> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Datadog
> Connect your Datadog organization to Oleria for full visibility into users, roles, and teams, plus the non-human identity credential surface across your Datadog organization.
Connect Datadog to Oleria to see who has access across your Datadog organization: every user (human and service account), the roles and teams they belong to, and the API keys, application keys, and other credentials acting as non-human identities (NHIs). Oleria reads this data from the Datadog API. Two authentication methods are supported - API Key + Application Key for full coverage, or OAuth2 for reduced coverage - and this page walks through both.
## What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Datadog organization:
* **Accounts** - every user, human and service account, with email, status, and role assignment.
* **Roles** - Datadog's built-in and custom roles, and which accounts hold each.
* **Teams** - Datadog teams and their membership.
* **Non-human identities (NHIs)** - API keys, application keys, personal access tokens, service account access tokens, service account application keys, and org-authorized OAuth clients, each linked to the account that owns it.
* **Activity** - security-relevant Datadog Audit Trail events, such as user, role, team, and credential lifecycle changes. Only available with the API Key + Application Key method - see [Choose an authentication method](#choose-an-authentication-method).
Datadog's access model is flat: a role is granted directly to a user, with no per-resource permission grant. This integration doesn't populate resource-level Access Graph or Access Inventory data. Datadog also doesn't expose org-wide single sign-on (SSO) or multi-factor authentication (MFA) enforcement through any API - those are UI-only Security Settings. Per-user MFA enrollment status is available and is reported.
## Prerequisites
* A Datadog organization admin, or an account with equivalent permissions, to create the credentials below.
* For OAuth2 only: a Datadog Partner Sandbox account. Standard Datadog organizations don't have the Developer Platform / OAuth Apps page, so most customers should use API Key + Application Key instead.
## Choose an authentication method
Full coverage. An application key inherits the permissions of the account that creates it, so use one owned by a Datadog Admin Role account - it needs to reach every endpoint this integration reads, including application keys, API keys, and service accounts.
Log in to Datadog as an admin and go to **Organization Settings** -> **API Keys** -> **New Key**. Give it a name (for example, `Oleria`) and copy the generated value.
Go to **Organization Settings** -> **Application Keys** -> **New Key**. Give it a name and copy the value immediately.
Datadog shows the application key value only once. If you lose it, generate a new one and update the credential in Oleria.
Registering an OAuth client requires a Datadog Partner Sandbox account - the Developer Platform / OAuth Apps page isn't available in standard Datadog organizations. Use API Key + Application Key instead unless you have one.
Reduced coverage with OAuth2: application keys, API keys, personal access tokens, and service account credentials aren't visible to this integration at all, and Audit Trail activity doesn't sync either. Datadog's OAuth scheme doesn't accept those endpoints - only API Key + Application Key gets full coverage.
Log in to Datadog as an admin and go to **Organization Settings** -> **OAuth Apps** -> **New Client**. Register a client for Oleria.
Datadog requires a **Redirect URI** on the client. Set it to your Oleria workspace URL followed by `/workspace/integrations/datadog/connect`. For example, if you log in to Oleria at `https://acme.oleria.io`, enter:
```
https://acme.oleria.io/workspace/integrations/datadog/connect
```
This redirect URI must match exactly what Oleria sends when it exchanges the authorization code, or Datadog rejects the connection with a redirect URI mismatch. Oleria captures and reuses this exact redirect URI for the life of the connection - it isn't recalculated later. If your Oleria workspace URL changes, don't edit the redirect URI in Datadog: disconnect and reconnect the OAuth2 integration instead so a new redirect URI is captured for the new URL.
Copy the **Client ID** and **Client Secret** for the client you registered.
Store the client secret securely. If you lose it, generate a new one in Datadog and update the integration in Oleria.
## Connect Datadog to Oleria
Go to your Oleria workspace, select **Integrations** -> select **Datadog**.
Select your authentication method and fill in the connection form:
| Field | Notes |
| :-------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Site | Required. Select the Datadog site your organization uses - visible in your Datadog login URL. Options: `datadoghq.com`, `us3.datadoghq.com`, `us5.datadoghq.com`, `ap1.datadoghq.com`, `ap2.datadoghq.com`, `datadoghq.eu`, `ddog-gov.com`, `us2.ddog-gov.com`. |
| Authentication Method | Required. **API Key + Application Key (Recommended)** or **OAuth2**. |
| API Key | Required for API Key + Application Key. The API key you created above. |
| Application Key | Required for API Key + Application Key. The application key you created above. |
| Client ID | Required for OAuth2. The client ID from the OAuth client you registered above. |
| Client Secret | Required for OAuth2. The client secret for that same OAuth client. |
Select **Authenticate** to validate the credentials and save the integration.
## Verify the integration
Confirm Datadog appears in your Oleria workspace's connected integrations. After the first sync completes, you can review the discovered accounts, roles, teams, and credentials. Audit Trail activity, if available, syncs within Datadog's retention window (90 days by default, configurable to 3, 7, 15, 30, or 90 days).
If you rotate the API key, regenerate the application key, or rotate the OAuth client secret, update the credentials in Oleria by editing the integration. A revoked or expired credential stops discovery until you do.
## Remediation actions
Beyond discovery, Oleria can act on Datadog access to remediate risk, using the same credentials.
| Action | What it does | Revert |
| :-------------------- | :------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------- |
| Disable user | Disables the user's Datadog account. Datadog's API call is a soft disable, not a permanent delete. | Supported - re-enables the account. |
| Create user | Invites a new user to the Datadog organization. | Not supported - Datadog has no hard delete for users; disable the account instead. |
| Add user to role | Assigns a Datadog role to the user. | Supported - removes the role. |
| Remove user from role | Removes a Datadog role from the user. | Supported - re-adds the role. |
| Add user to team | Adds the user to a Datadog team. | Supported - removes the user from the team. |
| Remove user from team | Removes the user from a Datadog team. | Supported - re-adds the user to the team. |
## Contact us
For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).