# Datadog > Datadog: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the monitors, incidents and postmortem notebooks of a Datadog account, so operations agents can explain an alert from what the team wrote about the last one. It reads the descriptions and the people’s text, never the telemetry. ## At a glance | Collector | Datadog, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | Datadog: Datadog API (monitors, incidents, notebooks) ([the vendor's documentation](https://docs.datadoghq.com/api/latest/)) | | Family | Observability | | Kind | Monitoring | | Ways to connect | Access token | | Scopes | - Read: `monitors_read`, `incident_read`, `notebooks_read` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Content, Identity | | Hosts it may contact | `api.datadoghq.com`, `api.datadoghq.eu`, `api.us3.datadoghq.com`, `api.us5.datadoghq.com`, `api.ap1.datadoghq.com`, `api.ddog-gov.com`, `api.{site}`, `app.{site}`, `api`, `app`, `datadoghq.com` | | Vendor API versions | Datadog API v1 (monitors, notebooks) and v2 (incidents) | | Lowest engine version | `0.45.0` | ## What it reads - Monitors: name, message, query, type, state, tags and priority. The monitor API has no “modified since” filter, so each run lists them all and keeps the newer ones; a monitor that has gone is withdrawn. - Incidents: title, state, severity, customer impact and the text fields the responders filled in (summary, root cause, and any the account added). - Postmortems: Datadog keeps them as notebooks of type `postmortem`; their Markdown cells are the record. Graph cells are left out. - Each kind has its own modified-time cursor, and the boundary item is re-read, which costs nothing because an unchanged record is not rewritten. - Never read: dashboards, logs, traces and metrics. ## How to connect 1. Create an API key and an application key with only the read scopes below (Organization settings, Application keys). 2. In LightHouse, open **Connectors**, choose **Datadog**, pick your site (`us1`, `us3`, `us5`, `eu1`, `ap1` or `us1-fed`), a label and how often to read, and enter the two keys. 3. In code, give the deployment `DD_API_KEY` and `DD_APP_KEY` from your secret store and add a `kind: datadog` source card with `site` (the API host suffix, such as `datadoghq.eu`), `label` and `requires`. `api_key_env` and `app_key_env` change the variable names. ## Permissions Read scopes only: `monitors_read`, `incident_read` and `notebooks_read`. The collector sends only `GET` requests, to `api.` and no other host. A key that could write is a key a leak turns into an outage, so give the application key no write scope. Its read-only test proves it on every change. ## Limits - The site must be a Datadog site (`datadoghq.com`, `datadoghq.eu`, a regional `*.datadoghq.com`, or `ddog-gov.com`); anything else is refused. - Incidents and postmortems are kept when deleted in Datadog; only monitors are withdrawn. - The monitor list is read whole on every run. - Requests are paced and back off when Datadog asks (`Retry-After`). ## Data handling - Monitor messages, incident text and postmortem text are copied into the deployment’s corpus under the source’s `label`. They can name people and hold personal data. - Both keys stay in your secret store and are never written to logs or run notes; they are sent only to the API host. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | --------------------------------------------- | --------------------------------------------------------------------- | --------------------------------------------------------------------- | | `is not a Datadog site` | `site` is not a Datadog API host suffix | Use `datadoghq.com`, `datadoghq.eu`, `us5.datadoghq.com` and the like | | `unknown Datadog kinds` | `kinds` names something other than monitors, incidents or postmortems | Correct the list | | `credential variable 'DD_API_KEY' is not set` | A key variable is empty (the name is shown, never a value) | Set `DD_API_KEY` and `DD_APP_KEY` | | `HTTP 403` | The application key lacks a read scope, or belongs to another site | Add the scope; check the site | | Read succeeded, 0 written | Nothing was modified since the cursor | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.45.0` | Datadog API v1 (monitors, notebooks) and v2 (incidents) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/datadog/