pup (Datadog CLI) Pup CLI for Datadog API operations. Supports OAuth2 and API key auth. Quick Reference Task Command Search error logs pup logs search query "status:error" from 1h List monitors pup monitors list Diff a monitor definition pup monitors diff <monitor id monitor.json Schedule monitor downtime pup downtime create file downtime.json Open a dashboard at a live time window pup dashboards url <dashboard id from now 1h to now live true Find recent slow traces for a service (last 1h) pup traces search query "service:<service name @duration: 500ms" from 1h List incidents pup incidents list limit 50 Import incident payload pup incidents import file incident.json Query metrics pup metrics query query "avg:system.cpu.user{ }" List hosts pup infrastructure hosts list count 50 Check SLOs pup slos list On call teams pup on call teams list Triage open critical security signals (last 1h) pup security signals list query "status:open severity:critical" from 1h limit 100 Search audit logs pup audit logs search query "@action:deleted" from 24h Audit activity by user pup audit logs search query "@usr.email:user@example.com" from 7d Investigate API key pup audit logs search query "@metadata.api key.id:KEY ID" from 90d Check auth pup auth status Token expiry (time left) pup auth status Refresh token pup auth refresh Prerequisites Install pup using the [setup instructions](https://github.com/datadog labs/agent skills/tree/main?tab=readme ov file setup pup). Required Input Resolution For commands that need specific scope values ( <env , <service name , <team id , resource IDs), use this order: 1. Check context first (conversation history, prior command output, saved variables). 2. If missing, run a discovery command first (list/search) to get valid values. 3. If still missing or ambiguous, ask the user to confirm the exact value. 4. Then run the target command. 5. Never run commands with unresolved placeholders like <env or <monitor id . Auth Tokens expire (~1 hour) . If a command fails with 401/403 mid conversation: If Chrome opens the wrong profile/window, use the one time OAuth URL printed by pup auth login ( If the browser doesn't open, visit: ... ) and open that link manually in the correct account session. Headless/CI (no browser) Command Reference Monitors Logs Metrics APM / Traces Incidents Dashboards Safe dashboard create, clone, and update workflow The goal is a recoverable source and a verified destination. A successful API response alone does not prove that widget content or placement was preserved. 1. Fetch the source or update target with read only and save the exact response as an immutable snapshot. Never overwrite this file with transformed JSON. 2. Build a separate mutation payload. Remove response only fields before create/update: author handle , author name , created at , id , modified at , and url . 3. For a backup or clone, leave the source dashboard unchanged and change only explicitly requested fields, usually title or description . Preserve layout type , reflow type , widget order, and every recursive widget layout object ( x , y , width , height , and is column break ). Repacking or compacting coordinates creates a derived layout, not an exact clone. 4. Create or update from dashboard payload.json , then fetch the destination into a new file. 5. Normalize away the response only fields and compare the complete definitions. The only differences should be the fields intentionally changed. 6. Also compare layout projections separately so a placement regression cannot hide in a large widget diff: Pup 1.6.3 does not expose dashboard version history. If an exact historical version is required and no immutable snapshot exists, inspect version history in the Datadog UI before changing the dashboard. SLOs Synthetics On Call Hosts / Infrastructure Events Downtimes Users / Teams Security Audit Logs Service Catalog Notebooks Workflows Observability Pipelines LLM Observability Reference Tables Cost Cloud Configs Subcommand Discovery If local help differs from this skill, compare pup version with the latest stable release before inventing a workaround. Error Handling Error Cause Fix 401 Unauthorized Token expired pup auth refresh 403 Forbidden Missing scope Check app key permissions 404 Not Found Wrong ID/resource Verify resource exists Rate limited Too many requests Add delays between calls Install See [Setup Pup](https://github.com/datadog labs/agent skills/tree/main?tab=readme ov file setup pup) for installation instructions. Verify Installation Sites Site DD SITE value US1 (default) datadoghq.com US3 us3.datadoghq.com US5 us5.datadoghq.com EU1 datadoghq.eu AP1 ap1.datadoghq.com AP2 ap2.datadoghq.com US1 FED ddog gov.com

dd-pup