Datadog Role Permissions

Docs > Account Management > Role Based Access Control > Datadog Role Permissions

After creating a role, assign or remove permissions to this role directly by updating the role in Datadog, or through the Datadog Permission API. Find below a list of available permissions.

Overview

By default, existing users are associated with one of the three out-of-the-box roles:

Datadog Admin
Datadog Standard
Datadog Read-Only

All users with one of these roles can read all data types. Admin and Standard users have write permissions on assets. Admin users have additional read and write permissions for sensitive assets relating to user management, org management, billing, and usage.

Note: When adding a new custom role to a user, make sure to remove the out-of-the-box Datadog role associated with that user in order to enforce the new role permissions.

Each asset type has corresponding read and write permissions. In the tables below, find the details of these permissions.

API and Application Keys

Find below the list of permissions for the api and application keys assets:

Name	Description
`user_app_keys`	View and manage Application Keys owned by the user.
`org_app_keys_read`	View Application Keys owned by all users in the organization.
`org_app_keys_write`	Manage Application Keys owned by all users in the organization.
`api_keys_read`	List and retrieve the key values of all API Keys in your organization.
`api_keys_write`	Create and rename API Keys for your organization.
`client_tokens_read`	Read Client Tokens. Unlike API keys, client tokens may be exposed client-side in JavaScript code for web browsers and other clients to send data to Datadog.
`client_tokens_write`	Create and edit Client Tokens. Unlike API keys, client tokens may be exposed client-side in JavaScript code for web browsers and other clients to send data to Datadog.
`api_keys_delete`	Delete API Keys for your organization.

APM

Find below the list of permissions for the apm assets:

Name	Description
`apm_read`	Read and query APM and Trace Analytics.
`apm_retention_filter_read`	Read trace retention filters. A user with this permission can view the retention filters page, list of filters, their statistics, and creation info.
`apm_retention_filter_write`	Create, edit, and delete trace retention filters. A user with this permission can create new retention filters, and update or delete to existing retention filters.
`apm_service_ingest_read`	Access service ingestion pages. A user with this permission can view the service ingestion page, list of root services, their statistics, and creation info.
`apm_service_ingest_write`	Edit service ingestion pages' root services. A user with this permission can edit the root service ingestion and generate a code snippet to increase ingestion per service.
`apm_apdex_manage_write`	Set Apdex T value on any service. A user with this permission can set the T value from the Apdex graph on the service page.
`apm_tag_management_write`	Edit second primary tag selection. A user with this permission can modify the second primary tag dropdown in the APM settings page.
`apm_primary_operation_write`	Edit the operation name value selection. A user with this permission can modify the operation name list in the APM settings page and the operation name controller on the service page.
`debugger_write`	Edit Dynamic Instrumentation configuration.
`debugger_read`	View Dynamic Instrumentation configuration.
`apm_generate_metrics`	Create custom metrics from spans.
`apm_pipelines_write`	Add and change APM pipeline configurations.
`apm_pipelines_read`	View APM pipeline configurations.
`apm_service_catalog_write`	Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
`apm_service_catalog_read`	View service catalog and service definitions.
`apm_remote_configuration_write`	Edit APM Remote Configuration.
`apm_remote_configuration_read`	View APM Remote Configuration.
`continuous_profiler_read`	View data in Continuous Profiler.

Access Management

Find below the list of permissions for the access management assets:

Name	Description
`user_access_invite`	Invite other users to your organization.
`user_access_manage`	Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
`service_account_write`	Create, disable, and use Service Accounts in your organization.
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

Billing and Usage

Find below the list of permissions for the billing and usage assets:

Name	Description
`billing_read`	View your organization's subscription and payment method but not make edits.
`billing_edit`	Manage your organization's subscription and payment method.
`usage_read`	View your organization's usage and usage attribution.
`usage_edit`	Manage your organization's usage attribution set-up.
`usage_notifications_read`	Receive notifications and view currently configured notification settings.
`usage_notifications_write`	Receive notifications and configure notification settings.

CI Visibility

Find below the list of permissions for the ci visibility assets:

Name	Description
`ci_visibility_read`	View CI Visibility.
`ci_visibility_write`	Edit flaky tests and delete Test Services.
`ci_provider_settings_write`	Edit CI Provider settings. Manage GitHub accounts and repositories for enabling CI Visibility and job logs collection.
`ci_visibility_settings_write`	Configure CI Visibility settings. Set a repository default branch, enable GitHub comments, and delete test services.
`intelligent_test_runner_activation_write`	Enable or disable Intelligent Test Runner.
`intelligent_test_runner_settings_write`	Edit Intelligent Test Runner settings, such as modifying ITR excluded branch list.
`ci_ingestion_control_write`	Edit CI Ingestion Control exclusion filters.
`ci_visibility_pipelines_write`	Create CI Visibility pipeline spans using the API.
`quality_gate_rules_read`	View Quality Gate Rules.
`quality_gate_rules_write`	Edit Quality Gate Rules.

