Authorization Scopes for OAuth Clients

Scopes are an authorization mechanism that allow you to limit and define the specific access applications have to an organization's Datadog data. When authorized to access data on behalf of a user or service account, applications can only access the information explicitly permitted by their assigned scopes.

ATTENTION

This page lists only the authorization scopes that can be assigned to OAuth clients. To view the full list of assignable permissions for scoped application keys, see Datadog Role Permissions.

OAuth clients → Can only be assigned authorization scopes (limited set).
Scoped application keys → Can be assigned any Datadog permission.

The best practice for scoping applications is to follow the principle of least privilege. Assign only the minimum scopes necessary for an application to function as intended. This enhances security and provides visibility into how applications interact with your organization's data. For example, a third-party application that only reads dashboards does not need permissions to delete or manage users.

You can use authorization scopes with OAuth2 clients for your Datadog Apps.

API Management, Synthetics

Scope name	Description	Endpoints that require this scope
`apm_api_catalog_read`	View API catalog and API definitions.	Get all global variables List APIs Get an API
`apm_api_catalog_write`	Add, modify, and delete API catalog definitions.	Delete an API Update an API Create a new API
`synthetics_global_variable_read`	View, search, and use Synthetics global variables.	Get all global variables Get a global variable
`synthetics_global_variable_write`	Create, edit, and delete global variables for Synthetics.	Create a global variable Delete a global variable Edit a global variable
`synthetics_private_location_read`	View, search, and use Synthetics private locations.	Get all locations (public and private) Get a private location
`synthetics_private_location_write`	Create and delete private locations in addition to having access to the associated installation guidelines.	Create a private location Delete a private location Edit a private location
`synthetics_read`	List and view configured Synthetic tests and test results.	Get details of batch Get the list of all Synthetic tests Get an API test Get a browser test Get a browser test's latest results summaries Get a browser test result Get a mobile test Search Synthetic tests Fetch uptime for multiple tests Get a test configuration Get an API test's latest results summaries Get an API test result Get available subtests for a multistep test Get parent tests for a subtest Search test suites Get a suite Get a browser test's latest results Get a fast test result Get a Network Path test Poll for test results Get a presigned URL for downloading a test file Get parent suites for a test Get a test's latest results Get a test result Get version history of a test Get a specific version of a test
`synthetics_write`	Create, edit, and delete Synthetic tests.	Create a test Create an API test Edit an API test Create a browser test Edit a browser test Delete tests Create a mobile test Edit a mobile test Trigger Synthetic tests Trigger tests from CI/CD pipelines Patch a Synthetic test Edit a test Pause or start a test Create a test suite Bulk delete suites Edit a test suite Patch a test suite Bulk delete tests Create a Network Path test Edit a Network Path test Get presigned URLs for uploading a test file Abort a multipart upload of a test file Complete a multipart upload of a test file

APM, APM Trace, Spans

Scope name	Description	Endpoints that require this scope
`apm_read`	Read and query APM and Trace Analytics.	Get service list Get a pruned trace by ID Aggregate spans Get a list of spans Search spans Get a trace by ID

Agentless Scanning, CI Visibility GitHub Accounts, Compliance, Customer Org, Domain Allowlist, Identity Providers, IP Allowlist, Organizations, Security Monitoring, Static Analysis

Scope name	Description	Endpoints that require this scope
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`security_monitoring_findings_read`	View a list of findings that include both misconfigurations and identity risks.	List AWS scan options Get AWS scan options List Azure scan options Get Azure scan options List GCP scan options Get GCP scan options List AWS on demand tasks Get AWS on demand task Get the rule-based view of compliance findings List findings Get a finding List security findings Search security findings
`ci_provider_settings_write`		Update GitHub CI Visibility status
`integrations_read`	View configured integrations and their settings.	List GitHub CI Visibility status List entity context sync configurations Get Entra ID Azure App Registration prerequisites Validate entity context sync credentials Get an entity context sync configuration Validate an entity context sync configuration
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist
`org_connections_write`	Create, edit, and delete cross organization connections.	List your managed organizations Create Org Connection Delete Org Connection Update Org Connection
`user_access_read`	View users and their roles and settings.	List all users Get all datasets Get a single dataset by ID List global orgs List permissions List roles List role templates Get a role List permissions for a role Get all users of a role Get user details Get a user permissions
`code_analysis_read`	View Code Analysis.	Post dependencies for analysis Submit libraries for vulnerability scanning Retrieve a dependency scan result POST request to resolve vulnerable symbols List codegen rulesets List Custom Rulesets Create Custom Ruleset Get default rulesets for a language Ruleset get multiple Get a SAST ruleset Returns a list of Secrets rules Analyze code Get AST for source code Get node types for a language Get tree-sitter WASM file
`logs_modify_indexes`	Modify log indexes, filters, exclusion filters, and configurations.	Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`logs_read_index_data`	Read indexed log data.	Get sample log generation subscriptions
`manage_integrations`	Install, uninstall, and configure integrations.	Create an entity context sync configuration Delete an entity context sync configuration Update an entity context sync configuration Activate an entity context sync integration Deactivate an entity context sync integration
`security_monitoring_critical_assets_read`	Read Critical Assets.	Get all critical assets Get critical assets affecting a specific rule Get a critical asset
`security_monitoring_critical_assets_write`	Write Critical Assets.	Create a critical asset Delete a critical asset Update a critical asset
`security_monitoring_filters_read`	Read Security Filters.	List resource filters Get all security filters Get the version history of security filters Get a security filter Get content pack states Get sample log generation subscriptions Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_filters_write`	Create, edit, and delete Security Filters.	Update resource filters Create a security filter Delete a security filter Update a security filter Activate content pack Deactivate content pack Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`security_monitoring_findings_write`		Import security vulnerabilities
`security_monitoring_notification_profiles_write`		Test a notification rule
`security_monitoring_rules_read`	Read Detection Rules.	Create a custom framework Delete a custom framework Get a custom framework Update a custom framework List batch migrations List batch migration resources List datasets Get dataset dependencies Get a dataset Get a dataset at a specific version Get the version history of a dataset List rules Bulk export security monitoring rules Bulk convert rules to Terraform Get a rule's details Convert an existing rule from JSON to Terraform Get investigation queries for a signal Get suggested actions for a signal Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform Get a job's details
`security_monitoring_rules_write`	Create and edit Detection Rules.	Create a custom framework Delete a custom framework Update a custom framework Create a batch migration Delete a batch migration Update a batch migration Cancel a batch migration Publish a batch migration Delete resources from a batch migration Add resources to a batch migration Update a batch migration resource Start a batch migration Create a dataset Delete a dataset Update a dataset Create a detection rule Bulk delete security monitoring rules Convert a rule from JSON to Terraform Test a rule Validate a detection rule Delete an existing rule Update an existing rule Restore a rule to a historical version Test an existing rule Run a historical job Cancel a historical job
`security_monitoring_signals_read`	View Security Signals.	List indicators of compromise Get an indicator of compromise Get signals matching an event Get a quick list of security signals Get a list of security signals Get a signal's details Get entities related to a signal Get investigation queries for a signal Get suggested actions for a signal List hist signals Search hist signals Get a hist signal's details Get a job's hist signals
`security_monitoring_signals_write`		Create or update an indicator triage state
`security_monitoring_suppressions_read`	Read Rule Suppressions.	Get all suppression rules Get suppressions affecting future rule Get suppressions affecting a specific rule Get a suppression rule Get a suppression's version history Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_suppressions_write`	Write Rule Suppressions.	Create a suppression rule Validate a suppression rule Delete a suppression rule Update a suppression rule
`siem_entities_read`	View Cloud SIEM entities.	Get entity context Get recently updated entity context Get a single entity context

