Portées d’autorisation pour les clients OAuth

Les portées sont un mécanisme d’autorisation qui permet de contrôler et de restreindre précisément l’accès des applications aux données d’une organisation dans Datadog. Lorsqu’une application est autorisée à accéder aux données pour le compte d’un utilisateur ou d’un compte de service, elle ne peut consulter que les informations explicitement permises par les portées qui lui sont assignées.

Cette page répertorie uniquement les portées d'autorisation pouvant être attribuées aux clients OAuth. Pour consulter la liste complète des autorisations attribuables aux clés d'application avec portée, consultez la page Autorisations des rôles Datadog
  • Clients OAuth → Peuvent uniquement se voir attribuer des portées d'autorisation (ensemble limité).
  • Clés d'application avec portée → Peuvent se voir attribuer n'importe quelle autorisation Datadog.

La meilleure pratique pour définir la portée des applications consiste à suivre le principe du moindre privilège. Attribuez uniquement les portées minimales nécessaires au bon fonctionnement de l’application. Cela renforce la sécurité et permet de mieux comprendre comment les applications interagissent avec les données de votre organisation. Par exemple, une application tierce qui se contente de lire des dashboards n’a pas besoin d’autorisations pour supprimer ou gérer des utilisateurs.

Vous pouvez utiliser les portées d’autorisation avec des clients OAuth2 pour vos applications Datadog.

API Management, Synthetics

Scope name

Description

Endpoints that require this scope

apm_api_catalog_read

View API catalog and API definitions.

apm_api_catalog_write

Add, modify, and delete API catalog definitions.

synthetics_global_variable_read

View, search, and use Synthetics global variables.

synthetics_global_variable_write

Create, edit, and delete global variables for Synthetics.

synthetics_private_location_read

View, search, and use Synthetics private locations.

synthetics_private_location_write

Create and delete private locations in addition to having access to the associated installation guidelines.

APM, Spans

Scope name

Description

Endpoints that require this scope

apm_read

Read and query APM and Trace Analytics.

Agentless Scanning, Compliance, Domain Allowlist, IP Allowlist, Monitors, Org Connections, Organizations, Security Monitoring

Scope name

Description

Endpoints that require this scope

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

org_connections_read

Read cross organization connections.

org_connections_write

Create, edit, and delete cross organization connections.

logs_modify_indexes

Modify log indexes, filters, exclusion filters, and configurations.

logs_read_index_data

Read indexed log data.

security_monitoring_critical_assets_read

Read Critical Assets.

security_monitoring_critical_assets_write

Write Critical Assets.

siem_entities_read

View Cloud SIEM entities.

Agentless Scanning, Compliance, Domain Allowlist, IP Allowlist, Organizations, Security Monitoring, Static Analysis

Scope name

Description

Endpoints that require this scope

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

org_connections_write

Create, edit, and delete cross organization connections.

logs_modify_indexes

Modify log indexes, filters, exclusion filters, and configurations.

logs_read_index_data

Read indexed log data.

security_monitoring_critical_assets_read

Read Critical Assets.

security_monitoring_critical_assets_write

Write Critical Assets.

siem_entities_read

View Cloud SIEM entities.

Agentless Scanning, Compliance, Security Monitoring, Static Analysis

Scope name

Description

Endpoints that require this scope

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

logs_modify_indexes

Modify log indexes, filters, exclusion filters, and configurations.

logs_read_index_data

Read indexed log data.

security_monitoring_critical_assets_read

Read Critical Assets.

security_monitoring_critical_assets_write

Write Critical Assets.

siem_entities_read

View Cloud SIEM entities.

Agentless Scanning, Domain Allowlist, Downtimes, IP Allowlist, Monitors, Organizations

Scope name

Description

Endpoints that require this scope

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

monitors_downtime

Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.

org_connections_write

Create, edit, and delete cross organization connections.

Agentless Scanning, Domain Allowlist, IP Allowlist, Org Connections, Organizations

Scope name

Description

Endpoints that require this scope

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

org_connections_read

Read cross organization connections.

org_connections_write

Create, edit, and delete cross organization connections.

