Datadog

Overview

Rootly’s Datadog integration connects your monitoring stack to your incident response process. When a Datadog monitor fires, Rootly can receive the alert, route it to the right team, and automatically kick off an incident — all without manual intervention. During incidents, Rootly workflows can also pull Datadog notebooks, graph snapshots, and dashboards directly into the incident record.

Features

Alert Ingestion

Receive Datadog monitor alerts in Rootly via webhooks and route them to on-call or incident workflows.

On-Call Paging

Page a specific user, team, escalation policy, or service directly from a Datadog alert payload.

Notebook Automation

Create Datadog notebooks automatically from Rootly workflow actions during incidents.

Snapshot & Dashboard Retrieval

Pull Datadog graph snapshots and dashboards into incident records via workflow actions.

Before You Begin

Rootly recommends performing the installation with a service account to ensure the integration does not break if the installing user leaves the company. Ensure you are logged in as an Admin in Rootly.

You will need three pieces of information from Datadog:

Host — your Datadog account’s API hostname
API Key — authenticates Rootly with your Datadog organization
Application Key — grants Rootly permission to read dashboards

Plan Requirements

Datadog account with Admin access
Rootly account with Owner or Admin role

Installation

Open Rootly Integrations

Navigate to Configuration → Integrations in Rootly, search for Datadog, and click Setup.

Datadog integration card in Rootly's integrations catalog

Create an API Key in Datadog

In Datadog, navigate to Organization Settings → API Keys and click + New Key.

Creating a new API key in Datadog organization settings

Name the key (for example, Rootly Integration) and click Create Key. Copy the key immediately.

The API key value is only shown once at creation. Copy it before closing the dialog — not the Key ID.

Create an Application Key in Datadog

In Datadog, navigate to Personal Settings → Security → Application Keys and click + New Key.

Creating a new application key in Datadog personal settings

Name the key (for example, Rootly Integration), then edit its scope to include Read permission for Dashboards.

Adding dashboard read scope to the Datadog application key

Copy the application key.

Rootly only requires dashboard_read scope. You can add more permissions if needed for other integrations, but this is the minimum required.

Enter credentials in Rootly

Back in the Rootly setup form, enter:

Host — your Datadog API hostname. Common values:
Region Host
US1 (default) api.datadoghq.com
US3 api.us3.datadoghq.com
US5 api.us5.datadoghq.com
EU api.eu.datadoghq.com
Gov api.ddog-gov.com
API Key — paste the API key you created
Application Key — paste the application key you created

Region	Host
US1 (default)	`api.datadoghq.com`
US3	`api.us3.datadoghq.com`
US5	`api.us5.datadoghq.com`
EU	`api.eu.datadoghq.com`
Gov	`api.ddog-gov.com`

Click Connect.

Datadog integration configuration form in Rootly

Confirm connection

Datadog will appear as Connected in your integrations list.

Datadog showing as connected in Rootly's integrations list

Ingest Datadog Alerts

Once Datadog is connected, forward monitor alerts to Rootly via a webhook. Alerts received in Rootly can be routed to a Slack channel, used to page on-call responders, or trigger incident workflows automatically.

Step 1: Set Up the Webhook in Datadog

Install the Webhooks integration

In Datadog, navigate to Integrations, search for Webhooks, and click Install.

Installing the Webhooks integration in Datadog

Create a new webhook

Switch to the Configuration tab and click + New to add a webhook.

Configuration tab in Datadog Webhooks showing the New button

Configure the webhook

Fill in the following fields:Name — give the webhook a descriptive name (for example, Rootly_Alerts)URL — enter:

https://webhooks.rootly.com/webhooks/incoming/datadog_webhooks

Payload — choose based on your use case:

General Alert
Page On-Call

Use this payload for standard alerts that appear in Rootly’s Alerts page without paging anyone.

