooks and incident write-ups live. Read-only; notebooks_write also covers deletion and is not requested.

List powerpacks — reusable widget groups a team drops into several dashboards. Useful context for 'what does this team actually watch'.

List the organization's Real User Monitoring applications with their ids, names and types. The application id is the argument every other RUM read needs. The single-application read is NOT exposed: its response carries the application's `client_token`, which is the credential a browser SDK ships telemetry with.

List RUM events — real browser and mobile sessions, views and errors from actual users — in a time window, with a query filter. This is what turns 'the API looks fine' into 'users are seeing it fail'. CONTAINS END-USER DATA: RUM events carry user ids, emails where the SDK was configured to send them, IP-derived geography and full URLs.

List the JavaScript source maps uploaded for RUM error unminifying, by service and version. PREVIEW endpoint. The read that explains why a stack trace is still minified.

Read the version history of the organization's security filters — every change to what reaches the security pipeline, with who made it. A security-audit read.

List security filters — which logs are routed into Cloud SIEM for analysis at all. THE read that explains a detection that never fired: if the logs never reached the security pipeline, no rule could match them. Read-only; the filter write is never requested.

List security findings — misconfigurations and posture violations across the cloud estate, with severity, resource and rule. The compliance surface an auditor asks about. Read-only: the finding WRITE mutes a finding, which removes it from the posture dashboard the customer's compliance evidence is drawn from, and is never requested. Datadog declares this endpoint as security_monitoring_findings_read OR appsec_vm_read; Agentic Fabriq requests the first. REQUIRES CLOUD SECURITY MANAGEMENT.

List the organization's security detection rules — what Cloud SIEM and CSM are actually looking for. The read that turns a signal into 'this fired because of rule X, which looks for Y'. Read-only: every rule WRITE carries security_monitoring_rules_write and is never requested, because editing a detection rule changes what is detected for everyone, silently and with no expiry. REQUIRES CLOUD SIEM or CSM.

List Cloud SIEM security signals in a time window, newest first. Requires Cloud SIEM.

List every service definition in the Software Catalog — the organization's service inventory. Datadog documents Software Catalog as available at no additional charge to Infrastructure Monitoring customers.

List every SLO correction in the organization, newest first.

List Datadog service level objectives with their thresholds, tags and type. Use this to answer 'are we within budget' questions before reaching for raw metrics.

List the span-based metrics configured in the organization. Read-only — CREATING one mints a billable custom metric per tag combination and is permanently excluded. Requires the APM module.

List the most recent run results for one Synthetics browser test, per location, with step outcomes and timings. Same shape and same exclusion as List Synthetics test results.

List Synthetics downtimes — the windows in which synthetic tests are paused and will not alert. The Synthetics counterpart of List downtimes, and the read that explains a silent synthetic check.

List every Synthetics run location available to this organization, public and private, with its id and display name. Turns a location id in a result into a place. Read-only — the private-location DETAIL read is excluded because its response carries the location's `secrets` block.

List the most recent run results for one Synthetics test — pass or fail, per location, with timings. The v2 result list, which returns run outcomes WITHOUT the test's request configuration; the per-result detail reads are deliberately not exposed because their `check.config` block carries the test's HTTP credentials.

List the version history of one Synthetics test — every change, when, and by whom. The read that answers 'did somebody edit this check just before it started failing'. Returns version METADATA only; the versioned configuration itself is not in the response, which is what keeps it outside the credential-bearing exclusion.

List the organization's metric tag indexing rules — the rules that decide which tags stay queryable. Explains a tag that exists on the metric but cannot be grouped by. PREVIEW endpoint.

List the connections between Datadog teams and external systems. Read-only; DELETING team connections carries the same teams_read permission and is permanently excluded.

List parent/child relationships between teams — the org chart Datadog routes through.

List one team's links — its runbooks, dashboards, Slack channels and wikis.

List the people in one team and their roles. The last hop from 'checkout-api is owned by the payments team' to a named human.

List where one team's notifications are routed. Read-only; creating, editing and deleting these rules — which Datadog also puts behind teams_read — are permanently excluded.

SECURITY AUDIT READ — report who may edit a team, manage its membership and change its links. The matching WRITE is permanently excluded even though Datadog gates it on the same 'read' permission.

List the organization's Datadog teams, with handles and member counts. Team handles are what monitor notifications and service definitions point at, so this is the other half of alert routing.

List the log restriction queries that apply to one user. PREVIEW endpoint.

List the channels one user can be paged on. Requires the On-Call module.

List how one user is notified when they are paged — the channels and delays. Read-only. The matching UPDATE, which Datadog also puts behind on_call_read, is permanently excluded: rewriting where a human's pages go silences them with no expiry and no visible record. Requires the On-Call module.

List every team one user belongs to. The reverse lookup: 'what is this person responsible for'.

DESTRUCTIVE — mute one Datadog monitor by scheduling a downtime, so it stops notifying. A muted monitor does not page anyone, so muting the wrong one is an outage nobody hears about. duration_minutes is required and capped at 1440 (24 hours): Datadog itself allows a downtime that never ends, and Agentic Fabriq does not. scope is required and may not be '*', which would silence the entire organization. Muting by tag is not available. Returns the downtime id — keep it, datadog_unmute_monitor needs it.

Run one Datadog metric query over a time range and return the data points, e.g. 'avg:system.cpu.user{env:prod} by {host}'. Both timestamps are UNIX seconds, NOT milliseconds and NOT ISO strings. Use datadog_list_metrics for metric names, or datadog_get_dashboard for queries a team already trusts.

