--- title: List governance insights description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Governance Insights --- # List governance insights{% #list-governance-insights %} Copy pageCopied {% tab title="v2" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). | Datadog site | API endpoint | | ----------------- | ------------------------------------------------------------ | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/governance/insights | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/governance/insights | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/governance/insights | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/governance/insights | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/governance/insights | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/governance/insights | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/governance/insights | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/governance/insights | ### Overview Retrieve the list of governance insights available to the organization. By default, only insight metadata is returned; pass `withValues=true` to also compute and include each insight's current and previous values. Insights can be filtered by product. ### Arguments #### Query Strings | Name | Type | Description | | --------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | withValues | boolean | Whether to compute and include the current and previous value of each insight. Defaults to `false`, in which case only insight metadata is returned. | | orgUuid | string | The UUID of the organization to compute insights for. Defaults to the organization of the authenticated user. Used to retrieve insights for a child organization from a parent organization. | | filter[product] | array | Restrict the results to insights belonging to the given products. May be repeated to filter by multiple products. Matching is case-insensitive. | ### Response {% tab title="200" %} OK {% tab title="Model" %} A list of governance insights. | Parent field | Field | Type | Description | | ----------------- | -------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | [object] | An array of governance insight resources. | | data | attributes [*required*] | object | The attributes of a governance insight. | | attributes | audit_query [*required*] | object | An audit log query used to compute an insight value. | | audit_query | compute [*required*] | object | The aggregation applied to an audit log query. | | compute | aggregation [*required*] | string | The aggregation function to apply. | | compute | interval [*required*] | int64 | The aggregation time window, in milliseconds. | | compute | metric [*required*] | string | The metric or attribute to aggregate. | | compute | rollup | string | An optional secondary aggregation applied to the audit query result. | | audit_query | indexes [*required*] | [string] | The audit log indexes the query runs against. | | audit_query | query [*required*] | string | The audit log search query string. | | audit_query | source [*required*] | string | The data source the query runs against. | | attributes | best_practice [*required*] | object | The best practice associated with an insight. Populated with the first active best practice matched to the insight; `null` when no best practice is attached. | | best_practice | category [*required*] | string | The value driver the best practice is grouped under, such as `access_governance`, `security`, `compliance`, or `operational_hygiene`. | | best_practice | deep_link [*required*] | string | A relative link to the configuration page where the best practice can be acted upon. | | best_practice | description [*required*] | string | The full rationale and guidance for the best practice. | | best_practice | detection_type | string | An optional association to a control's detection type. `null` when not associated with a control. | | best_practice | id [*required*] | string | The unique identifier of the best practice. | | best_practice | impact [*required*] | string | The expected impact of following the best practice. | | best_practice | impact_hint [*required*] | int64 | A priority hint for ordering best practices by expected impact. Lower values indicate higher priority. | | best_practice | permissions [*required*] | [string] | The permissions required for the user to act on the best practice. | | best_practice | status [*required*] | string | Whether the best practice is currently `active` or `deprecated`. | | best_practice | summary [*required*] | string | A one-line explanation of why this best practice matters. | | best_practice | title [*required*] | string | A short, human-readable name for the best practice. | | best_practice | trigger_condition [*required*] | string | The condition that surfaces the best practice. For an `insight` trigger, the insight slug; for a `static` trigger, a descriptive condition key. | | best_practice | trigger_type [*required*] | string | How the best practice is surfaced. `insight` ties it to an insight; `static` surfaces it unless its condition is met. | | attributes | deep_link [*required*] | string | A relative link to the product surface where the insight can be acted upon. | | attributes | description [*required*] | string | A human-readable description of what the insight measures. | | attributes | display_name [*required*] | string | Human-readable name of the insight. | | attributes | event_query [*required*] | object | An event query used to compute an insight value. | | event_query | compute | object | The aggregation applied to an event query. | | compute | aggregation [*required*] | string | The aggregation function to apply. | | compute | interval [*required*] | int64 | The aggregation time window, in milliseconds. | | event_query | indexes [*required*] | [string] | The event indexes the query runs against. | | event_query | query [*required*] | string | The event search query string. | | attributes | metric_query [*required*] | object | A metric query used to compute an insight value. | | metric_query | query [*required*] | string | The query string. | | metric_query | reducer [*required*] | string | How the query result series is reduced to a single value. | | metric_query | source [*required*] | string | The data source the query runs against. | | attributes | old_value [*required*] | double | The value of the insight over the previous comparison window. `null` when values were not requested or could not be computed. | | attributes | percentage_query [*required*] | object | A percentage query that computes an insight value as a ratio of two metric queries. | | percentage_query | denominator_query [*required*] | object | A metric query used to compute an insight value. | | denominator_query | query [*required*] | string | The query string. | | denominator_query | reducer [*required*] | string | How the query result series is reduced to a single value. | | denominator_query | source [*required*] | string | The data source the query runs against. | | percentage_query | numerator_query [*required*] | object | A metric query used to compute an insight value. | | numerator_query | query [*required*] | string | The query string. | | numerator_query | reducer [*required*] | string | How the query result series is reduced to a single value. | | numerator_query | source [*required*] | string | The data source the query runs against. | | attributes | product [*required*] | string | The product the insight belongs to. | | attributes | query_config | object | Query execution context that allows the frontend to execute insight queries directly. | | query_config | chart_type | string | The chart type the frontend should use to render the insight. | | query_config | comparison_shift [*required*] | string | The window used for the previous value comparison, for example `week` or `month`. | | query_config | default_value | int64 | The default value to display when no data is available. | | query_config | directionality | string | Whether an increase in the value is good, bad, or neutral. One of `neutral`, `increase_better`, or `decrease_better`. | | query_config | effective_time_window_days [*required*] | int64 | The number of days the insight value is computed over. | | attributes | sort_order | int64 | The relative order in which the insight should be displayed. | | attributes | state [*required*] | string | The state of the insight. A `critical` insight receives extra UI treatment to draw attention to it. | | attributes | sub_product [*required*] | string | The sub-product the insight belongs to, if any. | | attributes | time_range [*required*] | string | The time range the insight value is computed over, if applicable. | | attributes | unit_name [*required*] | string | The unit that the insight's value is measured in. | | attributes | usage_query [*required*] | object | A usage query used to compute an insight value. | | usage_query | query [*required*] | string | The usage query string. | | usage_query | reducer [*required*] | string | How the query result series is reduced to a single value. | | attributes | value [*required*] | double | The current value of the insight. `null` when values were not requested or could not be computed. | | data | id [*required*] | string | The unique identifier of the insight. | | data | type [*required*] | enum | JSON:API resource type for a governance insight. Allowed enum values: `insight` | {% /tab %} {% tab title="Example" %} ```json { "data": [ { "attributes": { "audit_query": { "compute": { "aggregation": "cardinality", "interval": 86400000, "metric": "@usr.id", "rollup": "" }, "indexes": [ "main" ], "query": "@evt.name:Dashboard", "source": "audit" }, "best_practice": { "category": "access_governance", "deep_link": "/organization-settings/users?status=inactive", "description": "Review and deactivate users who have not logged in within the last 90 days.", "detection_type": null, "id": "bp_monitor_inactive_users", "impact": "Reduces unauthorized access risk.", "impact_hint": 1, "permissions": [ "user_access_manage" ], "status": "active", "summary": "Inactive users with access increase your security surface area.", "title": "Monitor inactive users", "trigger_condition": "active_users", "trigger_type": "insight" }, "deep_link": "", "description": "Number of users who have used the Dashboard in the last 30 days", "display_name": "Active Dashboards", "event_query": { "compute": { "aggregation": "count", "interval": 86400000 }, "indexes": [ "main" ], "query": "source:cloudtrail" }, "metric_query": { "query": "avg:system.cpu.user{*}", "reducer": "avg", "source": "metrics" }, "old_value": 3274, "percentage_query": { "denominator_query": { "query": "avg:system.cpu.user{*}", "reducer": "avg", "source": "metrics" }, "numerator_query": { "query": "avg:system.cpu.user{*}", "reducer": "avg", "source": "metrics" } }, "product": "Usage", "query_config": { "chart_type": "line", "comparison_shift": "month", "default_value": 0, "directionality": "neutral", "effective_time_window_days": 30 }, "sort_order": 1, "state": "critical", "sub_product": "Indexes", "time_range": "month", "unit_name": "active dashboards", "usage_query": { "query": "logs_indexed_events", "reducer": "sum" }, "value": 3601 }, "id": "498ee21f-8037-48b8-a961-a488692902f4", "type": "insight" } ] } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="401" %} Unauthorized {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \# Curl command curl -X GET "https://api.datadoghq.com/api/v2/governance/insights" \ -H "Accept: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" {% /tab %}