{
  "id": "$ID",
  "body": "$EVENT_MSG",
  "last_updated": "$LAST_UPDATED",
  "event_type": "$EVENT_TYPE",
  "title": "$EVENT_TITLE",
  "alert_id": "$ALERT_ID",
  "alert_metric": "$ALERT_METRIC",
  "alert_priority": "$ALERT_PRIORITY",
  "alert_query": "$ALERT_QUERY",
  "alert_scope": "$ALERT_SCOPE",
  "alert_status": "$ALERT_STATUS",
  "alert_title": "$ALERT_TITLE",
  "alert_transition": "$ALERT_TRANSITION",
  "alert_type": "$ALERT_TYPE",
  "date": "$DATE",
  "org": {"id": "$ORG_ID", "name": "$ORG_NAME"}
}

Use this payload to page a specific user, team, escalation policy, or service when the alert fires. Replace <TYPE> and <ID> with your target resource.

{
  "id": "$ID",
  "body": "$EVENT_MSG",
  "last_updated": "$LAST_UPDATED",
  "event_type": "composite_monitor",
  "title": "Datadog webhook alert",
  "alert_id": "$ALERT_ID",
  "alert_metric": "$ALERT_METRIC",
  "alert_priority": "$ALERT_PRIORITY",
  "alert_query": "$ALERT_QUERY",
  "alert_scope": "$ALERT_SCOPE",
  "alert_status": "$ALERT_STATUS",
  "alert_title": "$ALERT_TITLE",
  "alert_transition": "$ALERT_TRANSITION",
  "alert_type": "$ALERT_TYPE",
  "date": "$DATE",
  "org": {"id": "$ORG_ID", "name": "$ORG_NAME"},
  "rootly": {
    "notification_target": {
      "type": "<TYPE>",
      "id": "<ID>"
    }
  }
}

Field	Values
`type`	`User`, `Group`, `EscalationPolicy`, or `Service`
`id`	The resource ID — found by editing the resource in Rootly

The only difference between these payloads is the notification_target object. Including it tells Rootly who to page when the alert is received.

Add the custom header

Check the Custom Headers box and add the following, replacing the value with your Rootly webhook secret:

{
  "secret": "<YOUR_ROOTLY_WEBHOOK_SECRET>"
}

To find your secret:

In Rootly, go to Alerts → Sources → Datadog and click Configure

Configure button on the Datadog alert source in Rootly

Find the Connection Instructions panel on the right

Connection Instructions panel showing the webhook URL and secret

Copy the secret value from the Custom Headers section

Custom Headers section showing the secret to copy

Save the webhook

Click Save.

Step 2: Attach the Webhook to a Monitor

Open a monitor

In Datadog, navigate to Monitors → New Monitor and choose a monitor type, or open an existing monitor to edit it.

Add the webhook to notifications

In the Configure notifications and automations section, reference your webhook using @webhook-<WEBHOOK_NAME> syntax (for example, @webhook-Rootly_Alerts).

Test and save

Click Test Notifications to confirm the alert reaches Rootly, then save the monitor.

Datadog monitor notification configuration with webhook

Verify the alert appeared on the Alerts page in Rootly.

Step 3: Build Alert Workflows in Rootly

With alerts flowing into Rootly, create a workflow that reacts to them. Alert workflows let you check alert fields, apply conditions, and trigger automated actions like creating an incident or notifying responders.

Open Workflows

Navigate to Workflows in Rootly and click Create Workflow.

Create Workflow button in Rootly's Workflows page

Choose Alert workflow type

Select Alert as the workflow type. This workflow triggers whenever Rootly receives an alert from Datadog.

Selecting Alert as the workflow type in Rootly

Set the trigger

Select Alert Created to fire on new alerts, or Alert Status Updated to react when an existing alert changes.

Available triggers: Alert Created fires when a new alert is received. Alert Status Updated fires when an existing alert changes state.

Add conditions

Filter which alerts should trigger this workflow. Common patterns:

Match by source
Match by payload

Add a condition where Source is Datadog to scope the workflow to Datadog alerts only.

