Authorization Scopes

Authorization scopes

Scope is an authorization mechanism that allows you to limit and define the granular access that applications have to an organization’s Datadog data. When authorized access on behalf of a user or service account, applications can access only the information explicitly requested and nothing more.

The best practice for scoping applications is to maintain the minimal privileges and most restrictive scopes necessary for an application to function as intended. This gives users fine-grained access control of applications and transparency into how an application is using their data. For example, a third-party application that only reads dashboard data does not need permissions to delete or manage users in an organization.

You may use scopes two ways with Datadog:

Scope OAuth2 clients for your Datadog Apps
Scope your application keys

AuthN Mappings, Logs Restriction Queries, Roles, Users

Scope name

Description

Endpoints that require this scope

user_access_manage

Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.

Create an AuthN Mapping
Delete an AuthN Mapping
Edit an AuthN Mapping
Create a restriction query
Delete a restriction query
Update a restriction query
Revoke role from a restriction query
Grant role to a restriction query
Create role
Delete role
Update a role
Create a new role by cloning an existing role
Revoke permission
Grant permission to a role
Remove a user from a role
Add a user to a role
Disable a user
Update a user

user_access_read

View users and their roles and settings.

List all users
List permissions
List roles
Get a role
List permissions for a role
Get all users of a role
List all users
Get user details
Get a user permissions

user_access_invite

Invite other users to your organization.

Create a user
Send invitation emails
Get a user invitation
Create a user

CI Visibility Pipelines, CI Visibility Tests

Scope name

Description

Endpoints that require this scope

ci_visibility_read

View CI Visibility.

Aggregate pipelines events
Get a list of pipelines events
Search pipelines events
Aggregate tests events
Get a list of tests events
Search tests events

Case Management

Scope name

Description

Endpoints that require this scope

cases_read

Read all cases data.

Search cases
Get all projects
Get the details of a project
Get the details of a case

cases_write

Create, update and delete cases data.

Create a case
Create a project
Remove a project
Archive case
Assign case
Update case priority
Update case status
Unarchive case
Unassign case

Dashboard Lists, Dashboards, Powerpack

Scope name

Description

Endpoints that require this scope

dashboards_read

View dashboards.

Get all dashboards
Get all dashboard lists
Get a dashboard list
Get a shared dashboard
Get a dashboard
Get items of a Dashboard List
Get all powerpacks
Get a Powerpack

dashboards_write

Create and change dashboards.

Delete dashboards
Restore deleted dashboards
Create a new dashboard
Create a dashboard list
Delete a dashboard list
Update a dashboard list
Delete a dashboard
Update a dashboard
Create a new powerpack
Delete a powerpack
Update a powerpack

dashboards_public_share

Generate public and authenticated links to share dashboards or embeddable graphs externally.

Create a shared dashboard
Revoke a shared dashboard URL
Update a shared dashboard
Revoke shared dashboard invitations
Get all invitations for a shared dashboard
Send shared dashboard invitation email

Downtimes, Monitors

Scope name

Description

Endpoints that require this scope

monitors_downtime

Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute hosts. The ability to write monitors is not required to set downtimes.

Schedule a downtime
Cancel downtimes by scope
Cancel a downtime
Update a downtime
Get all downtimes
Schedule a downtime
Cancel a downtime
Get a downtime
Update a downtime
Get active downtimes for a monitor

monitors_read

View monitors.

Get all downtimes
Get a downtime
Get all monitor details
Check if a monitor can be deleted
Monitors group search
Monitors search
Get a monitor's details
Get active downtimes for a monitor
Get all monitor configuration policies
Get a monitor configuration policy

monitors_write

Edit and delete individual monitors.

Create a monitor
Validate a monitor
Delete a monitor
Edit a monitor
Mute a monitor
Unmute a monitor
Validate an existing monitor

Events

Scope name

Description

Endpoints that require this scope

events_read

Read Events data.

Get a list of events
Get an event
Get a list of events
Search events

Incident Services, Incident Teams, Incidents

Scope name

Description

Endpoints that require this scope

incident_read

View incidents in Datadog.

Get a list of incidents
Search for incidents
Get the details of an incident
Get a list of attachments
Get a list of an incident's integration metadata
Get incident integration metadata details
Get a list of an incident's todos
Get incident todo details
Get a list of all incident services
Get details of an incident service
Get a list of all incident teams
Get details of an incident team

incident_settings_write

Configure Incident Settings.

