datadog-incidents

johnnymo87's avatarfrom johnnymo87

Work with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd get-incident/update-incident commands.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 2, 2026
[Incident Response]

When & Why to Use This Skill

This Claude skill enables seamless interaction with the Datadog Incidents API, allowing users to fetch, enrich, and update incident data directly through an AI-powered interface. It streamlines the incident management lifecycle by providing human-readable details, Slack/Jira integration links, and the ability to modify incident status, severity, and custom fields, significantly reducing the Mean Time to Resolve (MTTR) for SRE and DevOps teams.

Use Cases

  • Rapid Incident Retrieval: Quickly fetch detailed incident information using public IDs to assess current status, impact scope, and assigned responders without leaving the terminal or chat interface.
  • Contextual Data Enrichment: Automatically transform technical UUIDs into human-readable user names and emails, and pull in linked Slack channels or Jira tickets for immediate cross-team coordination.
  • Real-time Incident Updates: Efficiently update incident severity (e.g., SEV-1 to SEV-2), transition states to 'stable' or 'resolved', and document root causes in custom fields during active troubleshooting sessions.
  • Automated Reporting and Analysis: Use the skill to extract structured incident data for post-mortem documentation or to understand complex incident data structures for better reporting.
namedatadog-incidents
descriptionWork with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd get-incident/update-incident commands.

Datadog Incidents API

CLI Commands

# Get incident by ID (public ID like 152, or UUID)
dd get-incident 152

# Get enriched incident with user details
dd get-incident 152 --include users

# Get fully enriched with incident type and integrations
dd get-incident 152 --include users --enrich

# Update incident
dd update-incident 152 --title "New Title" --severity SEV-2 --state resolved

Enrichment Levels

Basic (no flags)

Returns incident data with UUIDs for users - less useful for human analysis.

With --include users

Transforms user references:

"created_by": {
  "data": {
    "type": "users",
    "id": "0082a465-...",
    "attributes": {
      "name": "Peter Chang",
      "email": "peterc@wonder.com"
    }
  }
}

With --enrich

Adds enrichment section with:

  • Incident type: Name, description, prefix
  • Integrations: Slack channels, Jira tickets with direct links

Update Fields

Standard fields

  • --title - Incident title
  • --severity - SEV-1, SEV-2, etc.
  • --state - active, stable, resolved
  • --customer-impacted - true/false
  • --customer-impact-scope - Description of impact

Custom fields

dd update-incident 152 --field "root_cause=Database timeout" --field "teams=backend"

Key Notes

  • CLI accepts public IDs: Use 152 instead of full UUID
  • API requires UUIDs: CLI handles conversion internally
  • Permission requirements: App key owner needs incident management permissions
  • The include parameter only works for users and attachments

curl Examples

# Get with user enrichment
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID?include=users" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Get integrations (Slack/Jira)
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID/relationships/integrations" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Get incident type config
curl -X GET "https://api.$DD_SITE/api/v2/incidents/config/types/$TYPE_UUID" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"