Agentless Scanning, CI Visibility GitHub Accounts, Compliance, Security Monitoring, Static Analysis

Scope name	Description	Endpoints that require this scope
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`security_monitoring_findings_read`	View a list of findings that include both misconfigurations and identity risks.	List AWS scan options Get AWS scan options List Azure scan options Get Azure scan options List GCP scan options Get GCP scan options List AWS on demand tasks Get AWS on demand task Get the rule-based view of compliance findings List findings Get a finding List security findings Search security findings
`ci_provider_settings_write`		Update GitHub CI Visibility status
`integrations_read`	View configured integrations and their settings.	List GitHub CI Visibility status List entity context sync configurations Get Entra ID Azure App Registration prerequisites Validate entity context sync credentials Get an entity context sync configuration Validate an entity context sync configuration
`code_analysis_read`	View Code Analysis.	Post dependencies for analysis Submit libraries for vulnerability scanning Retrieve a dependency scan result POST request to resolve vulnerable symbols List codegen rulesets List Custom Rulesets Create Custom Ruleset Get default rulesets for a language Ruleset get multiple Get a SAST ruleset Returns a list of Secrets rules Analyze code Get AST for source code Get node types for a language Get tree-sitter WASM file
`logs_modify_indexes`	Modify log indexes, filters, exclusion filters, and configurations.	Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`logs_read_index_data`	Read indexed log data.	Get sample log generation subscriptions
`manage_integrations`	Install, uninstall, and configure integrations.	Create an entity context sync configuration Delete an entity context sync configuration Update an entity context sync configuration Activate an entity context sync integration Deactivate an entity context sync integration
`security_monitoring_critical_assets_read`	Read Critical Assets.	Get all critical assets Get critical assets affecting a specific rule Get a critical asset
`security_monitoring_critical_assets_write`	Write Critical Assets.	Create a critical asset Delete a critical asset Update a critical asset
`security_monitoring_filters_read`	Read Security Filters.	List resource filters Get all security filters Get the version history of security filters Get a security filter Get content pack states Get sample log generation subscriptions Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_filters_write`	Create, edit, and delete Security Filters.	Update resource filters Create a security filter Delete a security filter Update a security filter Activate content pack Deactivate content pack Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`security_monitoring_findings_write`		Import security vulnerabilities
`security_monitoring_notification_profiles_write`		Test a notification rule
`security_monitoring_rules_read`	Read Detection Rules.	Create a custom framework Delete a custom framework Get a custom framework Update a custom framework List batch migrations List batch migration resources List datasets Get dataset dependencies Get a dataset Get a dataset at a specific version Get the version history of a dataset List rules Bulk export security monitoring rules Bulk convert rules to Terraform Get a rule's details Convert an existing rule from JSON to Terraform Get investigation queries for a signal Get suggested actions for a signal Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform Get a job's details
`security_monitoring_rules_write`	Create and edit Detection Rules.	Create a custom framework Delete a custom framework Update a custom framework Create a batch migration Delete a batch migration Update a batch migration Cancel a batch migration Publish a batch migration Delete resources from a batch migration Add resources to a batch migration Update a batch migration resource Start a batch migration Create a dataset Delete a dataset Update a dataset Create a detection rule Bulk delete security monitoring rules Convert a rule from JSON to Terraform Test a rule Validate a detection rule Delete an existing rule Update an existing rule Restore a rule to a historical version Test an existing rule Run a historical job Cancel a historical job
`security_monitoring_signals_read`	View Security Signals.	List indicators of compromise Get an indicator of compromise Get signals matching an event Get a quick list of security signals Get a list of security signals Get a signal's details Get entities related to a signal Get investigation queries for a signal Get suggested actions for a signal List hist signals Search hist signals Get a hist signal's details Get a job's hist signals
`security_monitoring_signals_write`		Create or update an indicator triage state
`security_monitoring_suppressions_read`	Read Rule Suppressions.	Get all suppression rules Get suppressions affecting future rule Get suppressions affecting a specific rule Get a suppression rule Get a suppression's version history Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_suppressions_write`	Write Rule Suppressions.	Create a suppression rule Validate a suppression rule Delete a suppression rule Update a suppression rule
`siem_entities_read`	View Cloud SIEM entities.	Get entity context Get recently updated entity context Get a single entity context

Agentless Scanning, Compliance, Customer Org, Data Observability, Datasets, Domain Allowlist, Identity Providers, IP Allowlist, Monitors, Org Connections, Organizations, Roles, Security Monitoring, Users

