Skip to content

guides

Intended Documentation

Datadog Connector Setup (Beta)

Connect Intended to Datadog. Create an API key and an Application key, pick your Datadog site, and run Test connection. Host-pinned by site to the api.datadoghq.* hosts. Beta until validated against your live Datadog org.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

Datadog Connector Setup (Beta)#

Connect Intended to Datadog so approved intents can post events and mute monitors through the real Datadog v1 REST adapter (packages/execution-engine/src/adapters/datadog.ts). Every write is Authority-Token-verified and ESCALATEs for approval under the starter policy.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real Datadog org is pending — treat Datadog as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionsdatadog.event.create, datadog.monitor.mute
AuthDD-API-KEY + DD-APPLICATION-KEY headers
Pinned hosts (by site)api.datadoghq.com, api.us3.datadoghq.com, api.us5.datadoghq.com, api.datadoghq.eu, api.ap1.datadoghq.com, api.ddog-gov.com
Test connectionGET /api/v1/validate

The site you select maps to exactly one of those pinned API hosts. A stored baseUrl is honored only if it resolves to a known Datadog host; otherwise it fails closed.

Provider-side steps#

1. API key (apiKey, required)#

The API key sent as DD-API-KEY authorizes event submission and monitor writes.

  1. In Datadog, go to Organization Settings → API Keys.
  2. Click New Key, name it (e.g. intended-connector), and copy the key value.

2. Application key (applicationKey, required)#

The application key sent as DD-APPLICATION-KEY scopes the request to a user/service account's permissions.

  1. Go to Organization Settings → Application Keys.
  2. Click New Key and copy the value.
  3. Application keys inherit the permissions of the account (or the key's scopes if your org uses scoped application keys). Scope it to the minimum below.

3. Datadog site (site, required in the console)#

Your Datadog org lives in one region. Pick the matching site so the connector pins the correct host. In the adapter the site is optional and defaults to US1 (datadoghq.com), but the console presents it as a required select so you explicitly choose the region rather than silently defaulting.

Valid selector values (each maps to a pinned host):

Select valuePinned host
datadoghq.com (US1)api.datadoghq.com
us3api.us3.datadoghq.com
us5api.us5.datadoghq.com
datadoghq.eu (EU1)api.datadoghq.eu
ap1api.ap1.datadoghq.com
ddog-gov.com (US1-FED)api.ddog-gov.com

Least-privilege scope guidance#

  • Matrix scopes for this connector: events_write, monitors_write.
  • If your org uses scoped application keys, grant only events_write (for datadog.event.create) and monitors_write / monitors_downtime (for datadog.monitor.mute).
  • Do not use an application key tied to an admin account when a scoped key suffices.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → Datadog → Configure auth:

Field labelKeyRequiredValue
API KeyapiKeyYesDatadog org API key (sent as DD-API-KEY)
Application KeyapplicationKeyYesDatadog application key (sent as DD-APPLICATION-KEY)
Datadog SitesiteYes (console)Select your region from the list above

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter calls GET /api/v1/validate on your site's pinned host. A green result means both keys are valid and the region host resolved.

Next steps#

Datadog Connector Setup (Beta) | Intended