--- title: "Create a monitor" method: POST path: "/api/v1/monitor" tags: ["Monitors"] --- # Create a monitor `POST /api/v1/monitor` Create a monitor using the specified options. #### Monitor Types The type of monitor chosen from: - anomaly: `query alert` - APM: `query alert` or `trace-analytics alert` - composite: `composite` - custom: `service check` - forecast: `query alert` - host: `service check` - integration: `query alert` or `service check` - live process: `process alert` - logs: `log alert` - metric: `query alert` - network: `service check` - outlier: `query alert` - process: `service check` - rum: `rum alert` - SLO: `slo alert` - watchdog: `event-v2 alert` - event-v2: `event-v2 alert` - audit: `audit alert` - error-tracking: `error-tracking alert` - database-monitoring: `database-monitoring alert` - network-performance: `network-performance alert` - cloud cost: `cost alert` - network-path: `network-path alert` **Notes**: - Synthetic monitors are created through the Synthetics API. See the [Synthetics API](https://docs.datadoghq.com/api/latest/synthetics/) documentation for more information. - Log monitors require an unscoped App Key. #### Query Types ##### Metric Alert Query Example: `time_aggr(time_window):space_aggr:metric{tags} [by {key}] operator #` - `time_aggr`: avg, sum, max, min, change, or pct_change - `time_window`: `last_#m` (with `#` between 1 and 10080 depending on the monitor type) or `last_#h`(with `#` between 1 and 168 depending on the monitor type) or `last_1d`, or `last_1w` - `space_aggr`: avg, sum, min, or max - `tags`: one or more tags (comma-separated), or * - `key`: a 'key' in key:value tag syntax; defines a separate alert for each tag in the group (multi-alert) - `operator`: <, <=, >, >=, ==, or != - `#`: an integer or decimal number used to set the threshold To use a dynamic threshold on a metric monitor with a formula query, replace `#` with the `threshold` keyword (for example, `... > threshold`) and provide the threshold as a query via `critical_query` on `options.thresholds`. This feature is in preview. If you are using the `_change_` or `_pct_change_` time aggregator, instead use `change_aggr(time_aggr(time_window), timeshift):space_aggr:metric{tags} [by {key}] operator #` with: - `change_aggr` change, pct_change - `time_aggr` avg, sum, max, min [Learn more](https://docs.datadoghq.com/monitors/create/types/#define-the-conditions) - `time_window` last\_#m (between 1 and 2880 depending on the monitor type), last\_#h (between 1 and 48 depending on the monitor type), or last_#d (1 or 2) - `timeshift` #m_ago (5, 10, 15, or 30), #h_ago (1, 2, or 4), or 1d_ago Use this to create an outlier monitor using the following query: `avg(last_30m):outliers(avg:system.cpu.user{role:es-events-data} by {host}, 'dbscan', 7) > 0` ##### Service Check Query Example: `"check".over(tags).last(count).by(group).count_by_status()` - `check` name of the check, for example `datadog.agent.up` - `tags` one or more quoted tags (comma-separated), or "*". for example: `.over("env:prod", "role:db")`; `over` cannot be blank. - `count` must be at greater than or equal to your max threshold (defined in the `options`). It is limited to 100. For example, if you've specified to notify on 1 critical, 3 ok, and 2 warn statuses, `count` should be at least 3. - `group` must be specified for check monitors. Per-check grouping is already explicitly known for some service checks. For example, Postgres integration monitors are tagged by `db`, `host`, and `port`, and Network monitors by `host`, `instance`, and `url`. See [Service Checks](https://docs.datadoghq.com/api/latest/service-checks/) documentation for more information. ##### Event Alert Query **Note:** The Event Alert Query has been replaced by the Event V2 Alert Query. For more information, see the [Event Migration guide](https://docs.datadoghq.com/service_management/events/guides/migrating_to_new_events_features/). ##### Event V2 Alert Query Example: `events(query).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `rollup_method` The stats roll-up method - supports `count`, `avg` and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. ##### Process Alert Query Example: `processes(search).over(tags).rollup('count').last(timeframe) operator #` - `search` free text search string for querying processes. Matching processes match results on the [Live Processes](https://docs.datadoghq.com/infrastructure/process/?tab=linuxwindows) page. - `tags` one or more tags (comma-separated) - `timeframe` the timeframe to roll up the counts. Examples: 10m, 4h. Supported timeframes: s, m, h and d - `operator` <, <=, >, >=, ==, or != - `#` an integer or decimal number used to set the threshold ##### Logs Alert Query Example: `logs(query).index(index_name).