Scope name	Description	Endpoints that require this scope
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`security_monitoring_findings_read`	View a list of findings that include both misconfigurations and identity risks.	List AWS scan options Get AWS scan options List Azure scan options Get Azure scan options List GCP scan options Get GCP scan options List AWS on demand tasks Get AWS on demand task Get the rule-based view of compliance findings List findings Get a finding List security findings Search security findings
`data_observability_monitors_write`		Get data observability monitor run status Run a data observability monitor
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist
`user_access_manage`	Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.	Anonymize users Create a dataset Delete a dataset Edit a dataset Create role Delete role Update a role Create a new role by cloning an existing role Revoke permission Grant permission to a role Remove a user from a role Add a user to a role Disable a user Update a user Get identity provider overrides for a user Update identity provider overrides for a user
`user_access_read`	View users and their roles and settings.	List all users Get all datasets Get a single dataset by ID List global orgs List permissions List roles List role templates Get a role List permissions for a role Get all users of a role Get user details Get a user permissions
`monitors_draft_write`	Create, edit, and delete draft monitors. Does not allow editing live monitors or publishing drafts to production.	Create a monitor Delete a monitor Edit a monitor
`monitors_read`	View monitors.	Get all downtimes Get a downtime Get all monitors Check if a monitor can be deleted Monitors group search Monitors search Validate a monitor Get a monitor's details Get active downtimes for a monitor Validate an existing monitor Get all monitor notification rules Get a monitor notification rule Get all monitor configuration policies Get a monitor configuration policy Get all monitor user templates Get a monitor user template
`org_connections_read`	Read cross organization connections.	List Org Connections
`org_connections_write`	Create, edit, and delete cross organization connections.	List your managed organizations Create Org Connection Delete Org Connection Update Org Connection
`code_analysis_read`	View Code Analysis.	Post dependencies for analysis Submit libraries for vulnerability scanning Retrieve a dependency scan result POST request to resolve vulnerable symbols List codegen rulesets List Custom Rulesets Create Custom Ruleset Get default rulesets for a language Ruleset get multiple Get a SAST ruleset Returns a list of Secrets rules Analyze code Get AST for source code Get node types for a language Get tree-sitter WASM file
`integrations_read`	View configured integrations and their settings.	List GitHub CI Visibility status List entity context sync configurations Get Entra ID Azure App Registration prerequisites Validate entity context sync credentials Get an entity context sync configuration Validate an entity context sync configuration
`logs_modify_indexes`	Modify log indexes, filters, exclusion filters, and configurations.	Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`logs_read_index_data`	Read indexed log data.	Get sample log generation subscriptions
`manage_integrations`	Install, uninstall, and configure integrations.	Create an entity context sync configuration Delete an entity context sync configuration Update an entity context sync configuration Activate an entity context sync integration Deactivate an entity context sync integration
`security_monitoring_critical_assets_read`	Read Critical Assets.	Get all critical assets Get critical assets affecting a specific rule Get a critical asset
`security_monitoring_critical_assets_write`	Write Critical Assets.	Create a critical asset Delete a critical asset Update a critical asset
`security_monitoring_filters_read`	Read Security Filters.	List resource filters Get all security filters Get the version history of security filters Get a security filter Get content pack states Get sample log generation subscriptions Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_filters_write`	Create, edit, and delete Security Filters.	Update resource filters Create a security filter Delete a security filter Update a security filter Activate content pack Deactivate content pack Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`security_monitoring_findings_write`		Import security vulnerabilities
`security_monitoring_notification_profiles_write`		Test a notification rule
`security_monitoring_rules_read`	Read Detection Rules.	Create a custom framework Delete a custom framework Get a custom framework Update a custom framework List batch migrations List batch migration resources List datasets Get dataset dependencies Get a dataset Get a dataset at a specific version Get the version history of a dataset List rules Bulk export security monitoring rules Bulk convert rules to Terraform Get a rule's details Convert an existing rule from JSON to Terraform Get investigation queries for a signal Get suggested actions for a signal Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform Get a job's details
`security_monitoring_rules_write`	Create and edit Detection Rules.	Create a custom framework Delete a custom framework Update a custom framework Create a batch migration Delete a batch migration Update a batch migration Cancel a batch migration Publish a batch migration Delete resources from a batch migration Add resources to a batch migration Update a batch migration resource Start a batch migration Create a dataset Delete a dataset Update a dataset Create a detection rule Bulk delete security monitoring rules Convert a rule from JSON to Terraform Test a rule Validate a detection rule Delete an existing rule Update an existing rule Restore a rule to a historical version Test an existing rule Run a historical job Cancel a historical job
`security_monitoring_signals_read`	View Security Signals.	List indicators of compromise Get an indicator of compromise Get signals matching an event Get a quick list of security signals Get a list of security signals Get a signal's details Get entities related to a signal Get investigation queries for a signal Get suggested actions for a signal List hist signals Search hist signals Get a hist signal's details Get a job's hist signals
`security_monitoring_signals_write`		Create or update an indicator triage state
`security_monitoring_suppressions_read`	Read Rule Suppressions.	Get all suppression rules Get suppressions affecting future rule Get suppressions affecting a specific rule Get a suppression rule Get a suppression's version history Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_suppressions_write`	Write Rule Suppressions.	Create a suppression rule Validate a suppression rule Delete a suppression rule Update a suppression rule
`siem_entities_read`	View Cloud SIEM entities.	Get entity context Get recently updated entity context Get a single entity context
`user_access_invite`	Invite other users to your organization.	Send invitation emails Get a user invitation Create a user Delete a pending user's invitations

Agentless Scanning, Customer Org, Data Observability, Domain Allowlist, Downtimes, Identity Providers, IP Allowlist, Monitors, Organizations

Scope name	Description	Endpoints that require this scope
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`security_monitoring_findings_read`	View a list of findings that include both misconfigurations and identity risks.	List AWS scan options Get AWS scan options List Azure scan options Get Azure scan options List GCP scan options Get GCP scan options List AWS on demand tasks Get AWS on demand task Get the rule-based view of compliance findings List findings Get a finding List security findings Search security findings
`data_observability_monitors_write`		Get data observability monitor run status Run a data observability monitor
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist
`monitors_downtime`	Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.	Schedule a downtime Cancel downtimes by scope Cancel a downtime Update a downtime Get all downtimes Get a downtime Get active downtimes for a monitor
`monitors_read`	View monitors.	Get all downtimes Get a downtime Get all monitors Check if a monitor can be deleted Monitors group search Monitors search Validate a monitor Get a monitor's details Get active downtimes for a monitor Validate an existing monitor Get all monitor notification rules Get a monitor notification rule Get all monitor configuration policies Get a monitor configuration policy Get all monitor user templates Get a monitor user template
`monitors_draft_write`	Create, edit, and delete draft monitors. Does not allow editing live monitors or publishing drafts to production.	Create a monitor Delete a monitor Edit a monitor
`org_connections_write`	Create, edit, and delete cross organization connections.	List your managed organizations Create Org Connection Delete Org Connection Update Org Connection
`user_access_read`	View users and their roles and settings.	List all users Get all datasets Get a single dataset by ID List global orgs List permissions List roles List role templates Get a role List permissions for a role Get all users of a role Get user details Get a user permissions

Agentless Scanning, Customer Org, Datasets, Domain Allowlist, Identity Providers, IP Allowlist, Org Connections, Organizations, Roles, Users