Use payload field conditions to filter further — for example:

alert_priority equals P1
alert_title contains CRITICAL
alert_transition equals Triggered

Use Datadog payload fields like alert_priority, alert_status, alert_type, and alert_title to build precise conditions.

Add actions

Add one or more actions to execute when the workflow fires:

Action	Use case
Create Incident	Auto-create an incident from the alert
Page Rootly On-Call	Page the responsible team or escalation policy
Send Slack Message	Notify a channel about the alert
Send SMS or Email	Alert responders directly

You can chain multiple actions for a complete response process — for example, create an incident and then send a Slack message in the same workflow.

Save the workflow

Name the workflow (for example, Create Incident from Datadog P1 Alert) and click Create Workflow.

Save and create the alert workflow in Rootly

Verify the Workflow

After saving the workflow:

Return to Datadog and trigger a test alert from your monitor by clicking Test Notifications
Confirm the workflow activates in Rootly and performs the expected actions
View the run log under Workflows → History in Rootly

You have successfully built a Datadog alert workflow in Rootly!

Workflow Actions

Action	Description
Create Datadog Notebook	Creates a new notebook in your Datadog account, optionally pre-populated with incident data
Get Datadog Graph Snapshot	Retrieves a point-in-time snapshot of a Datadog metric graph and attaches it to the incident
Get Datadog Dashboard	Fetches a Datadog dashboard URL and surfaces it in the incident timeline

Create Datadog Notebook

Use this action to automatically create a Datadog notebook when an incident starts or reaches a specific status. Notebooks are useful for capturing investigation notes, timelines, and graphs in a single Datadog-native view.

Open workflow creation

Navigate to Workflows in Rootly and click Create Workflow, or open an existing workflow to edit it.

Add the action

Click Add Action, search for Datadog, and select Create Datadog Notebook.

Configure the action

Field	Required	Description
Name	No	A label for this action step. Does not affect behavior.
Notebook Name	Yes	The title of the notebook. Supports Liquid syntax — use the Liquid Variable Explorer to build dynamic names.

Save the workflow

Click Add, name the workflow, and click Create Workflow.

Get Datadog Graph Snapshot

Use this action to capture a point-in-time graph from Datadog and attach it to the incident. This is useful for preserving the state of a metric at the time an incident was declared or escalated.

Add the action

In your workflow, click Add Action, search for Datadog, and select Get Datadog Graph Snapshot.

Configure the action

Field	Required	Description
Metric Query	Yes	The Datadog metric query to snapshot — for example `avg:system.cpu.user` with an optional scope filter.
Start	No	Snapshot start time in Unix epoch seconds. Supports Liquid syntax.
End	No	Snapshot end time in Unix epoch seconds. Defaults to the current time if blank.

Get Datadog Dashboard

Use this action to retrieve a Datadog dashboard and surface its URL in the incident timeline. This gives responders quick access to the relevant monitoring view without leaving Rootly.

Add the action

In your workflow, click Add Action, search for Datadog, and select Get Datadog Dashboard.

Configure the action

Field	Required	Description
Dashboard ID	Yes	The ID of the Datadog dashboard to fetch. Found in the dashboard URL (for example, `abc-123-xyz`).

Alert Workflow Patterns

In addition to incident workflow actions, you can build Alert workflows in Rootly that trigger automatically when a Datadog alert arrives. These are separate from incident workflows and configured under Workflows → Alert. Common patterns:

Auto-create an incident when a SEV-1 Datadog alert fires
Page on-call for alerts with alert_priority of P1 or P2
Send a Slack message to a channel when a monitor transitions to ALERT
Resolve the alert automatically when Datadog sends a RECOVERY transition

To scope workflows to Datadog only, add a condition where Source is Datadog, or filter on payload fields like alert_priority, alert_title, or alert_transition.

Uninstall

To remove the Datadog integration:

Go to Configuration → Integrations and find Datadog
Click the Connected button to reveal the disconnect option
Click Delete

Click the Connected button to reveal the Disconnect option

Frequently Asked Questions

Alerts are not appearing in Rootly

Verify the webhook URL is exactly https://webhooks.rootly.com/webhooks/incoming/datadog_webhooks. Confirm the Custom Headers secret value matches what is shown in Alerts → Sources → Datadog → Configure in Rootly. Check that the Datadog integration is still connected under Configuration → Integrations.

