# Datadog

> Tell reviewers when a pull request changes code behind Datadog errors or touches a service with a monitor in alert: how it works, keys and storage.

When a pull request changes files that appear in the stack traces of your Datadog Error Tracking issues or recent APM error spans, or touches a service whose monitor is in alert, MergeHarbor gives that to the reviewer and notes it in the summary, for example: "This change touches code behind Datadog issue checkout: NullPointerException".

## How it works

- In the background, at most once an hour and only when reviews need it, MergeHarbor reads a small snapshot: Error Tracking issues from the last 14 days, recent APM error spans (the last 24 hours, up to 50), and the monitors currently in **Alert**.
- A review uses only the issues and spans whose stack frames or file paths are in files the pull request changes, and the monitors in alert for the repository's services. Reviews never wait for Datadog, and no extra model call is made.
- MergeHarbor follows Datadog's rate-limit headers: when a limit is reached it waits until it resets and uses the last snapshot.

### Which services belong to a repository

Open **Settings** on **Datadog** and map each repository to its Datadog services. Without a mapping, MergeHarbor uses services named like the repository and services whose spans carry its `git.repository_url` tag (set by Datadog's source code integration). You can also choose an `env` (for example `prod`) to read only that environment.

## Connect

1. In Datadog, open **Organization Settings → API Keys** and create an API key for MergeHarbor.
2. Open **Organization Settings → Application Keys**, choose **New Key**, and limit its scopes to `monitors_read`, `error_tracking_read` and `apm_read`. MergeHarbor only reads; it needs no other scope.
3. In the console, open **Integrations** and choose **Connect** on **Datadog** (under **Observability & incidents**). You need the `settings.manage` permission.
4. Paste both keys and pick your Datadog site: US1 (`datadoghq.com`), US3, US5, EU1 (`datadoghq.eu`), AP1 or US1-FED (`ddog-gov.com`).
5. Choose **Test connection**.

## What is read and stored

Issue and span error type and message, service, resource, the file, function and line of stack frames, counts and last seen time, and monitor names, states and tags. Log lines, span payloads beyond the error and stack, and metrics are not read. The snapshot is kept until the next refresh and never written to logs. Both keys are encrypted at rest and never shown again.

## Disconnect

Open the integration in **Integrations** and choose **Disconnect**. MergeHarbor deletes the keys and the snapshot. Then delete the application key in Datadog, since MergeHarbor cannot revoke it.

## Self-hosted installations

Datadog needs no OAuth application: set `DATADOG_ENABLED=true` on the API and workers to offer it in the console. `DATADOG_SYNC_INTERVAL` (default `1h`) sets how often the snapshot may refresh.