Scope name	Description	Endpoints that require this scope
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`security_monitoring_findings_read`	View a list of findings that include both misconfigurations and identity risks.	List AWS scan options Get AWS scan options List Azure scan options Get Azure scan options List GCP scan options Get GCP scan options List AWS on demand tasks Get AWS on demand task Get the rule-based view of compliance findings List findings Get a finding List security findings Search security findings
`user_access_manage`	Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.	Anonymize users Create a dataset Delete a dataset Edit a dataset Create role Delete role Update a role Create a new role by cloning an existing role Revoke permission Grant permission to a role Remove a user from a role Add a user to a role Disable a user Update a user Get identity provider overrides for a user Update identity provider overrides for a user
`user_access_read`	View users and their roles and settings.	List all users Get all datasets Get a single dataset by ID List global orgs List permissions List roles List role templates Get a role List permissions for a role Get all users of a role Get user details Get a user permissions
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist
`org_connections_read`	Read cross organization connections.	List Org Connections
`org_connections_write`	Create, edit, and delete cross organization connections.	List your managed organizations Create Org Connection Delete Org Connection Update Org Connection
`user_access_invite`	Invite other users to your organization.	Send invitation emails Get a user invitation Create a user Delete a pending user's invitations

Bits AI

Scope name	Description	Endpoints that require this scope
`bits_investigations_read`	View Bits AI investigations.	List Bits AI investigations Get a Bits AI investigation
`bits_investigations_write`	Create and manage Bits AI investigations.	Trigger a Bits AI investigation

CI Visibility GitHub Accounts, Security Monitoring

Scope name	Description	Endpoints that require this scope
`ci_provider_settings_write`		Update GitHub CI Visibility status
`integrations_read`	View configured integrations and their settings.	List GitHub CI Visibility status List entity context sync configurations Get Entra ID Azure App Registration prerequisites Validate entity context sync credentials Get an entity context sync configuration Validate an entity context sync configuration
`code_analysis_read`	View Code Analysis.	Post dependencies for analysis Submit libraries for vulnerability scanning Retrieve a dependency scan result POST request to resolve vulnerable symbols List codegen rulesets List Custom Rulesets Create Custom Ruleset Get default rulesets for a language Ruleset get multiple Get a SAST ruleset Returns a list of Secrets rules Analyze code Get AST for source code Get node types for a language Get tree-sitter WASM file
`logs_modify_indexes`	Modify log indexes, filters, exclusion filters, and configurations.	Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`logs_read_index_data`	Read indexed log data.	Get sample log generation subscriptions
`manage_integrations`	Install, uninstall, and configure integrations.	Create an entity context sync configuration Delete an entity context sync configuration Update an entity context sync configuration Activate an entity context sync integration Deactivate an entity context sync integration
`security_monitoring_critical_assets_read`	Read Critical Assets.	Get all critical assets Get critical assets affecting a specific rule Get a critical asset
`security_monitoring_critical_assets_write`	Write Critical Assets.	Create a critical asset Delete a critical asset Update a critical asset
`security_monitoring_filters_read`	Read Security Filters.	List resource filters Get all security filters Get the version history of security filters Get a security filter Get content pack states Get sample log generation subscriptions Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_filters_write`	Create, edit, and delete Security Filters.	Update resource filters Create a security filter Delete a security filter Update a security filter Activate content pack Deactivate content pack Subscribe to sample log generation Bulk subscribe to sample log generation Unsubscribe from sample log generation
`security_monitoring_findings_read`	View a list of findings that include both misconfigurations and identity risks.	List AWS scan options Get AWS scan options List Azure scan options Get Azure scan options List GCP scan options Get GCP scan options List AWS on demand tasks Get AWS on demand task Get the rule-based view of compliance findings List findings Get a finding List security findings Search security findings
`security_monitoring_findings_write`		Import security vulnerabilities
`security_monitoring_notification_profiles_write`		Test a notification rule
`security_monitoring_rules_read`	Read Detection Rules.	Create a custom framework Delete a custom framework Get a custom framework Update a custom framework List batch migrations List batch migration resources List datasets Get dataset dependencies Get a dataset Get a dataset at a specific version Get the version history of a dataset List rules Bulk export security monitoring rules Bulk convert rules to Terraform Get a rule's details Convert an existing rule from JSON to Terraform Get investigation queries for a signal Get suggested actions for a signal Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform Get a job's details
`security_monitoring_rules_write`	Create and edit Detection Rules.	Create a custom framework Delete a custom framework Update a custom framework Create a batch migration Delete a batch migration Update a batch migration Cancel a batch migration Publish a batch migration Delete resources from a batch migration Add resources to a batch migration Update a batch migration resource Start a batch migration Create a dataset Delete a dataset Update a dataset Create a detection rule Bulk delete security monitoring rules Convert a rule from JSON to Terraform Test a rule Validate a detection rule Delete an existing rule Update an existing rule Restore a rule to a historical version Test an existing rule Run a historical job Cancel a historical job
`security_monitoring_signals_read`	View Security Signals.	List indicators of compromise Get an indicator of compromise Get signals matching an event Get a quick list of security signals Get a list of security signals Get a signal's details Get entities related to a signal Get investigation queries for a signal Get suggested actions for a signal List hist signals Search hist signals Get a hist signal's details Get a job's hist signals
`security_monitoring_signals_write`		Create or update an indicator triage state
`security_monitoring_suppressions_read`	Read Rule Suppressions.	Get all suppression rules Get suppressions affecting future rule Get suppressions affecting a specific rule Get a suppression rule Get a suppression's version history Export security monitoring resources to Terraform Convert security monitoring resource to Terraform Export security monitoring resource to Terraform
`security_monitoring_suppressions_write`	Write Rule Suppressions.	Create a suppression rule Validate a suppression rule Delete a suppression rule Update a suppression rule
`siem_entities_read`	View Cloud SIEM entities.	Get entity context Get recently updated entity context Get a single entity context

CI Visibility Pipelines, CI Visibility Tests, Test Optimization

Scope name	Description	Endpoints that require this scope
`ci_visibility_read`	View CI Visibility.	Aggregate pipelines events Get a list of pipelines events Search pipelines events Aggregate tests events Get a list of tests events Search tests events
`test_optimization_read`	View Test Optimization.	Get Flaky Tests Management policies Get Test Optimization service settings Aggregate tests events Get a list of tests events Search tests events Search flaky tests
`test_optimization_settings_write`	Update service settings in Test Optimization.	Update Flaky Tests Management policies Delete Test Optimization service settings Update Test Optimization service settings
`test_optimization_write`	Update flaky tests from Flaky Tests Management of Test Optimization.	Update flaky test states

CI Visibility Tests, Test Optimization

Scope name	Description	Endpoints that require this scope
`ci_visibility_read`	View CI Visibility.	Aggregate pipelines events Get a list of pipelines events Search pipelines events Aggregate tests events Get a list of tests events Search tests events
`test_optimization_read`	View Test Optimization.	Get Flaky Tests Management policies Get Test Optimization service settings Aggregate tests events Get a list of tests events Search tests events Search flaky tests
`test_optimization_settings_write`	Update service settings in Test Optimization.	Update Flaky Tests Management policies Delete Test Optimization service settings Update Test Optimization service settings
`test_optimization_write`	Update flaky tests from Flaky Tests Management of Test Optimization.	Update flaky test states

