Datadog

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the monitors, incidents and postmortem notebooks of a Datadog account, so operations agents can explain an alert from what the team wrote about the last one. It reads the descriptions and the people’s text, never the telemetry.

At a glance

Collector	Datadog, version 1.0.0
Reads	Datadog: Datadog API (monitors, incidents, notebooks) (the vendor's documentation)
Family	Observability
Kind	Monitoring
Ways to connect	Access token
Scopes	Read: monitors_read, incident_read, notebooks_read
Read only	Yes
Vendor's API can move money	No
Personal data	Content, Identity
Hosts it may contact	api.datadoghq.com, api.datadoghq.eu, api.us3.datadoghq.com, api.us5.datadoghq.com, api.ap1.datadoghq.com, api.ddog-gov.com, api.{site}, app.{site}, api, app, datadoghq.com
Vendor API versions	Datadog API v1 (monitors, notebooks) and v2 (incidents)
Lowest engine version	0.45.0

What it reads

• Monitors: name, message, query, type, state, tags and priority. The monitor API has no “modified since” filter, so each run lists them all and keeps the newer ones; a monitor that has gone is withdrawn.
• Incidents: title, state, severity, customer impact and the text fields the responders filled in (summary, root cause, and any the account added).
• Postmortems: Datadog keeps them as notebooks of type postmortem; their Markdown cells are the record. Graph cells are left out.
• Each kind has its own modified-time cursor, and the boundary item is re-read, which costs nothing because an unchanged record is not rewritten.
• Never read: dashboards, logs, traces and metrics.

How to connect

1. Create an API key and an application key with only the read scopes below (Organization settings, Application keys).
2. In LightHouse, open Connectors, choose Datadog, pick your site (us1, us3, us5, eu1, ap1 or us1-fed), a label and how often to read, and enter the two keys.
3. In code, give the deployment DD_API_KEY and DD_APP_KEY from your secret store and add a kind: datadog source card with site (the API host suffix, such as datadoghq.eu), label and requires. api_key_env and app_key_env change the variable names.

Permissions

Read scopes only: monitors_read, incident_read and notebooks_read. The collector sends only GET requests, to api.<site> and no other host. A key that could write is a key a leak turns into an outage, so give the application key no write scope. Its read-only test proves it on every change.

Limits

• The site must be a Datadog site (datadoghq.com, datadoghq.eu, a regional *.datadoghq.com, or ddog-gov.com); anything else is refused.
• Incidents and postmortems are kept when deleted in Datadog; only monitors are withdrawn.
• The monitor list is read whole on every run.
• Requests are paced and back off when Datadog asks (Retry-After).

Data handling

• Monitor messages, incident text and postmortem text are copied into the deployment’s corpus under the source’s label. They can name people and hold personal data.
• Both keys stay in your secret store and are never written to logs or run notes; they are sent only to the API host.
• Nothing leaves the deployment: only counts reach LightHouse.

Troubleshooting

What you see	What it means	What to do
is not a Datadog site	site is not a Datadog API host suffix	Use datadoghq.com, datadoghq.eu, us5.datadoghq.com and the like
unknown Datadog kinds	kinds names something other than monitors, incidents or postmortems	Correct the list
credential variable 'DD_API_KEY' is not set	A key variable is empty (the name is shown, never a value)	Set DD_API_KEY and DD_APP_KEY
HTTP 403	The application key lacks a read scope, or belongs to another site	Add the scope; check the site
Read succeeded, 0 written	Nothing was modified since the cursor	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.45.0	Datadog API v1 (monitors, notebooks) and v2 (incidents)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only