Skip to main content

​
About Datadog Integration

The Datadog Integration lets Sawmills use Datadog credentials for Datadog-backed features. When you save the Datadog configuration, Sawmills validates the credentials and checks predefined permissions before storing them.

​
Step-by-Step: Configure Datadog Integration

​
1. Access Integrations

Open the user menu at the top right and select Integrations.

​
2. Open Datadog Configuration

In the Integrations section, open Datadog configuration.

​
3. Enter Credentials

Provide:
  • Datadog API Key
  • Datadog Application Key
  • Datadog Site

​
Best Practice: Service Account + Custom Role

For production, use a dedicated Datadog service account (not a personal user key).

​
1. Create a service account in Datadog

Create a service account for Sawmills integration usage.

​
2. Assign roles

Assign:
  • Datadog Read Only Role (baseline read access)
  • A custom role for extra Sawmills checks, for example: Sawmills Integration Role

​
3. Add required permissions to the custom role

Grant these Datadog permissions (typo-safe):
  • logs_read_config
  • audit_logs_read
  • logs_live_tail
  • logs_read_data
  • logs_read_index_data
  • usage_notifications_read
  • usage_read
  • dashboards_read
  • logs_read_archives
Notes:
  • Required to save: logs_read_config.
  • metrics_read and timeseries_query are validated by API access checks in Sawmills (no matching Datadog permission names in role configuration).

​
4. Create keys for the service account

  • Create an API key in Datadog.
  • Create an application key for the same service account.
  • Use those keys in Sawmills Datadog integration.

​
5. Save and Validate

Click Save. Before persisting, Sawmills runs validation and shows:
  • Keys status: Working or Invalid
  • Required permissions status
  • Per-permission status for predefined checks
Save is blocked if keys are invalid or required permissions are missing.

​
Backend Validation Flow

Validation is enforced in the backend service:
  • POST /v1/notification-integrations/datadog/validate: validates keys and returns per-permission status.
  • POST /v1/notification-integrations: blocks save when keys are invalid or required permissions are missing.
  • PATCH /v1/notification-integrations/{id}: re-validates merged Datadog config before update is persisted.

​
Required Permission

  • logs_read_config

​
Predefined Permissions Checked

  • logs_read_config
  • audit_logs_read
  • logs_live_tail
  • logs_read_data
  • logs_read_index_data
  • usage_notifications_read
  • usage_read
  • dashboards_read
  • logs_read_archives
  • metrics_read
  • timeseries_query