Case Management Attribute, Case Management Type

Scope name	Description	Endpoints that require this scope
`cases_shared_settings_write`	Update shared case management settings.	Update a case type Update custom attribute config

Case Management, Change Management, Error Tracking, Scorecards

Scope name	Description	Endpoints that require this scope
`cases_read`	View Cases.	Search cases Aggregate cases Count cases List case links Get all projects List project favorites Get the details of a project Get notification rules List automation rules Get an automation rule List case views Get a case view Get the details of a case Get case timeline List case watchers Get a change request Remove the assignee of an issue Update the assignee of an issue List all campaigns Get a campaign
`cases_write`	Create and update cases.	Create a case Bulk update cases Create a case link Delete a case link Create a project Remove a project Update a project Unfavorite a project Favorite a project Create a notification rule Delete a notification rule Update a notification rule Create an automation rule Delete an automation rule Update an automation rule Disable an automation rule Enable an automation rule Create a case view Delete a case view Update a case view Archive case Assign case Update case attributes Update case comment Delete custom attribute from case Update case custom attribute Update case description Update case due date Remove insights from a case Add insights to a case Update case priority Link incident to case Remove Jira issue link from case Link existing Jira issue to case Create Jira issue for case Create investigation notebook for case Update case project Create ServiceNow ticket for case Update case resolved reason Update case status Update case title Unarchive case Unassign case Unwatch a case Watch a case Create a change request Update a change request Create a change request branch Delete a change request decision Update a change request decision Remove the assignee of an issue Update the assignee of an issue Create a new campaign Delete a campaign Update a campaign
`event_correlation_config_read`	View event correlation configurations.	List maintenance windows
`event_correlation_config_write`	Create and update event correlation configurations.	Create a maintenance window Delete a maintenance window Update a maintenance window
`error_tracking_read`	Read Error Tracking data.	Search error tracking issues Get the details of an error tracking issue Remove the assignee of an issue Update the assignee of an issue Update the state of an issue
`error_tracking_write`	Edit Error Tracking issues.	Remove the assignee of an issue Update the assignee of an issue Update the state of an issue
`apm_service_catalog_read`	View service catalog and service definitions.	Get a list of entities Preview catalog entities Get a list of entity kinds Get a list of entity relations List all campaigns Get a campaign List all rule outcomes List all rules List all scorecards List all scores Get all service definitions Get a single service definition
`apm_service_catalog_write`	Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.	Create or update entities Delete a single entity Create or update kinds Delete a single kind Create a new campaign Delete a campaign Update a campaign Update Scorecard outcomes Create outcomes batch Create a new rule Delete a rule Update an existing scorecard rule Create or update service definition Delete a single service definition

Case Management, Change Management, Error Tracking, Scorecards, Service Definition, Software Catalog

Scope name	Description	Endpoints that require this scope
`cases_read`	View Cases.	Search cases Aggregate cases Count cases List case links Get all projects List project favorites Get the details of a project Get notification rules List automation rules Get an automation rule List case views Get a case view Get the details of a case Get case timeline List case watchers Get a change request Remove the assignee of an issue Update the assignee of an issue List all campaigns Get a campaign
`cases_write`	Create and update cases.	Create a case Bulk update cases Create a case link Delete a case link Create a project Remove a project Update a project Unfavorite a project Favorite a project Create a notification rule Delete a notification rule Update a notification rule Create an automation rule Delete an automation rule Update an automation rule Disable an automation rule Enable an automation rule Create a case view Delete a case view Update a case view Archive case Assign case Update case attributes Update case comment Delete custom attribute from case Update case custom attribute Update case description Update case due date Remove insights from a case Add insights to a case Update case priority Link incident to case Remove Jira issue link from case Link existing Jira issue to case Create Jira issue for case Create investigation notebook for case Update case project Create ServiceNow ticket for case Update case resolved reason Update case status Update case title Unarchive case Unassign case Unwatch a case Watch a case Create a change request Update a change request Create a change request branch Delete a change request decision Update a change request decision Remove the assignee of an issue Update the assignee of an issue Create a new campaign Delete a campaign Update a campaign
`event_correlation_config_read`	View event correlation configurations.	List maintenance windows
`event_correlation_config_write`	Create and update event correlation configurations.	Create a maintenance window Delete a maintenance window Update a maintenance window
`error_tracking_read`	Read Error Tracking data.	Search error tracking issues Get the details of an error tracking issue Remove the assignee of an issue Update the assignee of an issue Update the state of an issue
`error_tracking_write`	Edit Error Tracking issues.	Remove the assignee of an issue Update the assignee of an issue Update the state of an issue
`apm_service_catalog_read`	View service catalog and service definitions.	Get a list of entities Preview catalog entities Get a list of entity kinds Get a list of entity relations List all campaigns Get a campaign List all rule outcomes List all rules List all scorecards List all scores Get all service definitions Get a single service definition
`apm_service_catalog_write`	Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.	Create or update entities Delete a single entity Create or update kinds Delete a single kind Create a new campaign Delete a campaign Update a campaign Update Scorecard outcomes Create outcomes batch Create a new rule Delete a rule Update an existing scorecard rule Create or update service definition Delete a single service definition

Cloud Cost Management

Scope name	Description	Endpoints that require this scope
`cloud_cost_management_read`	View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.	Get account filters List cost anomalies Get cost anomaly List custom allocation rules List custom allocation rule statuses Get custom allocation rule List Cloud Cost Management AWS CUR configs Get cost AWS CUR config List Cloud Cost Management Azure configs Get cost Azure UC config List Cloud Cost Management cloud accounts Get commitments list Get commitments coverage (scalar) Get commitments coverage (timeseries) Get commitments on-demand hot spots (scalar) Get commitments savings (scalar) Get commitments savings (timeseries) Get commitments utilization (scalar) Get commitments utilization (timeseries) List Custom Costs files Get Custom Costs file List Google Cloud Usage Cost configs Get Google Cloud Usage Cost config List Cloud Cost Management OCI configs Search cost recommendations List Cloud Cost Management tag descriptions Get a Cloud Cost Management tag description Generate a Cloud Cost Management tag description List Cloud Cost Management tag keys Get a Cloud Cost Management tag key List Cloud Cost Management tag key metadata Get the Cloud Cost Management billing currency List available Cloud Cost Management metrics List Cloud Cost Management tag metadata months List Cloud Cost Management orchestrators List Cloud Cost Management tag sources List Cloud Cost Management tags List tag pipeline rulesets List tag pipeline ruleset statuses Validate query Get a tag pipeline ruleset
`cloud_cost_management_write`	Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.	Update account filters Create custom allocation rule Reorder custom allocation rules Delete custom allocation rule Update custom allocation rule Create Cloud Cost Management AWS CUR config Delete Cloud Cost Management AWS CUR config Update Cloud Cost Management AWS CUR config Create Cloud Cost Management Azure configs Delete Cloud Cost Management Azure config Update Cloud Cost Management Azure config Upload Custom Costs file Delete Custom Costs file Create Google Cloud Usage Cost config Delete Google Cloud Usage Cost config Update Google Cloud Usage Cost config Delete a Cloud Cost Management tag description Upsert a Cloud Cost Management tag description Create tag pipeline ruleset Reorder tag pipeline rulesets Delete tag pipeline ruleset Update tag pipeline ruleset