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `index_name` For multi-index organizations, the log index in which the request is performed. - `rollup_method` The stats roll-up method - supports `count`, `avg` and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. ##### Composite Query Example: `12345 && 67890`, where `12345` and `67890` are the IDs of non-composite monitors * `name` [*required*, *default* = **dynamic, based on query**]: The name of the alert. * `message` [*required*, *default* = **dynamic, based on query**]: A message to include with notifications for this monitor. Email notifications can be sent to specific users by using the same '@username' notation as events. * `tags` [*optional*, *default* = **empty list**]: A list of tags to associate with your monitor. When getting all monitor details via the API, use the `monitor_tags` argument to filter results by these tags. It is only available via the API and isn't visible or editable in the Datadog UI. ##### SLO Alert Query Example: `error_budget("slo_id").over("time_window") operator #` - `slo_id`: The alphanumeric SLO ID of the SLO you are configuring the alert for. - `time_window`: The time window of the SLO target you wish to alert on. Valid options: `7d`, `30d`, `90d`. - `operator`: `>=` or `>` ##### Audit Alert Query Example: `audits(query).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `rollup_method` The stats roll-up method - supports `count`, `avg` and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. ##### CI Pipelines Alert Query Example: `ci-pipelines(query).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `rollup_method` The stats roll-up method - supports `count`, `avg`, and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. ##### CI Tests Alert Query Example: `ci-tests(query).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `rollup_method` The stats roll-up method - supports `count`, `avg`, and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. ##### Error Tracking Alert Query "New issue" example: `error-tracking(query).source(issue_source).new().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator #` "High impact issue" example: `error-tracking(query).source(issue_source).impact().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `issue_source` The issue source - supports `all`, `browser`, `mobile` and `backend` and defaults to `all` if omitted. - `rollup_method` The stats roll-up method - supports `count`, `avg`, and `cardinality` and defaults to `count` if omitted. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `group by` Comma-separated list of attributes to group by - should contain at least `issue.id`. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. **Database Monitoring Alert Query** Example: `database-monitoring(query).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `rollup_method` The stats roll-up method - supports `count`, `avg`, and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. **Network Performance Alert Query** Example: `network-performance(query).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `rollup_method` The stats roll-up method - supports `count`, `avg`, and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. **Cost Alert Query** Example: `formula(query).timeframe_type(time_window).function(parameter) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `timeframe_type` The timeframe type to evaluate the cost - for `forecast` supports `current` - for `change`, `anomaly`, `threshold` supports `last` - `time_window` - supports daily roll-up e.g. `7d` - `function` - [optional, defaults to `threshold` monitor if omitted] supports `change`, `anomaly`, `forecast` - `parameter` Specify the parameter of the type - for `change`: - supports `relative`, `absolute` - [optional] supports `#`, where `#` is an integer or decimal number used to set the threshold - for `anomaly`: - supports `direction=both`, `direction=above`, `direction=below` - [optional] supports `threshold=#`, where `#` is an integer or decimal number used to set the threshold - `operator` - for `threshold` supports `<`, `<=`, `>`, `>=`, `==`, or `!=` - for `change` supports `>`, `<` - for `anomaly` supports `>=` - for `forecast` supports `>` - `#` an integer or decimal number used to set the threshold. **Network Path Alert Query** Example: `network-path(query).index(index_name).rollup(rollup_method[, measure]).last(time_window) operator #` - `query` The search query - following the [Log search syntax](https://docs.datadoghq.com/logs/search_syntax/). - `index_name` The data type to monitor on - supports `netpath-path` and `netpath-hop`. - `rollup_method` The stats roll-up method - supports `count`, `avg`, and `cardinality`. - `measure` For `avg` and cardinality `rollup_method` - specify the measure or the facet name you want to use. - `time_window` #m (between 1 and 2880), #h (between 1 and 48). - `operator` `<`, `<=`, `>`, `>=`, `==`, or `!