Infrastructure

Datadog

Connect your Datadog organization to Ploy to automatically discover every Datadog user, their account status, MFA state, last login and the Datadog roles they hold. Ploy keeps your Datadog access picture up to date as people join, change roles or are deactivated, and can also disable, re-enable and invite Datadog users for you as part of onboarding and offboarding.

Before you begin

  • You need access to Datadog with permission to create an API key and an application key for your organization.

  • The application key acts with the permissions of the user who owns it (or the scopes authorized on it). For Ploy to read your user directory, that key needs the user_access_read permission.

  • If you also want Ploy to disable or re-enable users, the key needs the user_access_manage permission, and inviting users needs user_access_invite. If you scope the application key, make sure those same scopes are authorized on it.

  • Know which regional site your Datadog organization is hosted on. It is the domain you see in your browser when you open Datadog (for example datadoghq.com, us3.datadoghq.com or datadoghq.eu).

Create your Datadog API and application keys

Ploy authenticates to Datadog with two keys, and both are required: an organization-level API key and a user-level application key. Every request Ploy makes carries both.

Create an API key

  1. Log in to Datadog.

  2. Open your organization settings and go to the API keys section.

  3. Create a new API key. Give it a recognisable name such as Ploy.

  4. Copy the key value — you will paste it into Ploy in a moment.

Create an application key

  1. In your organization settings, go to the application keys section.

  2. Create a new application key named something recognisable such as Ploy.

  3. The key inherits the permissions of its owner, so create it as a user who holds user_access_read (plus user_access_manage and user_access_invite if you want Ploy to manage users). If your Datadog plan supports scoping application keys, authorize those same scopes on the key.

  4. Copy the key value.

Connect Datadog to Ploy

  1. In Ploy, go to the integrations page and select Datadog.

  2. The wizard links to Datadog API Key Docs — Datadog's own guide to creating API and application keys — if you have not created the keys yet.

  3. Select your Datadog site (required). This is the regional site your Datadog organization is hosted on — the domain you see when you open Datadog.

  4. Enter your Datadog API key (required). Paste the API key you created.

  5. Enter your Datadog application key (required). Paste the application key you created.

  6. Complete the wizard. Ploy immediately tests the connection by reading your user list from Datadog.

The available sites are:

  • US1 (datadoghq.com)

  • US3 (us3.datadoghq.com)

  • US5 (us5.datadoghq.com)

  • EU (datadoghq.eu)

  • AP1 (ap1.datadoghq.com)

  • AP2 (ap2.datadoghq.com)

  • UK1 (uk1.datadoghq.com)

  • US1-FED (ddog-gov.com)

  • US2-FED (us2.ddog-gov.com)

What data syncs

  • Users — every user in your Datadog organization, including pending invitations and deactivated accounts, with their account status, MFA state and last login time. Users sync every hour.

  • App access — who has access to Datadog, with each user's Datadog roles shown as entitlements on their access. When a user disappears from Datadog or is deactivated, Ploy revokes their access on the next scan. A pending invitation still counts as an allocated seat, matching how Datadog's own Users screen counts Active and Pending together.

  • Roles — every Datadog role and which users hold it, synced daily. Roles deleted in Datadog are archived in Ploy.

  • Usage — each user's last login feeds Ploy's usage picture for the Datadog app.

Datadog service accounts (programmatic identities that hold application keys rather than logins) are deliberately excluded from the user sync.

What Ploy can do in Datadog

With the right permissions on the application key, Ploy can make changes in Datadog — for example as part of offboarding flows:

  • Disable a user — Datadog's API deactivates the account rather than deleting it, so it can be restored later. Requires user_access_manage.

  • Re-enable a user — reactivates a previously disabled account. Requires user_access_manage.

  • Invite a user — creates the account and sends the Datadog invitation email in one step. Requires user_access_invite.

Troubleshooting

"Failed to authenticate with Datadog. Check your site, API key and application key."

The connection test at the end of the wizard could not read your user list. Check that:

  • The site you selected matches the domain you see when you open Datadog — a key from one regional site will not work against another.

  • Both keys were pasted completely, with no extra spaces.

  • The application key's owner (or its authorized scopes) has the user_access_read permission.

"Datadog refused the change."

If Ploy shows "Datadog refused the change. The application key needs the user_access_manage permission for disabling or re-enabling users, and user_access_invite for inviting them", Datadog returned a permission error for an action. Grant the missing permission to the application key's owner, or authorize the scope on the key, and retry the action.

Users show as Pending

A Pending user has been invited to Datadog but has not accepted the invitation yet. Ploy shows the account as not yet active while still counting the open invitation as an allocated seat, because Datadog holds the seat for them.

An invited user never received their email

Inviting a user requires the user_access_invite permission. Without it, the account can end up sitting in a Pending state with no invitation email delivered. Make sure the application key carries that permission before inviting users through Ploy.

Was this helpful?
Was this helpful?