Cloud Network Monitoring

Scope name	Description	Endpoints that require this scope
`network_connections_read`	Read cloud network connections.	Get all aggregated connections Get all aggregated DNS traffic

Code Coverage

Scope name	Description	Endpoints that require this scope
`code_coverage_read`	View Code Coverage.	Get code coverage summary for a branch Get code coverage summary for a commit Get per-file code coverage data Get code coverage summary for a pull request

DDSQL, Events, Governance Console, Metrics, Timeseries Anomaly Investigations

Scope name	Description	Endpoints that require this scope
`timeseries_query`	Query Timeseries data.	Query timeseries points Execute a tabular DDSQL query Fetch the result of a DDSQL query Query scalar data across multiple products Query timeseries data across multiple products Investigate a timeseries anomaly
`events_read`	Read Events data.	Get a list of events Get an event Search events List insights
`metrics_read`	View custom metrics.	Get active metrics list Get metric metadata Search metrics List insights Get a list of metrics Get a derived metric Get a historical metrics configuration List tag indexing rules Get a tag indexing rule List tags by metric name Get a tag indexing rule exemption List tag indexing rules for a metric List tag configuration by name Investigate a timeseries anomaly
`late_metrics_config_write`		Enable historical metrics ingestion Delete a historical metrics configuration
`metric_tags_write`		Create a derived metric Delete a derived metric Update a derived metric Create a tag indexing rule Reorder tag indexing rules Delete a tag indexing rule Update a tag indexing rule Delete a tag indexing rule exemption Create a tag indexing rule exemption

DDSQL, Governance Console, Metrics, Timeseries Anomaly Investigations

Scope name	Description	Endpoints that require this scope
`timeseries_query`	Query Timeseries data.	Query timeseries points Execute a tabular DDSQL query Fetch the result of a DDSQL query Query scalar data across multiple products Query timeseries data across multiple products Investigate a timeseries anomaly
`events_read`	Read Events data.	Get a list of events Get an event Search events List insights
`metrics_read`	View custom metrics.	Get active metrics list Get metric metadata Search metrics List insights Get a list of metrics Get a derived metric Get a historical metrics configuration List tag indexing rules Get a tag indexing rule List tags by metric name Get a tag indexing rule exemption List tag indexing rules for a metric List tag configuration by name Investigate a timeseries anomaly
`late_metrics_config_write`		Enable historical metrics ingestion Delete a historical metrics configuration
`metric_tags_write`		Create a derived metric Delete a derived metric Update a derived metric Create a tag indexing rule Reorder tag indexing rules Delete a tag indexing rule Update a tag indexing rule Delete a tag indexing rule exemption Create a tag indexing rule exemption

Dashboard Lists, Dashboard Secure Embed, Dashboard Sharing, Dashboards, Powerpack

Scope name	Description	Endpoints that require this scope
`dashboards_read`	View dashboards.	Get all dashboards Get all dashboard lists Get a dashboard list Get a shared dashboard Get a dashboard Get items of a Dashboard List List shared dashboards for a dashboard Get a secure embed for a dashboard Get usage stats for all dashboards Get usage stats for a dashboard Get all powerpacks Get a Powerpack
`dashboards_write`	Create and change dashboards.	Delete dashboards Restore deleted dashboards Create a new dashboard Create a dashboard list Delete a dashboard list Update a dashboard list Delete a dashboard Update a dashboard Create a new powerpack Delete a powerpack Update a powerpack
`dashboards_embed_share`	Create, modify, and delete shared dashboards with share type 'embed'.	Create a shared dashboard Revoke a shared dashboard URL Update a shared dashboard Create a secure embed for a dashboard Delete a secure embed for a dashboard Update a secure embed for a dashboard
`dashboards_invite_share`	Create, modify, and delete shared dashboards with share type 'invite'.	Create a shared dashboard Revoke a shared dashboard URL Update a shared dashboard Revoke shared dashboard invitations Get all invitations for a shared dashboard Send shared dashboard invitation email
`dashboards_public_share`	Generate public and authenticated links to share dashboards or embeddable graphs externally.	Create a shared dashboard Revoke a shared dashboard URL Update a shared dashboard

Data Observability, Domain Allowlist, Downtimes, Monitors

Scope name	Description	Endpoints that require this scope
`data_observability_monitors_write`		Get data observability monitor run status Run a data observability monitor
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`monitors_downtime`	Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.	Schedule a downtime Cancel downtimes by scope Cancel a downtime Update a downtime Get all downtimes Get a downtime Get active downtimes for a monitor
`monitors_read`	View monitors.	Get all downtimes Get a downtime Get all monitors Check if a monitor can be deleted Monitors group search Monitors search Validate a monitor Get a monitor's details Get active downtimes for a monitor Validate an existing monitor Get all monitor notification rules Get a monitor notification rule Get all monitor configuration policies Get a monitor configuration policy Get all monitor user templates Get a monitor user template
`monitors_draft_write`	Create, edit, and delete draft monitors. Does not allow editing live monitors or publishing drafts to production.	Create a monitor Delete a monitor Edit a monitor

Data Observability, Domain Allowlist, Monitors

Scope name	Description	Endpoints that require this scope
`data_observability_monitors_write`		Get data observability monitor run status Run a data observability monitor
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`monitors_draft_write`	Create, edit, and delete draft monitors. Does not allow editing live monitors or publishing drafts to production.	Create a monitor Delete a monitor Edit a monitor
`monitors_read`	View monitors.	Get all downtimes Get a downtime Get all monitors Check if a monitor can be deleted Monitors group search Monitors search Validate a monitor Get a monitor's details Get active downtimes for a monitor Validate an existing monitor Get all monitor notification rules Get a monitor notification rule Get all monitor configuration policies Get a monitor configuration policy Get all monitor user templates Get a monitor user template