=`. - `#` an integer or decimal number used to set the threshold. ## Request body - Monitor — Object describing a monitor. - `assets` MonitorAsset[] — The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks). - `category` 'runbook', required — Indicates the type of asset this entity represents on a monitor. - `name` string, required — Name for the monitor asset - `resource_key` string — Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings. - `resource_type` 'notebook' — Type of internal Datadog resource associated with a monitor asset. - `url` string, required — URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path. - `created` string, date-time — Timestamp of the monitor creation. - `creator` Creator — Object describing the creator of the shared element. - `email` string — Email of the creator. - `handle` string — Handle of the creator. - `name` string, nullable — Name of the creator. - `deleted` string, date-time, nullable — Whether or not the monitor is deleted. (Always `null`) - `draft_status` 'draft' | 'published' — Indicates whether the monitor is in a draft or published state. `draft`: The monitor appears as Draft and does not send notifications. `published`: The monitor is active and evaluates conditions and notify as configured. This field is in preview. The draft value is only available to customers with the feature enabled. - `id` integer — ID of this monitor. - `matching_downtimes` MatchingDowntime[] — A list of active v1 downtimes that match this monitor. - `end` integer, nullable — POSIX timestamp to end the downtime. - `id` integer, required — The downtime ID. - `scope` string[] — The scope(s) to which the downtime applies. Must be in `key:value` format. For example, `host:app2`. Provide multiple scopes as a comma-separated list like `env:dev,env:prod`. The resulting downtime applies to sources that matches ALL provided scopes (`env:dev` **AND** `env:prod`). - `start` integer — POSIX timestamp to start the downtime. - `message` string — A message to include with notifications for this monitor. - `modified` string, date-time — Last timestamp when the monitor was edited. - `multi` boolean — Whether or not the monitor is broken down on different groups. - `name` string — The monitor name. - `options` MonitorOptions — List of options associated with your monitor. - `aggregation` MonitorOptionsAggregation — Type of aggregation performed in the monitor query. - `group_by` string — Group to break down the monitor on. - `metric` string — Metric name used in the monitor. - `type` string — Metric type used in the monitor. - `device_ids` MonitorDeviceID[] — IDs of the device the Synthetics monitor is running on. - `enable_logs_sample` boolean — Whether or not to send a log sample when the log monitor triggers. - `enable_samples` boolean — Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors. - `escalation_message` string — We recommend using the [is_renotify](https://docs.datadoghq.com/monitors/notify/?tab=is_alert#renotify), block in the original message instead. A message to include with a re-notification. Supports the `@username` notification we allow elsewhere. Not applicable if `renotify_interval` is `None`. - `evaluation_delay` integer, nullable — Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to `300` (5min), the timeframe is set to `last_5m` and the time is 7:00, the monitor evaluates data from 6:50 to 6:55. This is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation. - `group_retention_duration` string — The time span after which groups with missing data are dropped from the monitor state. The minimum value is one hour, and the maximum value is 72 hours. Example values are: "60m", "1h", and "2d". This option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. - `groupby_simple_monitor` boolean — Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use `notify_by` instead. - `include_tags` boolean — A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title. **Examples** - If `True`, `[Triggered on {host:h1}] Monitor Title` - If `False`, `[Triggered] Monitor Title` - `locked` boolean — Whether or not the monitor is locked (only editable by creator and admins). Use `restricted_roles` instead. - `min_failure_duration` integer, nullable — How long the test should be in failure before alerting (integer, number of seconds, max 7200). - `min_location_failed` integer, nullable — The minimum number of locations in failure at the same time during at least one moment in the `min_failure_duration` period (`min_location_failed` and `min_failure_duration` are part of the advanced alerting rules - integer, >= 1). - `new_group_delay` integer, nullable — Time (in seconds) to skip evaluations for new groups. For example, this option can be used to skip evaluations for new hosts while they initialize. Must be a non negative integer. - `new_host_delay` integer, nullable — Time (in seconds) to allow a host to boot and applications to fully start before starting the evaluation of monitor results. Should be a non negative integer. Use new_group_delay