Return ONE aggregated number per query over a time window — 'what is p99 checkout latency right now' — rather than a series of points. Agentic Fabriq accepts a metric query plus a named aggregator (avg, min, max, sum, last, percentile, area, l2norm) instead of raw formulas JSON, so a model cannot get the request shape wrong.

The v2 form of a timeseries query: several named queries in one call over a shared time window, with millisecond timestamps. Use Query metrics for a single simple query; use this when you need two or more series retrieved together so their points line up.

DESTRUCTIVE — change how long an existing downtime lasts, without cancelling and recreating it (which would un-mute the monitor in the gap). Extends or shortens. Agentic Fabriq recomputes the end time server-side from a required duration_minutes of at most 24 hours, exactly as Mute monitor does, and refuses any caller-supplied schedule, recurrence or monitor_tags — so this cannot be used to convert a bounded downtime into an open-ended one.

Search Datadog audit events with a structured query, sort and cursor paging — '@usr.id:… @evt.name:monitor.updated'. The POST form of List audit logs, with the same ADMIN exposure.

Search Case Management cases with Datadog's case query syntax and get matches plus paging. Cases are where ops work is tracked between an alert firing and an incident being declared, so this is usually the first read of a triage session: 'what is already open on this service, and did somebody pick it up'.

Search CI pipeline events with a structured query, sort and cursor paging. The POST form, for correlating a specific service, branch or commit against an incident window. REQUIRES CI VISIBILITY.

Search CI test executions with a structured query, sort and cursor paging. REQUIRES TEST OPTIMIZATION.

Search the event stream with a structured query (source:deploy service:web), sorting and cursor paging. List events takes a time window and little else, so correlation — 'what changed just before the alert' — otherwise means pulling the whole organization's event stream and filtering it in-context.

Search the flaky-test list: tests that pass and fail on the same commit. Read-only — the flaky-test UPDATE, which marks a test fixed or quarantines it, carries test_optimization_write and is never requested. REQUIRES TEST OPTIMIZATION.

Search signals produced by historical (retro-scan) detections. PREVIEW endpoint. Requires Cloud SIEM.

Search incidents by state, severity, commander, time or custom field, with facet counts. PREVIEW endpoint.

Search Datadog log events. The result is raw production log lines, which routinely contain personal data and other systems' secrets — do not echo them further than the user asked. This is also the most rate-limited Datadog endpoint at 300 requests per hour for the whole organization, shared with the customer's own tooling, so narrow the query and the window rather than paging through everything. A query is required; an empty one would match every log line in the window.

Search the individual GROUP states of multi-alert monitors (a monitor grouped by {host} or {pod_name} has one overall state and N group states). This is what turns 'the checkout monitor is alerting' into 'on two of forty pods'.

Search monitors with Datadog's monitor search syntax (status:Alert, type:'metric alert', notify:@slack-sre, tag:env:prod) and get matches plus facet counts. 'What is alerting right now' is one call here instead of a full paginated scan of every monitor in the organization.

Search RUM events with a structured query, sort and cursor paging. The POST form of List RUM events, for queries too long for a URL. Same end-user data exposure.

Search security findings with a structured query and cursor paging. The POST form of List security findings, with the same exposure and the same read-only posture. REQUIRES CLOUD SECURITY MANAGEMENT.

Search Cloud SIEM security signals with a structured query and time window — for correlating a security detection with an ops incident. Read-only; every write in Datadog's security-monitoring family silences a detection and is permanently excluded. Requires Cloud SIEM.

Search SLOs with a facet query and get matching SLOs plus facet counts, instead of paging the whole list and filtering client-side.

Search APM spans — the trace-level layer between 'the metric moved' and 'this query is slow'. Returns individual spans with their service, resource, duration and error state. Requires the APM module.

Search Synthetics test suites — the named groups of tests a team runs together. Returns suite metadata, not the tests' request configuration.

DESTRUCTIVE — cancel a Datadog downtime so its monitors can page again. The downtime may be a planned maintenance window somebody else scheduled, and cancelling it during that window pages an entire on-call rotation. Datadog publishes no un-cancel endpoint; the downtime has to be recreated with datadog_mute_monitor.

Update an incident's title, summary, severity, state or root cause. Agentic Fabriq forwards ONLY those five fields — the request body is rebuilt from named arguments and an unrecognised key is refused, not dropped. In particular `detected` and `resolved`, which Datadog also accepts here, are unreachable: they are the timestamps MTTR is computed from, and rewriting them is editing the record rather than the data. Setting state to resolved records a resolution at the time of the call, which is the honest path to the same number. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT — this half of the family is seat-gated where creating is not.

Update an attachment on an incident — correct a postmortem link or its title. Ships with its create and its delete so a wrong link is a correction rather than a removal. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Update a recorded impact on an incident — correct the affected service, the segment or the window. The edit that sits between Create incident impact and Delete incident impact, so a wrong impact can be corrected without being removed. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Update one incident task — its content, its assignees, its due date or whether it is complete. PREVIEW endpoint. REQUIRES AN INCIDENT MANAGEMENT SEAT.

Compile a proposed change to an EXISTING monitor and return its errors without applying it. Creates nothing and changes nothing.

Compile a monitor definition and return its errors WITHOUT creating anything. Read-scoped and creates nothing, so an agent can draft a monitor, prove it parses, and hand the JSON to a human to paste — the whole workflow without ever granting monitor write access.