feat(datadog): extend to 40 tools and align every operation with the published OpenAPI specs (#6745)

* feat(datadog): add incidents, SLOs, dashboards, synthetics, Cloud SIEM, and APM tools

Extends the Datadog block from 12 to 39 operations, all verified against
Datadog's published OpenAPI specs:

- Incidents (v2, public beta): list, get, create, update, add todo
- SLOs (v1): list, get, create, update, delete, history
- Dashboards (v1): list, get, create, delete
- Synthetics (v1): list tests, get test, latest results, trigger, pause/resume
- Cloud SIEM (v2): search signals, get signal, update triage state, assign,
  list detection rules
- APM: search spans (v2), list Service Catalog definitions (v2)

Adds tools/datadog/utils.ts so every tool builds its URL from the configured
site/region and shares the JSON:API-aware error extraction, and handles the
v1 flat vs v2 envelope shapes and cursor pagination per endpoint.

* fix(datadog): align every operation with the published OpenAPI specs

Validated all 39 shipped operations (plus the 12 pre-existing ones that had
never been spec-checked) against the DataDog v1 and v2 OpenAPI schemas.

- `POST /api/v2/downtime` requires `monitor_identifier`, so a downtime created
  without a monitor id was rejected. Default to the `*` monitor tag.
- A one-time downtime schedule declares `additionalProperties: false` and
  accepts only `start`/`end`; the timezone moves to `display_timezone`.
- `GET /api/v2/downtime` has no `monitor_id` filter, and the response carries
  no `disabled` attribute. Downtime ids are UUID strings, not numbers.
- Drop scaffold types for operations that do not exist (metric metadata, event
  query, monitor update/delete/unmute, host listing) along with their fields.
- Note that monitor mute is no longer published in the v1 specification.
- Add browser Synthetic test results, which the browser-specific endpoint
  returns with its own camelCase step-count shape.
- Replace every `any` with a spec-derived interface, keeping the polymorphic
  service-definition schema opaque.

* fix(datadog): remove remaining any types and declare every returned output field

Replace the six surviving `Record<string, any>` request-body and response-cast
sites with concrete spec-derived shapes, and declare the output fields that
transformResponse already returned but outputs omitted:

- create_downtime / list_downtimes: timezone, created, modified
- create_monitor / get_monitor: options, creator
- list_monitors: message, priority, options, created, modified, creator
- query_logs: content.attributes, content.tags
- update_security_signal_state / _assignee: type; assignee also gained the
  archiveReason/archiveComment pair its sibling already declared
- query_timeseries: series gained the items shape it never described

* fix(datadog): stop dropping downtime targeting inputs in the block mapping

create_downtime accepts monitorTags, timezone and muteFirstRecoveryNotification,
but the block exposed no inputs for them and never forwarded them. Monitor-tag
targeting silently fell back to the `*` tag, so a downtime meant for one team's
monitors muted every monitor in scope. Adds the three advanced sub-blocks and
wires them through.

Also routes list_downtimes' currentOnly through toSwitchBoolean. A switch yields
the strings 'true'/'false', and 'false' is truthy, so turning the toggle off
still sent current_only=true. Every other switch in the block already used the
helper; this was the last raw one.

* fix(datadog): correct metric type codes, stop SLO update data loss, drop unpublished mute

Independent re-validation of all 39 operations against the DataDog/datadog-api-client-go
generator specs (v1 and v2 openapi.yaml) rather than the client-rendered docs site.

Correctness:
- submit_metrics sent inverted MetricIntakeType codes (gauge as 0/unspecified, rate as 1/count,
  count as 2/rate), silently changing how Datadog aggregated every submitted series. The spec
  enum is 0 unspecified, 1 count, 2 rate, 3 gauge; an unrecognized type is now omitted so
  Datadog infers it. Also stops stamping an invented `resources: [{name:'host'}]` default and
  now forwards `interval`, which Datadog requires for count and rate metrics.
- update_slo replaced the whole SLO with only the fields the caller filled in, so editing one
  field erased description, tags, query, monitor_ids, groups, thresholds, and timeframe.
  PUT /api/v1/slo/{slo_id} is a full replacement, so the stored SLO is now read first and the
  supplied edits are overlaid onto it, with the read-only fields stripped.
- update_incident admitted empty strings, so a blank input could blank a stored incident title
  or fail as an invalid date-time.
- query_timeseries reported a failed query as success: Datadog returns 200 with a non-ok
  `status` and the reason in `error`.
- create_monitor swallowed malformed options JSON and created a monitor with no thresholds.
- send_logs rebuilt each entry from a fixed field list, discarding the custom attributes
  Datadog accepts as additionalProperties, and padded absent optional fields with empty strings.

Removed:
- mute_monitor. /api/v1/monitor/{monitor_id}/mute is absent from the v1 spec entirely, there is
  no unmute counterpart to reverse it, and downtimes are the supported mechanism.