instead. - `no_data_timeframe` integer, nullable — The number of minutes before a monitor notifies after data stops reporting. Datadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks. If omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks. - `notification_preset_name` 'show_all' | 'hide_query' | 'hide_handles' | 'hide_all' | 'hide_query_and_handles' | 'show_only_snapshot' | 'hide_handles_and_footer' — Toggles the display of additional content sent in the monitor notification. - `notify_audit` boolean — A Boolean indicating whether tagged users is notified on changes to this monitor. - `notify_by` string[] — Controls what granularity a monitor alerts on. Only available for monitors with groupings. For instance, a monitor grouped by `cluster`, `namespace`, and `pod` can be configured to only notify on each new `cluster` violating the alert conditions by setting `notify_by` to `["cluster"]`. Tags mentioned in `notify_by` must be a subset of the grouping tags in the query. For example, a query grouped by `cluster` and `namespace` cannot notify on `region`. Setting `notify_by` to `["*"]` configures the monitor to notify as a simple-alert. - `notify_no_data` boolean — A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to `false`. - `on_missing_data` 'default' | 'show_no_data' | 'show_and_notify_no_data' | 'resolve' — Controls how groups or monitors are treated if an evaluation does not return any data points. The default option results in different behavior depending on the monitor query type. For monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions. For monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status. This option is available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. It is also required for metric monitors that use `scheduling_options.custom_schedule`. - `renotify_interval` integer, nullable — The number of minutes after the last notification before a monitor re-notifies on the current status. It only re-notifies if it’s not resolved. - `renotify_occurrences` integer, nullable — The number of times re-notification messages should be sent on the current status at the provided re-notification interval. - `renotify_statuses` MonitorRenotifyStatusType[], nullable — The types of monitor statuses for which re-notification messages are sent. Default: **null** if `renotify_interval` is **null**. If `renotify_interval` is set, defaults to renotify on `Alert` and `No Data`. - `require_full_window` boolean — A Boolean indicating whether this monitor needs a full window of data before it’s evaluated. We highly recommend you set this to `false` for sparse metrics, otherwise some evaluations are skipped. Default is false. This setting only applies to metric monitors. - `scheduling_options` MonitorOptionsSchedulingOptions — Configuration options for scheduling. - `custom_schedule` MonitorOptionsCustomSchedule — Configuration options for the custom schedule. **This feature is in private beta.** - `recurrences` MonitorOptionsCustomScheduleRecurrence[] — Array of custom schedule recurrences. - `rrule` string — Defines the recurrence rule (RRULE) for a given schedule. - `start` string — Defines the start date and time of the recurring schedule. - `timezone` string — Defines the timezone the schedule runs on. - `evaluation_window` MonitorOptionsSchedulingOptionsEvaluationWindow — Configuration options for the evaluation window. If `hour_starts` is set, no other fields may be set. Otherwise, `day_starts` and `month_starts` must be set together. - `day_starts` string — The time of the day at which a one day cumulative evaluation window starts. - `hour_starts` integer — The minute of the hour at which a one hour cumulative evaluation window starts. - `month_starts` integer — The day of the month at which a one month cumulative evaluation window starts. - `timezone` string — The timezone of the time of the day of the cumulative evaluation window start. - `silenced` object — Information about the downtime applied to the monitor. Only shows v1 downtimes. - `synthetics_check_id` string, nullable — ID of the corresponding Synthetic check. - `threshold_windows` MonitorThresholdWindowOptions — Alerting time window options. - `recovery_window` string, nullable — Describes how long an anomalous metric must be normal before the alert recovers. - `trigger_window` string, nullable — Describes how long a metric must be anomalous before an alert triggers. - `thresholds` MonitorThresholds — List of the different monitor threshold available. - `critical` number, double — The monitor `CRITICAL` threshold. - `critical_query` string — Query evaluated as a dynamic `CRITICAL` threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview. - `critical_recovery` number, double, nullable — The monitor `CRITICAL` recovery threshold. - `critical_recovery_query` string — Query evaluated as a dynamic `CRITICAL` recovery threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview. - `ok` number, double, nullable — The monitor `OK` threshold. - `unknown` number, double, nullable — The monitor UNKNOWN threshold. - `warning` number, double, nullable — The monitor `WARNING` threshold. - `warning_recovery` number, double, nullable — The monitor `WARNING` recovery threshold. - `timeout_h` integer, nullable — The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours. - `variables` MonitorFormulaAndFunctionQueryDefinition[] — List of requests that can be used in the monitor query. **This feature is currently in beta.