Datasets, Organizations, Roles, Users

Scope name	Description	Endpoints that require this scope
`user_access_manage`	Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.	Anonymize users Create a dataset Delete a dataset Edit a dataset Create role Delete role Update a role Create a new role by cloning an existing role Revoke permission Grant permission to a role Remove a user from a role Add a user to a role Disable a user Update a user Get identity provider overrides for a user Update identity provider overrides for a user
`user_access_read`	View users and their roles and settings.	List all users Get all datasets Get a single dataset by ID List global orgs List permissions List roles List role templates Get a role List permissions for a role Get all users of a role Get user details Get a user permissions
`org_connections_write`	Create, edit, and delete cross organization connections.	List your managed organizations Create Org Connection Delete Org Connection Update Org Connection
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`user_access_invite`	Invite other users to your organization.	Send invitation emails Get a user invitation Create a user Delete a pending user's invitations

Deployment Gates

Scope name	Description	Endpoints that require this scope
`deployment_gates_read`		List deployment gate evaluations List deployment gate rule evaluations

Downtimes, Monitors

Scope name	Description	Endpoints that require this scope
`monitors_downtime`	Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.	Schedule a downtime Cancel downtimes by scope Cancel a downtime Update a downtime Get all downtimes Get a downtime Get active downtimes for a monitor
`monitors_read`	View monitors.	Get all downtimes Get a downtime Get all monitors Check if a monitor can be deleted Monitors group search Monitors search Validate a monitor Get a monitor's details Get active downtimes for a monitor Validate an existing monitor Get all monitor notification rules Get a monitor notification rule Get all monitor configuration policies Get a monitor configuration policy Get all monitor user templates Get a monitor user template
`monitors_draft_write`	Create, edit, and delete draft monitors. Does not allow editing live monitors or publishing drafts to production.	Create a monitor Delete a monitor Edit a monitor
`monitors_write`	Edit, delete, and resolve individual monitors.	Create a monitor Delete a monitor Edit a monitor Mute a monitor Unmute a monitor Get data observability monitor run status Run a data observability monitor Get Domain Allowlist Sets Domain Allowlist

Events, Governance Console, Metrics, Timeseries Anomaly Investigations

Scope name	Description	Endpoints that require this scope
`events_read`	Read Events data.	Get a list of events Get an event Search events List insights
`metrics_read`	View custom metrics.	Get active metrics list Get metric metadata Search metrics List insights Get a list of metrics Get a derived metric Get a historical metrics configuration List tag indexing rules Get a tag indexing rule List tags by metric name Get a tag indexing rule exemption List tag indexing rules for a metric List tag configuration by name Investigate a timeseries anomaly
`late_metrics_config_write`		Enable historical metrics ingestion Delete a historical metrics configuration
`metric_tags_write`		Create a derived metric Delete a derived metric Update a derived metric Create a tag indexing rule Reorder tag indexing rules Delete a tag indexing rule Update a tag indexing rule Delete a tag indexing rule exemption Create a tag indexing rule exemption
`timeseries_query`	Query Timeseries data.	Query timeseries points Execute a tabular DDSQL query Fetch the result of a DDSQL query Query scalar data across multiple products Query timeseries data across multiple products Investigate a timeseries anomaly

Experiments

Scope name	Description	Endpoints that require this scope
`product_analytics_experiments_read`	View Product Analytics Experiments.	List experiments List experiment protocols Get experiment protocol Get experiment Get experiment analysis plan Get experiment diagnostics List experiment metric groups Get experiment results Get experiment traffic summary
`product_analytics_experiments_write`	Create, edit, and delete Product Analytics Experiments.	Create experiment Refresh experiment results for org Delete experiment Patch experiment Update experiment analysis plan attributes Cancel experiment Conclude experiment Create experiment metric group Create experiment metric group from collection Delete experiment metric group Update experiment metric group Refresh experiment results Start experiment
`product_analytics_metrics_read`	View Product Analytics Metrics.	List exposure SQL models Get exposure SQL model List metric collections Get metric collection List metric SQL models Get metric SQL model List metrics Get metric
`product_analytics_metrics_write`	Create, edit, and delete Product Analytics Metrics.	Create metric collection Delete metric collection Update metric collection Create metric Delete metric Update metric
`product_analytics_settings_read`	View Product Analytics Settings.	List subject types Get subject type
`product_analytics_settings_write`	Edit Product Analytics Settings.	Create subject type Delete subject type Patch subject type Set default subject type
`product_analytics_warehouse_model_write`	Create, edit, and delete Product Analytics Warehouse Models.	Create exposure SQL model Update exposure SQL model Archive exposure SQL model Unarchive exposure SQL model Create metric SQL model Update metric SQL model

Feature Flags

Scope name	Description	Endpoints that require this scope
`feature_flag_config_read`	View Feature Flag Configurations.	List feature flags Get a saved filter Get a feature flag
`feature_flag_config_write`	Edit Feature Flag Configurations.	Create a feature flag Pause a progressive rollout Resume a progressive rollout Start a progressive rollout Stop a progressive rollout Patch a saved filter Update a feature flag Archive a feature flag Create targeting rules for a flag env Update targeting rules for a flag Disable a feature flag in an environment Enable a feature flag in an environment Unarchive a feature flag Add a variant to a feature flag Delete a variant Update a variant
`feature_flag_environment_config_read`	View Feature Flag Environment settings.	List feature flags Create a feature flag List environments Get an environment Get a feature flag Update a feature flag Archive a feature flag Disable a feature flag in an environment Enable a feature flag in an environment Unarchive a feature flag
`feature_flag_environment_config_write`	Modify Feature Flag Environment settings.	Create an environment Delete an environment Update an environment

Hosts

Scope name	Description	Endpoints that require this scope
`hosts_read`	List hosts and their attributes.	Get all hosts for your organization Get the total number of active hosts

Incidents

Scope name	Description	Endpoints that require this scope
`incident_notification_settings_read`	View Incident Notification Rule Settings.	Get an incident notification rule
`incident_notification_settings_write`	Configure Incidents Notification Rule settings.	Create an incident notification rule Delete an incident notification rule Update an incident notification rule Create incident notification template Delete a notification template Update incident notification template
`incident_read`	View incidents in Datadog.	Get a list of incidents Get incident notification template Get a list of incident types List incident type org settings Get incident type details Get org settings by incident type Get a list of incident user-defined fields Get an incident user-defined field Search for incidents Get the details of an incident List an incident's impacts Get a list of an incident's integration metadata Get incident integration metadata details Get a list of an incident's todos Get incident todo details List incident responders Get an incident responder List incident timestamp overrides
`incident_settings_read`	View Incident Settings.	List incident impact fields List incident rules Get an incident rule List incident user-defined roles Get an incident user-defined role
`incident_settings_write`	Configure Incident Settings.	Create an incident Google Chat configuration Update an incident Google Chat configuration Create an incident Google Meet configuration Update an incident Google Meet configuration Create an incident impact field Delete an incident impact field Update an incident impact field Create an incident rule Delete an incident rule Update an incident rule Create an incident type Delete an incident type Update an incident type Create an incident user-defined field Delete an incident user-defined field Update an incident user-defined field Create an incident user-defined role Delete an incident user-defined role Update an incident user-defined role
`incident_write`	Create, view, and manage incidents in Datadog.	Create an incident Get incident notification template Import an incident Delete an existing incident Update an existing incident Get an AI-generated incident postmortem Create incident attachment Delete incident attachment Update incident attachment Create a page from an incident Update an incident configuration Create an incident configuration Create an incident impact Delete an incident impact Update an incident impact Create an on-call page from an incident Link a page to an incident Create an incident integration metadata Delete an incident integration metadata Update an existing incident integration metadata Create an incident todo Delete an incident todo Update an incident todo Create an incident responder Delete an incident responder Create an incident ServiceNow record Create an incident timestamp override Delete an incident timestamp override Update an incident timestamp override