Case and Incident Management

Find below the list of permissions for the case and incident management assets:

Name	Description
`incident_read`	View incidents in Datadog.
`incident_write`	Create, view, and manage incidents in Datadog.
`incident_settings_read`	View Incident Settings.
`incident_settings_write`	Configure Incident Settings.
`incidents_private_global_access`	Access all private incidents in Datadog, even when not added as a responder.
`cases_read`	View Cases.
`cases_write`	Create and update cases.
`incident_notification_settings_read`	View Incidents Notification settings.
`incident_notification_settings_write`	Configure Incidents Notification settings.

Cloud Cost Management

Find below the list of permissions for the cloud cost management assets:

Name	Description
`cloud_cost_management_read`	View Cloud Cost pages. This does not restrict access to the cloud cost data source in dashboards and notebooks.
`cloud_cost_management_write`	Configure cloud cost accounts and global customizations.

Cloud Security Platform

Find below the list of permissions for the cloud security platform assets:

Name	Description
`security_monitoring_rules_read`	Read Detection Rules.
`security_monitoring_rules_write`	Create and edit Detection Rules.
`security_monitoring_signals_read`	View Security Signals.
`security_monitoring_signals_write`	Modify Security Signals.
`security_monitoring_filters_read`	Read Security Filters.
`security_monitoring_filters_write`	Create, edit, and delete Security Filters.
`appsec_event_rule_read`	View Application Security Management Event Rules.
`appsec_event_rule_write`	Edit Application Security Management Event Rules.
`security_monitoring_notification_profiles_read`	Read Notification Rules.
`security_monitoring_notification_profiles_write`	Create, edit, and delete Notification Rules.
`security_monitoring_cws_agent_rules_read`	Read Cloud Workload Security Agent Rules.
`security_monitoring_cws_agent_rules_write`	Create, edit, and delete Cloud Workload Security Agent Rules.
`appsec_protect_read`	View blocked attackers.
`appsec_protect_write`	Manage blocked attackers.
`appsec_activation_read`	View whether Application Security Management has been enabled or disabled on services via 1-click enablement with Remote Configuration.
`appsec_activation_write`	Enable or disable Application Security Management on services via 1-click enablement with Remote Configuration.
`security_monitoring_findings_read`	View CSPM Findings.
`security_monitoring_findings_write`	Mute CSPM Findings.
`appsec_vm_write`	Update status or assignee of Application Security vulnerabilities.

Compliance

Find below the list of permissions for the compliance assets:

Name	Description
`audit_logs_read`	View Audit Trail in your organization.
`audit_logs_write`	Configure Audit Trail in your organization.
`data_scanner_read`	View Data Scanner configurations.
`data_scanner_write`	Edit Data Scanner configurations.

Cross-Product Features

Find below the list of permissions for the cross-product features assets:

Name	Description
`saved_views_write`	Modify Saved Views across all Datadog products.
`facets_write`	Manage facets for products other than Log Management, such as APM Traces. To modify Log Facets, use Logs Write Facets.

Dashboards

Find below the list of permissions for the dashboards assets:

Name	Description
`dashboards_read`	View dashboards.
`dashboards_write`	Create and change dashboards.
`dashboards_public_share`	Generate public and authenticated links to share dashboards or embeddable graphs externally.
`generate_dashboard_reports`	Schedule custom reports from a dashboard. These reports will display any viewable data regardless of any granular restrictions (restriction queries, scoped indexes) applied to the report's creator.

Error Tracking

Find below the list of permissions for the error tracking assets:

Name	Description
`error_tracking_write`	Edit Error Tracking settings.

Events

Find below the list of permissions for the events assets:

Name	Description
`event_correlation_config_read`	Read Event Correlation Configuration data such as Correlation Rules and Settings.
`event_correlation_config_write`	Manage Event Correlation Configuration such as Correlation Rules and Settings.
`event_config_write`	Manage general event configuration such as API Emails.

Integrations

Find below the list of permissions for the integrations assets:

Name	Description
`integrations_api`	Deprecated. Use the Integrations APIs to configure integrations. In order to configure integrations from the UI, a user must also have Standard Access.
`manage_integrations`	Install, uninstall, and configure integrations.

Log Management

Find below the list of permissions for the log configuration assets and log data, along with the typical category of user you’d assign this permission to. See the recommendations on how to assign permissions to team members in the Logs RBAC guide.