** - union — A formula and function query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - `compute` MonitorFormulaAndFunctionEventQueryDefinitionCompute, required — Compute options. - `aggregation` 'count' | 'cardinality' | 'median' | 'pc75' | 'pc90' | 'pc95' | 'pc98' | 'pc99' | 'sum' | 'min' | 'max' | 'avg', required — Aggregation methods for event platform queries. - `interval` integer — A time interval in milliseconds. - `metric` string — Measurable attribute to compute. - `name` string — The name assigned to this aggregation, when multiple aggregations are defined for a query. - `source` string — Source reference for composite query payloads. - `data_source` 'rum' | 'ci_pipelines' | 'ci_tests' | 'audit' | 'events' | 'logs' | 'spans' | 'database_queries' | 'network' | 'network_path', required — Data source for event platform-based queries. - `group_by` MonitorFormulaAndFunctionEventQueryGroupBy[] — Group by options. - `facet` string, required — Event facet. - `limit` integer — Number of groups to return. - `sort` MonitorFormulaAndFunctionEventQueryGroupBySort — Options for sorting group by results. - … - `source` string — Source reference for composite query payloads. - `indexes` string[] — An array of index names to query in the stream. Omit or use `[]` to query all indexes at once. - `name` string, required — Name of the query for use in formulas. - `search` MonitorFormulaAndFunctionEventQueryDefinitionSearch — Search options. - `query` string, required — Events search string. - MonitorFormulaAndFunctionCostQueryDefinition — A formula and functions cost query. - `aggregator` 'avg' | 'sum' | 'max' | 'min' | 'last' | 'area' | 'l2norm' | 'percentile' | 'stddev' — Aggregation methods for metric queries. - `data_source` 'metrics' | 'cloud_cost' | 'datadog_usage', required — Data source for cost queries. - `name` string, required — Name of the query for use in formulas. - `query` string, required — The monitor query. - MonitorFormulaAndFunctionDataQualityQueryDefinition — A formula and functions data quality query. - `data_source` 'data_quality_metrics', required — Data source for data quality queries. - `filter` string, required — Filter expression used to match on data entities. Uses Aastra query syntax. - `group_by` string[] — Optional grouping fields for aggregation. - `measure` string, required — The data quality measure to query. Common values include: `bytes`, `cardinality`, `custom`, `freshness`, `max`, `mean`, `min`, `nullness`, `percent_negative`, `percent_zero`, `row_count`, `stddev`, `sum`, `uniqueness`. Additional values may be supported. - `monitor_options` MonitorFormulaAndFunctionDataQualityMonitorOptions — Monitor configuration options for data quality queries. - `crontab_override` string — Crontab expression to override the default schedule. - `custom_sql` string — Custom SQL query for the monitor. - `custom_where` string — Custom WHERE clause for the query. - `group_by_columns` string[] — Columns to group results by. - `model_type_override` 'freshness' | 'percentage' | 'any' — Override for the model type used in anomaly detection. - `name` string, required — Name of the query for use in formulas. - `schema_version` string — Schema version for the data quality query. - `scope` string — Optional scoping expression to further filter metrics. Uses metrics filter syntax. This is useful when an entity has been configured to emit metrics with additional tags. - MonitorFormulaAndFunctionDataJobsQueryDefinition — A formula and functions data jobs query. - `job_type` string, required — The type of job being monitored. Valid values include: `databricks.job`, `spark.application`, `airflow.dag`, `dbt.job`, `dbt.model`, `dbt.test`, `glue.job`. Custom job types are supported with the `custom.ol.