Contract accuracy:
- Security signal search advertised relative times ("now-1h"); the spec types filter.from/to as
  format: date-time. Descriptions, placeholders, and wand prompts now produce ISO-8601.
- list_incidents advertised an `include` value ("integrations") that is not in the spec enum,
  and neither incident tool trimmed the comma-separated list, so "users, attachments" 400d.
- Invalid "ok" group state dropped from both monitor descriptions.
- time_slice removed from SLO create input, which cannot build one without an SLI specification.
- DatadogSite gains ap2, uk1, and us2.ddog-gov.com.

Pagination and errors:
- list_downtimes silently truncated at Datadog's default 30 with no way to page; adds
  page[limit]/page[offset] and surfaces totalCount.
- query_logs returned a cursor it had no way to accept back.
- Error extraction consolidated onto datadogErrorMessage, which now also reads the
  dictionary-shaped errors of the SLO delete conflict. Ten tools were reading `.detail` off
  plain strings or the raw entry off objects, degrading every failure to a bare status line.
- Debug logging removed from list_monitors.

Adds 29 regression tests, each verified to fail when its fix is reverted.

* fix(datadog): add SEV-0, document page-size caps, drop unsourced output defaults

- The severity dropdown omitted SEV-0, which IncidentSeverity allows and both incident
  tool descriptions already advertised.
- Page-size descriptions now state Datadog's documented default of 10 and cap of 100
  instead of an arbitrary example, so an agent does not request an out-of-range page.
- trigger_synthetics_tests emitted an explicit null for a string-typed optional output,
  and update_synthetics_status reported 'live' on the error path regardless of what the
  caller actually requested.

* fix(datadog): keep mute_monitor and add the missing unmute counterpart

Reverses the removal in the previous commit. Absence from the datadog-api-client-go
generator spec showed the endpoint is unpublished there, not that it is retired:
Datadog's official Python client still implements it on master as
`Monitor.mute(id, scope=, end=)` and `Monitor.unmute(id, scope=, all_scopes=)`
(datadogpy datadog/api/monitors.py), which `_trigger_class_action` resolves to
`POST /api/v1/monitor/{id}/mute` and `/unmute` with exactly those body fields.

mute_monitor has also been in the block since #2175 in December, so dropping it would
have broken existing workflows for an endpoint that two independent sources agree is live.

The genuine defect was that muting was a one-way trapdoor: Sim could mute a monitor but
had no way to reverse it. Adds datadog_unmute_monitor, sharing the monitor ID and scope
inputs with mute, so the operation is recoverable from the same block.

Also: mute no longer discards the response body (it now reports the monitor id, name, and
state), routes errors through datadogErrorMessage, encodes the monitor ID in the path, and
stops dropping an explicit `end` of 0.

* fix(datadog): make downtime targeting explicit and reach downtime pagination from the block

Addresses the review findings on the previous round.

- create_downtime accepted both a monitor ID and monitor tags but `monitor_identifier` is a
  oneOf, so it silently kept the ID and dropped the tags, muting a different set of monitors
  than the caller asked for. It now rejects the ambiguous combination.
- create_downtime ran Number.parseInt on the monitor ID with no validation, so a non-numeric
  value became NaN and serialized as null inside monitor_identifier. It now uses the same
  parseMonitorIds guard the SLO path already had, naming the offending value.
- list_downtimes gained limit/offset in the tool but the block exposed neither, so no
  block-driven call could page past Datadog's default. Adds the two sub-blocks and wires them
  through the params mapper.
- The block did not declare the totalCount the tool now returns, so nothing downstream could
  bind to it.

* fix(datadog): tolerate non-string list inputs and keep the shipped mute subblock ids

Both defects were introduced by this branch.

- splitCommaList called .split on its argument, so routing create_downtime's monitorId
  through it turned a legitimate numeric input into a TypeError before the request was
  built. A <Block.output> reference to get_monitor or list_monitors resolves to a number,
  and an LLM tool call can pass a number or an array, so the helper now normalizes all
  three shapes. The previous Number.parseInt path had accepted a number by coercion.
- Adding the unmute operation renamed the mute subblock ids scope/end to muteScope/muteEnd.
  Workflow state is persisted by subblock id, so every existing Mute Monitor block would
  have kept the old keys and silently lost its scope and end time. Restored the shipped ids;
  both are still unique block-wide and no operation reads another operation's value.