Bits AI

Scope name

Description

Endpoints that require this scope

bits_investigations_read

View Bits AI investigations.

bits_investigations_write

Create and manage Bits AI investigations.

CI Visibility Pipelines, CI Visibility Tests, Test Optimization

Scope name

Description

Endpoints that require this scope

test_optimization_write

Update flaky tests from Flaky Tests Management of Test Optimization.

CI Visibility Tests, Test Optimization

Scope name

Description

Endpoints that require this scope

test_optimization_write

Update flaky tests from Flaky Tests Management of Test Optimization.

Case Management Attribute, Case Management Type

Scope name

Description

Endpoints that require this scope

cases_shared_settings_write

Update shared case management settings.

Case Management, Change Management, Error Tracking, Scorecards

Scope name

Description

Endpoints that require this scope

event_correlation_config_read

View event correlation configurations.

event_correlation_config_write

Create and update event correlation configurations.

Case Management, Change Management, Error Tracking, Scorecards, Service Definition, Software Catalog

Scope name

Description

Endpoints that require this scope

event_correlation_config_read

View event correlation configurations.

event_correlation_config_write

Create and update event correlation configurations.

Cloud Cost Management

Scope name

Description

Endpoints that require this scope

Code Coverage

Scope name

Description

Endpoints that require this scope

Dashboard Lists, Dashboard Secure Embed, Dashboards, Powerpack

Datasets, Roles, Users

Domain Allowlist, Downtimes, Monitors

Scope name

Description

Endpoints that require this scope

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

monitors_downtime

Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.

Downtimes, Monitors

Events

Scope name

Description

Endpoints that require this scope

Hosts

Scope name

Description

Endpoints that require this scope

Incident Services, Incidents

Scope name

Description

Endpoints that require this scope

incident_notification_settings_read

View Incident Notification Rule Settings.

Metrics

Org Connections, Organizations

Scope name

Description

Endpoints that require this scope

org_connections_read

Read cross organization connections.

org_connections_write

Create, edit, and delete cross organization connections.

org_management

Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.

Service Level Objective Corrections, Service Level Objectives

Scope name

Description

Endpoints that require this scope

slos_corrections

Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.

Teams

Usage Metering

Scope name

Description

Endpoints that require this scope

usage_read

View your organization's usage and usage attribution.

Get hourly usage for analyzed logs
Get hourly usage for audit logs
Get hourly usage for Lambda
Get billable usage across your account
Get hourly usage for CI visibility
Get hourly usage for CSM Pro
Get hourly usage for cloud workload security
Get hourly usage for database monitoring
Get hourly usage for Fargate
Get hourly usage for hosts and containers
Get hourly usage attribution
Get hourly usage for incident management
Get hourly usage for indexed spans
Get hourly usage for ingested spans
Get hourly usage for IoT
Get hourly usage for logs
Get hourly logs usage by retention
Get hourly usage for logs by index
Get monthly usage attribution
get hourly usage for network flows
Get hourly usage for network hosts
Get hourly usage for online archive
Get hourly usage for profiled hosts
Get hourly usage for RUM units
Get hourly usage for RUM sessions
Get hourly usage for sensitive data scanner
Get hourly usage for SNMP devices
Get usage across your account
Get hourly usage for synthetics checks
Get hourly usage for synthetics API checks
Get hourly usage for synthetics browser checks
Get hourly usage for custom metrics
Get all custom metrics by hourly average
Get active billing dimensions for cost attribution
Get Monthly Cost Attribution
Get hourly usage for application security
Get billing dimension mapping for usage endpoints
Get cost across multi-org account
Get estimated cost across your account
Get historical cost across your account
Get hourly usage by product family
Get hourly usage for Lambda traced invocations
Get hourly usage for observability pipelines
Get projected cost across your account
Get usage attribution types

Webhooks Integration

Scope name

Description

Endpoints that require this scope

create_webhooks

Create webhooks integrations.

Workflow Automation

Scope name

Description

Endpoints that require this scope

workflows_run

Run workflows.