> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog

> Connect Datadog to CloudThinker for log search, metric queries, infrastructure monitoring, and incident investigation

Connect your Datadog account to enable CloudThinker agents to search logs, query metrics, monitor infrastructure, and investigate incidents across your entire stack. Datadog authenticates with an **API key** and a **scoped Application key** pair.

***

## Supported platforms

| Site    | URL                 |
| ------- | ------------------- |
| **US1** | `app.datadoghq.com` |
| **US3** | `us3.datadoghq.com` |
| **US5** | `us5.datadoghq.com` |
| **EU1** | `app.datadoghq.eu`  |
| **AP1** | `ap1.datadoghq.com` |
| **AP2** | `ap2.datadoghq.com` |

<Warning>
  GovCloud (US1-FED) is not supported by the Datadog MCP server.
</Warning>

***

## Prerequisites

You need a **Datadog API key** and a **scoped Application key**.

**Create an API key:**

1. Go to **Organization Settings → API Keys** in your Datadog account.
2. Click **+ New Key**, name it (e.g., `CloudThinker`), and save.
3. Copy the key value.

**Create a scoped Application key:**

1. Go to **Organization Settings → Application Keys**.
2. Click **+ New Key**, name it (e.g., `CloudThinker`).
3. Under **Scopes**, select the permissions listed in [Required permissions](#required-permissions).
4. Save and copy the key value.

<Tip>
  Always use scoped Application keys instead of unscoped ones. An unscoped key inherits all permissions from the user who created it.
</Tip>

***

## Setup

<Steps>
  <Step title="Open CloudThinker">
    Navigate to **Connections → Datadog** in your CloudThinker workspace.
  </Step>

  <Step title="Select your Datadog site">
    Choose the Datadog site that matches your account (e.g., US1 for `datadoghq.com`, EU1 for `datadoghq.eu`).
  </Step>

  <Step title="Enter your API key">
    Paste your Datadog **API key**.
  </Step>

  <Step title="Enter your Application key">
    Paste your Datadog **Application key**.
  </Step>

  <Step title="Connect">
    Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
  </Step>
</Steps>

***

## Connection details

| Field               | Description                                  | Example               |
| ------------------- | -------------------------------------------- | --------------------- |
| **Site**            | Datadog site matching your account           | `US1 (datadoghq.com)` |
| **API Key**         | Datadog API key                              | —                     |
| **Application Key** | Datadog Application key with explicit scopes | —                     |

***

## Required permissions

Select these scopes when creating your Application key. Read scopes cover all investigation tools; `notebooks_write` is optional and enables notebook creation.

| Scope                                    | What it enables                                    |
| ---------------------------------------- | -------------------------------------------------- |
| `logs_read_data`, `logs_read_index_data` | Search and analyze logs                            |
| `metrics_read`, `timeseries_query`       | Query metrics and time-series data                 |
| `monitors_read`                          | Search monitors by status and tag                  |
| `incidents_read`                         | Search incidents and get details                   |
| `dashboards_read`                        | Inspect dashboard configurations                   |
| `hosts_read`                             | List and inspect infrastructure hosts              |
| `apm_read`                               | Retrieve traces and search APM spans               |
| `apm_service_catalog_read`               | List services and map dependencies                 |
| `events_read`                            | Search platform and custom events                  |
| `notebooks_read`                         | Search and retrieve investigation notebooks        |
| `rum_apps_read`                          | Search Real User Monitoring data                   |
| `notebooks_write`                        | Create and edit investigation notebooks (optional) |

<Tip>
  Start with read scopes only. Add `notebooks_write` only for workflows where agents need to create investigation notebooks.
</Tip>

***

## Agent capabilities

Once connected, agents can perform read and write operations across your Datadog environment.

| Capability            | What the agent can do                                                      |
| --------------------- | -------------------------------------------------------------------------- |
| **Logs**              | Search logs across services and environments, analyze patterns and trends  |
| **Metrics**           | Search available metrics, query time-series data, retrieve metric metadata |
| **Monitors**          | Find monitors by status, name, or tag                                      |
| **Incidents**         | Search active and resolved incidents, get full incident details            |
| **Dashboards**        | Search and inspect dashboard configurations                                |
| **Infrastructure**    | List and inspect hosts across your infrastructure                          |
| **APM**               | Retrieve distributed traces, search spans for latency analysis             |
| **Service catalog**   | List services and map service dependency relationships                     |
| **Events**            | Search platform and custom events                                          |
| **Notebooks**         | Search, retrieve, create, and edit investigation notebooks                 |
| **RUM**               | Search Real User Monitoring data                                           |
| **Connection health** | Validate that the Datadog connection is working                            |

<Warning>
  Notebook write operations require user approval before execution.
</Warning>

### Verify the connection

```text theme={null}
@alex run the Datadog connection health check and summarize active monitors and host count
```

### Example prompts

```text theme={null}
@alex search for error logs in the production environment from the last 15 minutes
@alex check for active Datadog incidents and investigate root causes
@alex analyze APM traces for the checkout service and identify latency bottlenecks
```

***

## Troubleshooting

<Accordion title="Connection test fails with 403">
  Verify your API key is valid and not revoked. Confirm your Application key has the required scopes and that both keys belong to the same Datadog organization.
</Accordion>

<Accordion title="Missing data after connecting">
  Check that your Application key scopes include the data type you are querying (e.g., `logs_read_data` for logs). Verify your Datadog retention settings and confirm the service or host is actively sending data.
</Accordion>

<Accordion title="Wrong Datadog site selected">
  If queries return empty results, you may have selected the wrong site. Check your Datadog URL — `app.datadoghq.com` is US1, `us3.datadoghq.com` is US3, `app.datadoghq.eu` is EU1. Disconnect and reconnect with the correct site.
</Accordion>

<Accordion title="API key vs Application key confusion">
  Both keys are required and serve different roles. The **API key** authenticates requests. The **Application key** controls which Datadog features and data the agent can access. One alone is not sufficient.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Scoped Application keys** — always specify explicit scopes; an unscoped key inherits the creating user's full permissions.
- **Separate keys per integration** — create dedicated API and Application keys for CloudThinker so you can revoke them independently.

***

## Related

<CardGroup cols={2}>
  <Card title="Grafana Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/grafana.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c1329049025cd3c3a0909b400baef7be" href="/guide/connections/grafana" width="24" height="24" data-path="images/icons/grafana.svg">
    Alternative metrics and dashboards
  </Card>

  <Card title="PagerDuty Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/pagerduty.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=cdc34a966d5d46da70c3bc509a2a7492" href="/guide/connections/pagerduty" width="24" height="24" data-path="images/icons/pagerduty.svg">
    Incident alerting and on-call
  </Card>
</CardGroup>