* fix(datadog): compare downtime targets after parsing, not before

A whitespace-only Monitor ID is truthy as a raw string but parses to no monitor, so
the oneOf conflict guard rejected a valid tag-targeted downtime whenever the untouched
Monitor ID field carried blank text. Both sides are now compared after parsing.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/datadog.mdx

@@ -4933,7 +4933,11 @@
         },
         {
           "name": "Mute Monitor",
-          "description": "Mute a monitor to temporarily suppress notifications."
+          "description": "Mute a monitor to temporarily suppress its notifications. Use Unmute Monitor to reverse it, or schedule a downtime instead when you want a planned, auditable maintenance window."
+        },
+        {
+          "name": "Unmute Monitor",
+          "description": "Unmute a monitor so it resumes sending notifications. Reverses Mute Monitor, either for one scope or for every scope at once."
         },
         {
           "name": "Query Logs",
@@ -4954,9 +4958,121 @@
         {
           "name": "Cancel Downtime",
           "description": "Cancel a scheduled downtime."
+        },
+        {
+          "name": "List Incidents",
+          "description": "List incidents for the organization. Requires the Incident Management `incident_read` permission; the Incidents API is in public beta."
+        },
+        {
+          "name": "Get Incident",
+          "description": "Get the details of a single incident by ID. Requires the Incident Management `incident_read` permission; the Incidents API is in public beta."
+        },
+        {
+          "name": "Create Incident",
+          "description": "Declare a new incident. Requires the Incident Management `incident_write` permission; the Incidents API is in public beta."
+        },
+        {
+          "name": "Update Incident",
+          "description": "Partially update an existing incident. Requires the Incident Management `incident_write` permission; the Incidents API is in public beta."
+        },
+        {
+          "name": "Add Incident Todo",
+          "description": "Add a follow-up task (todo) to an incident. Requires the Incident Management `incident_write` permission; the Incidents API is in public beta."
+        },
+        {
+          "name": "List SLOs",
+          "description": "List service level objectives, optionally filtered by IDs, name, tags, or underlying metrics query."
+        },
+        {
+          "name": "Get SLO",
+          "description": "Get the configuration of a single service level objective by ID."
+        },
+        {
+          "name": "Create SLO",
+          "description": "Create a service level objective from a metric query, monitors, or a time-slice condition."
+        },
+        {
+          "name": "Update SLO",
+          "description": "Update a service level objective. Reads the current SLO first and applies only the fields you supply, so anything left blank keeps its stored value."
+        },
+        {
+          "name": "Delete SLO",
+          "description": "Permanently delete a service level objective. Datadog returns a conflict when the SLO is still referenced by a dashboard."
+        },
+        {
+          "name": "Get SLO History",
+          "description": "Get an SLO’s history over a time window, including the overall SLI value and remaining error budget."
+        },
+        {
+          "name": "List Dashboards",
+          "description": "List custom created or cloned dashboards. Datadog preset dashboards are not returned."
+        },
+        {
+          "name": "Get Dashboard",
+          "description": "Get the full definition of a dashboard, including its widgets."
+        },
+        {
+          "name": "Create Dashboard",
+          "description": "Create a dashboard from a title, layout type, and widget definitions."
+        },
+        {
+          "name": "Delete Dashboard",
+          "description": "Delete a dashboard by ID."
+        },
+        {
+          "name": "List Synthetic Tests",
+          "description": "List all Synthetic tests (API, browser, and mobile) with their current status."
+        },
+        {
+          "name": "Get Synthetic Test",
+          "description": "Get the configuration of a Synthetic test by public ID. Browser test steps are not included by this type-agnostic endpoint."
+        },
+        {
+          "name": "Get Synthetic Test Results",
+          "description": "Get the latest result summaries (up to the last 150 runs) for a Synthetic API test."
+        },
+        {
+          "name": "Get Browser Synthetic Test Results",
+          "description": "Get the latest result summaries (up to the last 150 runs) for a Synthetic browser test, including step counts and errors."
+        },
+        {
+          "name": "Trigger Synthetic Tests",
+          "description": "Trigger an immediate run of one or more Synthetic tests by public ID."
+        },
+        {
+          "name": "Pause Or Start Synthetic Test",
+          "description": "Pause or resume a Synthetic test by setting its status to \"paused\" or \"live\"."
+        },
+        {
+          "name": "List Security Signals",
+          "description": "Search Cloud SIEM security signals by query and time range. Requires the `security_monitoring_signals_read` permission."
+        },
+        {
+          "name": "Get Security Signal",
+          "description": "Get the details of a single Cloud SIEM security signal. Requires the `security_monitoring_signals_read` permission."
+        },
+        {
+          "name": "Update Security Signal State",
+          "description": "Change the triage state of a Cloud SIEM security signal to open, under_review, or archived. Requires the `security_monitoring_signals_write` permission."
+        },
+        {
+          "name": "Assign Security Signal",
+          "description": "Assign a Cloud SIEM security signal to a Datadog user by UUID. Requires the `security_monitoring_signals_write` permission."
+        },
+        {
+          "name": "List Security Rules",
+          "description": "List Cloud SIEM detection rules. Requires the `security_monitoring_rules_read` permission."
+        },
+        {
+          "name": "Search Spans",
+          "description": "Search indexed APM spans using the span query syntax, with cursor pagination."
+        },
+        {
+          "name": "List Services",
+          "description": "List service definitions from the Datadog Service Catalog. Requires the `apm_service_catalog_read` permission."
         }
       ],
-      "operationCount": 12,
+      "operationCount": 41,
       "triggers": [],
       "triggerCount": 0,
       "authType": "api-key",