Logs

Scope name	Description	Endpoints that require this scope
`logs_read_data`	Read log data.	Aggregate events Search logs (POST)

Org Authorized Clients

Scope name	Description	Endpoints that require this scope
`org_authorized_apps_read`		List org authorized clients Get an org authorized client List user authorizations for a client
`org_authorized_apps_write`		Delete an org authorized client Update an org authorized client Delete a user's authorizations for a client Delete a user authorization for a client

Org Connections, Organizations

Scope name	Description	Endpoints that require this scope
`org_connections_read`	Read cross organization connections.	List Org Connections
`org_connections_write`	Create, edit, and delete cross organization connections.	List your managed organizations Create Org Connection Delete Org Connection Update Org Connection
`org_management`	Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.	Create AWS scan options Delete AWS scan options Update AWS scan options Create Azure scan options Delete Azure scan options Update Azure scan options Create GCP scan options Delete GCP scan options Update GCP scan options Create AWS on demand task Get Domain Allowlist Sets Domain Allowlist List identity providers Update an identity provider List users with an identity provider override Get IP Allowlist Update IP Allowlist Update the maximum session duration List your managed organizations Disable the authenticated customer organization
`user_access_read`	View users and their roles and settings.	List all users Get all datasets Get a single dataset by ID List global orgs List permissions List roles List role templates Get a role List permissions for a role Get all users of a role Get user details Get a user permissions

Product Catalog, Usage Metering

Scope name	Description	Endpoints that require this scope
`billing_read`	View your organization's billing information.	Get Monthly Cost Attribution List SKUs Get cost across multi-org account Get estimated cost across your account Get historical cost across your account Get projected cost across your account List usage quotas
`usage_read`	View your organization's usage and usage attribution.	Get hourly usage for analyzed logs Get hourly usage for audit logs Get hourly usage for Lambda Get billable usage across your account Get hourly usage for CI visibility Get hourly usage for CSM Pro Get hourly usage for cloud workload security Get hourly usage for database monitoring Get hourly usage for Fargate Get hourly usage for hosts and containers Get hourly usage attribution Get hourly usage for incident management Get hourly usage for indexed spans Get hourly usage for ingested spans Get hourly usage for IoT Get hourly usage for logs Get hourly logs usage by retention Get hourly usage for logs by index Get monthly usage attribution get hourly usage for network flows Get hourly usage for network hosts Get hourly usage for online archive Get hourly usage for profiled hosts Get hourly usage for RUM units Get hourly usage for RUM sessions Get hourly usage for sensitive data scanner Get hourly usage for SNMP devices Get usage across your account Get hourly usage for synthetics checks Get hourly usage for synthetics API checks Get hourly usage for synthetics browser checks Get hourly usage for custom metrics Get all custom metrics by hourly average Get active billing dimensions for cost attribution Get Monthly Cost Attribution List SKUs Get hourly usage for application security Get billing dimension mapping for usage endpoints Get cost across multi-org account Get estimated cost across your account Get historical cost across your account Get hourly usage by product family Get hourly usage for Lambda traced invocations Get hourly usage for observability pipelines Get projected cost across your account Get available fields for usage summary Get usage attribution types
`billing_edit`	Edit your organization's billing information.	List usage quotas Create or update usage quotas Delete a usage quota Update a usage quota Cancel a scheduled usage quota limit

Service Level Objective Corrections, Service Level Objectives

Scope name	Description	Endpoints that require this scope
`slos_corrections`	Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.	Create an SLO correction
`slos_read`	View SLOs and status corrections.	Get all SLOs Check if SLOs can be safely deleted Get all SLO corrections Search for SLOs Get an SLO's details Get Corrections For an SLO Get an SLO's history Create a new SLO report Get SLO report Get SLO report status Get SLO status
`slos_write`	Create, edit, and delete SLOs.	Create an SLO object Bulk Delete SLO Timeframes Delete an SLO Update an SLO

Status Pages

Scope name	Description	Endpoints that require this scope
`status_pages_incident_write`		Create degradation Create backfilled degradation Delete degradation Update degradation Soft delete degradation update Edit degradation update Schedule maintenance Create backfilled maintenance Update maintenance Edit maintenance update
`status_pages_internal_page_publish`		Publish status page Unpublish status page
`status_pages_public_page_publish`		Publish status page Unpublish status page
`status_pages_settings_read`		List status pages List degradations List maintenances Get status page List components Get component List degradation templates Get degradation template Get degradation List maintenance templates Get maintenance template Get maintenance
`status_pages_settings_write`		Create status page Delete status page Update status page Create component Delete component Update component Create degradation template Delete degradation template Update degradation template Create maintenance template Delete maintenance template Update maintenance template

Teams

Scope name	Description	Endpoints that require this scope
`teams_manage`	Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.	Create a team Create a team hierarchy link Remove a team hierarchy link Link teams with external teams Remove a team
`teams_read`	Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.	Get all teams Create a team Get team hierarchy links Create a team hierarchy link Remove a team hierarchy link Get a team hierarchy link Delete team connections List team connections Create team connections Get team sync configurations Get all member teams Add a member team Remove a member team Remove a team Get a team Update a team Get links for a team Create a team link Remove a team link Get a team link Update a team link Get team memberships Add a user to a team Remove a user from a team Update a user's membership attributes on a team Get team notification rules Create team notification rule Delete team notification rule Get team notification rule Update team notification rule Get permission settings for a team Update permission setting for team Get user memberships

User Authorized Clients

Scope name	Description	Endpoints that require this scope
`built_in_features`		List user authorized clients Delete a user authorized client Get a user authorized client

Webhooks Integration

Scope name	Description	Endpoints that require this scope
`create_webhooks`	Create webhooks integrations.	Create a webhooks integration

Workflow Automation

Scope name	Description	Endpoints that require this scope
`workflows_read`	View workflows.	List workflow instances Get a workflow instance
`workflows_run`	Run workflows.	Execute a workflow