Name	Description
`logs_modify_indexes`	Read and modify all indexes in your account. This includes the ability to grant the Logs Read Index Data and Logs Write Exclusion Filters permission to other roles, for some or all indexes.
`logs_write_exclusion_filters`	Add and change exclusion filters for all or some log indexes. Can be granted in a limited capacity per index to specific roles via the Logs interface or API. If granted from the Roles interface or API, the permission has global scope.
`logs_write_pipelines`	Add and change log pipeline configurations, including the ability to grant the Logs Write Processors permission to other roles, for some or all pipelines.
`logs_write_processors`	Add and change some or all log processor configurations. Can be granted in a limited capacity per pipeline to specific roles via the Logs interface or API. If granted via the Roles interface or API the permission has global scope.
`logs_write_archives`	Add and edit Log Archives.
`logs_generate_metrics`	Create custom metrics from logs.
`logs_read_data`	Read log data. In order to read log data, a user must have both this permission and Logs Read Index Data. This permission can be restricted with restriction queries. Restrictions are limited to the Log Management product.
`logs_read_archives`	Read Log Archives location and use it for rehydration.
`logs_write_historical_view`	Rehydrate logs from Archives.
`logs_write_facets`	Create or edit Log Facets.
`logs_delete_data`	Delete data from your Logs, including entire indexes.
`logs_write_forwarding_rules`	Add and edit forwarding destinations and rules for logs.

Log Management RBAC also includes two legacy permissions, superseded by finer-grained and more extensive logs_read_data permission:

Name	Description
`logs_live_tail`	Access the live tail feature
`logs_read_index_data`	Read a subset log data (index based)

Metrics

Find below the list of permissions for the metrics assets:

Name	Description
`metric_tags_write`	Edit and save tag configurations for custom metrics.
`host_tags_write`	Add and change tags on hosts.
`metrics_metadata_write`	Edit metadata on metrics.

Monitors

Find below the list of permissions for the monitors assets:

Name	Description
`monitors_read`	View monitors.
`monitors_write`	Edit, mute, and delete individual monitors.
`monitors_downtime`	Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute hosts. The ability to write monitors is not required to set downtimes.
`monitor_config_policy_write`	Create, update, and delete monitor configuration policies.

Notebooks

Find below the list of permissions for the notebooks assets:

Name	Description
`notebooks_read`	View notebooks.
`notebooks_write`	Create and change notebooks.

Observability Pipelines

Find below the list of permissions for the observability pipelines assets:

Name	Description
`observability_pipelines_read`	View pipeline configurations.
`observability_pipelines_write`	Create, edit, and delete pipeline configurations.
`observability_pipelines_delete`	Delete pipelines from your organization.
`observability_pipelines_deploy`	Deploy pipelines in your organization.

Processes

Find below the list of permissions for the processes assets:

Name	Description
`processes_generate_metrics`	Create custom metrics from processes.

Real User Monitoring

Find below the list of permissions for the real user monitoring assets:

Name	Description
`rum_apps_write`	Create, edit, and delete RUM applications. Creating a RUM application automatically generates a Client Token. In order to create Client Tokens directly, a user needs the Client Tokens Write permission.
`rum_apps_read`	View RUM Applications data.
`rum_session_replay_read`	View Session Replays.
`rum_generate_metrics`	Create custom metrics from RUM events.
`rum_delete_data`	Delete data from RUM.
`rum_playlist_write`	Create, update, and delete RUM playlists. Add and remove sessions from RUM playlists.

Reference Tables

Find below the list of permissions for the reference tables assets:

Name	Description
`reference_tables_write`	Create or modify Reference Tables.

Service Level Objectives

Find below the list of permissions for the service level objectives assets:

Name	Description
`slos_read`	View SLOs and status corrections.
`slos_write`	Create, edit, and delete SLOs.
`slos_corrections`	Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.

Synthetic Monitoring

Find below the list of permissions for the synthetic monitoring assets:

Name	Description
`synthetics_private_location_read`	View, search, and use Synthetics private locations.
`synthetics_private_location_write`	Create and delete private locations in addition to having access to the associated installation guidelines.
`synthetics_global_variable_read`	View, search, and use Synthetics global variables.
`synthetics_global_variable_write`	Create, edit, and delete global variables for Synthetics.
`synthetics_read`	List and view configured Synthetic tests and test results.
`synthetics_write`	Create, edit, and delete Synthetic tests.
`synthetics_default_settings_read`	View the default settings for Synthetic Monitoring.
`synthetics_default_settings_write`	Edit the default settings for Synthetic Monitoring.

Teams

Find below the list of permissions for the teams assets:

Name	Description
`teams_manage`	Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.

Watchdog

Find below the list of permissions for the watchdog assets:

Name	Description
`watchdog_insights_read`	Deprecated. View Watchdog Insights.
`watchdog_alerts_write`	Manage Watchdog Alerts.

Workflows

Find below the list of permissions for the workflows assets:

Name	Description
`workflows_read`	View workflows.
`workflows_write`	Create, edit, and delete workflows.
`workflows_run`	Run workflows.
`connections_read`	List and view available connections. Connections contain secrets that cannot be revealed.
`connections_write`	Create and delete connections.
`connections_resolve`	Resolve connections.