apps/sim/blocks/blocks/datadog.ts

@@ -0,0 +1,127 @@
+import type { AddIncidentTodoParams, AddIncidentTodoResponse } from '@/tools/datadog/types'
+import {
+  datadogApiUrl,
+  datadogErrorMessage,
+  datadogHeaders,
+  splitCommaList,
+} from '@/tools/datadog/utils'
+import type { ToolConfig } from '@/tools/types'
+
+export const addIncidentTodoTool: ToolConfig<AddIncidentTodoParams, AddIncidentTodoResponse> = {
+  id: 'datadog_add_incident_todo',
+  name: 'Datadog Add Incident Todo',
+  description:
+    'Add a follow-up task (todo) to an incident. Requires the Incident Management `incident_write` permission; the Incidents API is in public beta.',
+  version: '1.0.0',
+
+  params: {
+    incidentId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'The UUID of the incident the todo belongs to',
+    },
+    content: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'The follow-up task content (e.g., "Restore lost data")',
+    },
+    assignees: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'Comma-separated assignee handles (e.g., "@jane@example.com,@on-call"). Datadog requires at least one assignee',
+    },
+    dueDate: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'ISO-8601 timestamp for when the todo should be completed',
+    },
+    apiKey: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'Datadog API key',
+    },
+    applicationKey: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'Datadog Application key',
+    },
+    site: {
+      type: 'string',
+      required: false,
+      visibility: 'user-only',
+      description: 'Datadog site/region (default: datadoghq.com)',
+    },
+  },
+
+  request: {
+    url: (params) =>
+      datadogApiUrl(
+        params.site,
+        `/api/v2/incidents/${encodeURIComponent(params.incidentId)}/relationships/todos`
+      ),
+    method: 'POST',
+    headers: datadogHeaders,
+    body: (params) => {
+      const attributes: Record<string, unknown> = {
+        content: params.content,
+        assignees: splitCommaList(params.assignees) ?? [],
+        incident_id: params.incidentId,
+      }
+      if (params.dueDate) attributes.due_date = params.dueDate
+
+      return { data: { type: 'incident_todos', attributes } }
+    },
+  },
+
+  transformResponse: async (response: Response) => {
+    if (!response.ok) {
+      return {
+        success: false,
+        output: { todo: { attributes: {} } },
+        error: await datadogErrorMessage(response),
+      }
+    }
+
+    const data = await response.json()
+
+    return {
+      success: true,
+      output: {
+        todo: {
+          id: data.data?.id,
+          type: data.data?.type,
+          attributes: data.data?.attributes ?? {},
+        },
+      },
+    }
+  },
+
+  outputs: {
+    todo: {
+      type: 'object',
+      description: 'The created incident todo',
+      properties: {
+        id: { type: 'string', description: 'Todo UUID' },
+        type: { type: 'string', description: 'Resource type (incident_todos)' },
+        attributes: {
+          type: 'object',
+          description: 'Todo attributes',
+          properties: {
+            content: { type: 'string', description: 'Task content' },
+            assignees: { type: 'array', description: 'Assignee handles' },
+            due_date: { type: 'string', description: 'Due date' },
+            completed: { type: 'string', description: 'Completion timestamp' },
+            incident_id: { type: 'string', description: 'UUID of the parent incident' },
+          },
+        },
+      },
+    },
+  },
+}

apps/sim/lib/integrations/integrations.json

@@ -1,4 +1,5 @@
 import type { CancelDowntimeParams, CancelDowntimeResponse } from '@/tools/datadog/types'
+import { datadogErrorMessage } from '@/tools/datadog/utils'
 import type { ToolConfig } from '@/tools/types'
 
 export const cancelDowntimeTool: ToolConfig<CancelDowntimeParams, CancelDowntimeResponse> = {
@@ -49,13 +50,13 @@ export const cancelDowntimeTool: ToolConfig<CancelDowntimeParams, CancelDowntime
 
   transformResponse: async (response: Response) => {
     if (!response.ok && response.status !== 204) {
-      const errorData = await response.json().catch(() => ({}))
+      const message = await datadogErrorMessage(response)
       return {
         success: false,
         output: {
           success: false,
         },
-        error: errorData.errors?.[0]?.detail || `HTTP ${response.status}: ${response.statusText}`,
+        error: message,
       }
     }