Datadog

Datadog Agent API

The Agent API from Datadog — 4 operation(s) for agent.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 10

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/v2/remote_config/products/cws/agent_rules List Workload Protection agent rules · Datadog Get All Workload Protection Agent Rules #
Ask an LLM
“Which Workload Protection agent rules are defined on my commercial Datadog site?”
“Can I list only the agent rules that belong to one Workload Protection policy?”
Tell an agent
List all Workload Protection agent rules.
List the Workload Protection agent rules in policy {policy_id}.
POST /api/v2/remote_config/products/cws/agent_rules Create a Workload Protection agent rule · Datadog Create a Workload Protection Agent Rule #
Ask an LLM
“How do I add a new Workload Protection agent rule outside the government site?”
“Can I create a runtime security agent rule with a custom expression?”
Tell an agent
Create a Workload Protection agent rule with {rule}.
Add a new CWS agent rule defined as {rule} on the standard site.
DELETE /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} Delete a Workload Protection agent rule · Datadog Delete a Workload Protection Agent Rule #
Ask an LLM
“How do I remove a Workload Protection agent rule on a non-government site?”
“Can I delete an agent rule from just one policy?”
Tell an agent destructive · confirm first
Delete Workload Protection agent rule {agent_rule_id}.
Remove agent rule {agent_rule_id} from policy {policy_id}.
GET /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} Get a Workload Protection agent rule · Datadog Get a Workload Protection Agent Rule #
Ask an LLM
“What expression does one Workload Protection agent rule use?”
“Can I read an agent rule in the context of a specific policy?”
Tell an agent
Get Workload Protection agent rule {agent_rule_id}.
Show agent rule {agent_rule_id} within policy {policy_id}.
PATCH /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id} Update a Workload Protection agent rule · Datadog Update a Workload Protection Agent Rule #
Ask an LLM
“How do I change the expression or enabled state of a Workload Protection agent rule?”
“Can I edit an agent rule scoped to a particular policy?”
Tell an agent
Update Workload Protection agent rule {agent_rule_id} with {changes}.
Apply {changes} to agent rule {agent_rule_id} in policy {policy_id}.
GET /api/v2/security_monitoring/cloud_workload_security/agent_rules List agent rules on the US1-FED site · Datadog Get All Workload Protection Agent Rules (us1-fed) #
Ask an LLM
“Which Workload Protection agent rules exist on the US1-FED government site?”
“On the government site, where do I list Cloud Workload Security agent rules?”
Tell an agent
List all agent rules on the US1-FED site.
Show the government-site Cloud Workload Security agent rules.
POST /api/v2/security_monitoring/cloud_workload_security/agent_rules Create an agent rule on the US1-FED site · Datadog Create a Workload Protection Agent Rule (us1-fed) #
Ask an LLM
“How do I create a Workload Protection agent rule on the US1-FED government site?”
“Can I add a Cloud Workload Security agent rule in a FedRAMP org?”
Tell an agent
Create a US1-FED agent rule with {rule}.
Add a Cloud Workload Security agent rule {rule} on the government site.
DELETE /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} Delete an agent rule on the US1-FED site · Datadog Delete a Workload Protection Agent Rule (us1-fed) #
Ask an LLM
“How do I delete a Workload Protection agent rule on the US1-FED site?”
“Can I remove a Cloud Workload Security rule from a government org?”
Tell an agent destructive · confirm first
Delete US1-FED agent rule {agent_rule_id}.
Remove government-site Cloud Workload Security rule {agent_rule_id}.
GET /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} Get an agent rule on the US1-FED site · Datadog Get a Workload Protection Agent Rule (us1-fed) #
Ask an LLM
“How do I read one agent rule's details on the US1-FED site?”
“On the government site, what expression does a given agent rule use?”
Tell an agent
Get US1-FED agent rule {agent_rule_id}.
Show the government-site Cloud Workload Security rule {agent_rule_id}.
PATCH /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id} Update an agent rule on the US1-FED site · Datadog Update a Workload Protection Agent Rule (us1-fed) #
Ask an LLM
“How do I edit an agent rule on the US1-FED government site?”
“Can I disable a Cloud Workload Security rule in a government org?”
Tell an agent
Update US1-FED agent rule {agent_rule_id} with {changes}.
Apply {changes} to government-site Cloud Workload Security rule {agent_rule_id}.

Documentation

📖
Documentation
https://docs.datadoghq.com/api/latest/
📖
Authentication
https://docs.datadoghq.com/api/latest/authentication/
📖
Documentation
https://docs.datadoghq.com/api/latest/metrics/
📖
Documentation
https://docs.datadoghq.com/api/latest/logs/
📖
Documentation
https://docs.datadoghq.com/api/latest/events/
📖
Documentation
https://docs.datadoghq.com/api/latest/monitors/
📖
Documentation
https://docs.datadoghq.com/api/latest/incidents/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-agent-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/json-schema/datadog-metric-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/json-schema/datadog-log-event-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/json-schema/datadog-event-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/json-schema/datadog-monitor-schema.json

Other Resources

🔗
GraphQL
https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/graphql/datadog-graphql.md
🔗
Reference
https://docs.datadoghq.com/metrics/
🔗
Reference
https://docs.datadoghq.com/logs/
🔗
Reference
https://docs.datadoghq.com/service_management/events/
🔗
Reference
https://docs.datadoghq.com/monitors/
🔗
Reference
https://docs.datadoghq.com/service_management/incident_management/

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/datadog:datadog-agent-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

datadog-agent-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Agent API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:


# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-agent-api-openapi.yml