Create a new incident service
Delete an existing incident service
Update an existing incident service
Create a new incident team
Delete an existing incident team
Update an existing incident team

incident_write

Create, view, and manage incidents in Datadog.

Create an incident
Delete an existing incident
Update an existing incident
Create an incident integration metadata
Delete an incident integration metadata
Update an existing incident integration metadata
Create an incident todo
Delete an incident todo
Update an incident todo

Metrics

Scope name

Description

Endpoints that require this scope

metrics_read

View custom metrics.

Get active metrics list
Get metric metadata
Get a list of metrics
List active tags and aggregations
List tags by metric name
List tag configuration by name

timeseries_query

Query Timeseries data.

Query timeseries points
Query scalar data across multiple products
Query timeseries data across multiple products

Security Monitoring

Scope name

Description

Endpoints that require this scope

security_monitoring_filters_read

Read Security Filters.

Get all security filters
Get a security filter

security_monitoring_filters_write

Create, edit, and delete Security Filters.

Create a security filter
Delete a security filter
Update a security filter

security_monitoring_findings_read

View CSPM Findings.

List findings
Get a finding

security_monitoring_rules_read

Read Detection Rules.

List rules
Get a rule's details

security_monitoring_rules_write

Create and edit Detection Rules.

Create a detection rule
Validate a detection rule
Delete an existing rule
Update an existing rule

security_monitoring_signals_read

View Security Signals.

Get a quick list of security signals
Get a list of security signals
Get a signal's details

security_monitoring_suppressions_read

Read Rule Suppressions.

Get all suppression rules
Get a suppression rule

security_monitoring_suppressions_write

Write Rule Suppressions.

Create a suppression rule
Delete a suppression rule
Update a suppression rule

Service Definition, Service Scorecards

Scope name

Description

Endpoints that require this scope

apm_service_catalog_read

View service catalog and service definitions.

List all rule outcomes
List all rules
Get all service definitions
Get a single service definition

apm_service_catalog_write

Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.

Create outcomes batch
Create a new rule
Delete a rule
Create or update service definition
Delete a single service definition

Service Level Objective Corrections, Service Level Objectives

Scope name

Description

Endpoints that require this scope

slos_corrections

Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.

Create an SLO correction

slos_read

View SLOs and status corrections.

Get all SLOs
Check if SLOs can be safely deleted
Get all SLO corrections
Search for SLOs
Get an SLO's details
Get Corrections For an SLO
Get an SLO's history
Create a new SLO report
Get SLO report
Get SLO report status

slos_write

Create, edit, and delete SLOs.

Create an SLO object
Bulk Delete SLO Timeframes
Delete an SLO
Update an SLO

Synthetics

Scope name

Description

Endpoints that require this scope

synthetics_global_variable_read

View, search, and use Synthetics global variables.

Get all global variables
Get a global variable

synthetics_global_variable_write

Create, edit, and delete global variables for Synthetics.

Create a global variable
Delete a global variable
Edit a global variable

synthetics_private_location_read

View, search, and use Synthetics private locations.

Get all locations (public and private)
Get a private location

synthetics_private_location_write

Create and delete private locations in addition to having access to the associated installation guidelines.

Create a private location
Delete a private location
Edit a private location

synthetics_read

List and view configured Synthetic tests and test results.

Get details of batch
Get the list of all Synthetic tests
Get an API test
Get a browser test
Get a browser test's latest results summaries
Get a browser test result
Get a test configuration
Get an API test's latest results summaries
Get an API test result

synthetics_write

Create, edit, and delete Synthetic tests.

Create a test
Create an API test
Edit an API test
Create a browser test
Edit a browser test
Delete tests
Trigger Synthetic tests
Trigger tests from CI/CD pipelines
Patch a Synthetic test
Edit a test
Pause or start a test

Teams

Scope name

Description

Endpoints that require this scope

teams_manage

Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.

Create a team
Remove a team

teams_read

Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.

Get all teams
Create a team
Remove a team
Get a team
Update a team
Get links for a team
Create a team link
Remove a team link
Get a team link
Update a team link
Get team memberships
Add a user to a team
Remove a user from a team
Update a user's membership attributes on a team
Get permission settings for a team
Update permission setting for team
Get user memberships

Usage Metering

Scope name

Description

Endpoints that require this scope

usage_read

View your organization's usage and usage attribution.

Webhooks Integration

Scope name

Description

Endpoints that require this scope

create_webhooks

Create webhooks integrations.

Create a webhooks integration