How do I find the ID for the notification_target?

Open the resource (User, Team, Escalation Policy, or Service) in Rootly and click Edit. The resource ID appears in the URL or in the edit form. Copy it and paste it into the id field of the paging payload.

Can I send alerts from multiple Datadog monitors to Rootly?

Yes. Create one webhook and attach it to as many monitors as needed by adding @webhook-<WEBHOOK_NAME> to each monitor’s notification body. Each alert will appear separately in Rootly’s Alerts page.

What alert workflow triggers are available?

Alert workflows in Rootly support Alert Created (fires on new alerts) and Alert Status Updated (fires when an existing alert changes). Use conditions to filter by source (Datadog), payload fields like alert_priority or alert_title, or alert status.

Why aren't my WARNING alerts paging me?

By default, Rootly only pages for CRITICAL alerts from Datadog. WARNING vs. CRITICAL is the monitor’s alert_status field in the webhook payload — not alert_priority (which is your monitor’s P1–P5 importance and is independent of state). To extend paging to WARNING alerts, either configure your monitor to fire on the threshold you want treated as paging-eligible, or build an alert workflow that matches alert_status equals Warn (or Warning, depending on the value Datadog sends) and routes to the same target as CRITICAL.

Workflow Questions

The Create Notebook action ran but no notebook appeared in Datadog

Check the workflow run log in Rootly for error details. Confirm the Datadog Application Key has sufficient permissions and that the integration is still connected under Configuration → Integrations.

Can I chain Datadog actions with other workflow steps?

Yes. Datadog actions can be combined with any other Rootly workflow actions in the same workflow — for example, create a Datadog notebook and then send a Slack message with the notebook link.

What Liquid variables can I use in notebook names or metric queries?

Any incident Liquid variable is supported. Use the Liquid Variable Explorer to browse available variables and preview their values.

Getting Started

Alerts

On-Call

Incident Response

Retrospectives

Status Pages

Communications

Rootly AI

Workflows & Automation

Analytics

Configuration

Integrations

Administration

Resources & Help

Overview

Features

Alert Ingestion

On-Call Paging

Notebook Automation

Snapshot & Dashboard Retrieval

Before You Begin

Plan Requirements

Installation

Ingest Datadog Alerts

Step 1: Set Up the Webhook in Datadog

Step 2: Attach the Webhook to a Monitor

Step 3: Build Alert Workflows in Rootly

Verify the Workflow

Workflow Actions

Create Datadog Notebook

Get Datadog Graph Snapshot

Get Datadog Dashboard

Alert Workflow Patterns

Uninstall

Frequently Asked Questions

Workflow Questions

​Overview

​Features

Alert Ingestion

On-Call Paging

Notebook Automation

Snapshot & Dashboard Retrieval

​Before You Begin

​Plan Requirements

​Installation

​Ingest Datadog Alerts

​Step 1: Set Up the Webhook in Datadog

​Step 2: Attach the Webhook to a Monitor

​Step 3: Build Alert Workflows in Rootly

​Verify the Workflow

​Workflow Actions

​Create Datadog Notebook

​Get Datadog Graph Snapshot

​Get Datadog Dashboard

​Alert Workflow Patterns

​Uninstall

​Frequently Asked Questions

​Workflow Questions

​Related Resources

Overview

Features

Before You Begin

Plan Requirements

Installation

Ingest Datadog Alerts

Step 1: Set Up the Webhook in Datadog

Step 2: Attach the Webhook to a Monitor

Step 3: Build Alert Workflows in Rootly

Verify the Workflow

Workflow Actions

Create Datadog Notebook

Get Datadog Graph Snapshot

Get Datadog Dashboard

Alert Workflow Patterns

Uninstall

Frequently Asked Questions

Workflow Questions

Related Resources