` prefix. - `jobs_query` string, required — Filter expression used to select the jobs to monitor. - `name` string, required — Name of the query for use in formulas. Must be `run_query`. - `query_dialect` string, required — Query dialect for data jobs queries. Currently only `metric` is supported. - MonitorFormulaAndFunctionAggregateAugmentedQueryDefinition — A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table. - `augment_query` union, required — Augment query for aggregate augmented queries. Can be an events query or a reference table query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionReferenceTableQueryDefinition — A reference table query for use in aggregate queries. - … - `base_query` union, required — Base query for aggregate queries. Can be an events query or a metrics query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionMetricsQueryDefinition — A formula and functions metrics query for use in aggregate queries. - … - `compute` MonitorFormulaAndFunctionEventQueryDefinitionCompute[], required — Compute options for the query. - `aggregation` 'count' | 'cardinality' | 'median' | 'pc75' | 'pc90' | 'pc95' | 'pc98' | 'pc99' | 'sum' | 'min' | 'max' | 'avg', required — Aggregation methods for event platform queries. - `interval` integer — A time interval in milliseconds. - `metric` string — Measurable attribute to compute. - `name` string — The name assigned to this aggregation, when multiple aggregations are defined for a query. - `source` string — Source reference for composite query payloads. - `data_source` 'aggregate_augmented_query', required — Data source for aggregate augmented queries. - `group_by` MonitorFormulaAndFunctionEventQueryGroupBy[], required — Group by options for the query. - `facet` string, required — Event facet. - `limit` integer — Number of groups to return. - `sort` MonitorFormulaAndFunctionEventQueryGroupBySort — Options for sorting group by results. - … - `source` string — Source reference for composite query payloads. - `join_condition` MonitorFormulaAndFunctionAggregateQueryJoinCondition, required — Join condition for aggregate augmented queries. - `augment_attribute` string, required — Attribute from the augment query to join on. - `base_attribute` string, required — Attribute from the base query to join on. - `join_type` 'inner' | 'left', required — Join type for aggregate query join conditions. - `name` string — Name of the query for use in formulas. - MonitorFormulaAndFunctionAggregateFilteredQueryDefinition — A formula and functions aggregate filtered query. Used to filter base query results using data from another source. - `base_query` union, required — Base query for aggregate queries. Can be an events query or a metrics query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionMetricsQueryDefinition — A formula and functions metrics query for use in aggregate queries. - … - `compute` MonitorFormulaAndFunctionEventQueryDefinitionCompute[] — Compute options for the query. - `aggregation` 'count' | 'cardinality' | 'median' | 'pc75' | 'pc90' | 'pc95' | 'pc98' | 'pc99' | 'sum' | 'min' | 'max' | 'avg', required — Aggregation methods for event platform queries. - `interval` integer — A time interval in milliseconds. - `metric` string — Measurable attribute to compute. - `name` string — The name assigned to this aggregation, when multiple aggregations are defined for a query. - `source` string — Source reference for composite query payloads. - `data_source` 'aggregate_filtered_query', required — Data source for aggregate filtered queries. - `filter_query` union, required — Filter query for aggregate filtered queries. Can be an events query or a reference table query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionReferenceTableQueryDefinition — A reference table query for use in aggregate queries. - … - `filters` MonitorFormulaAndFunctionAggregateQueryFilter[], required — Filter conditions for the query. - `base_attribute` string, required — Attribute from the base query to filter on. - `exclude` boolean — Whether to exclude matching records instead of including them. - `filter_attribute` string, required — Attribute from the filter query to match against. - `group_by` MonitorFormulaAndFunctionEventQueryGroupBy[] — Group by options for the query. - `facet` string, required — Event facet. - `limit` integer — Number of groups to return. - `sort` MonitorFormulaAndFunctionEventQueryGroupBySort — Options for sorting group by results. - … - `source` string — Source reference for composite query payloads. - `name` string — Name of the query for use in formulas. - `overall_state` 'Alert' | 'Ignored' | 'No Data' | 'OK' | 'Skipped' | 'Unknown' | 'Warn' — The different states your monitor can be in. - `priority` integer, nullable — Integer from 1 (high) to 5 (low) indicating alert severity. - `query` string, required — The monitor query. - `restricted_roles` string[], nullable — A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the [Roles API](https://docs.datadoghq.com/api/latest/roles/#list-roles) and are located in the `data.id` field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the [Restriction Policies API](https://docs.datadoghq.com/api/latest/restriction-policies/) to manage write authorization for individual monitors by teams and users, in addition to roles. - `state` MonitorState — Wrapper object with the different monitor states. - `groups` object — Dictionary where the keys are groups (comma separated lists of tags) and the values are the list of groups your monitor is broken down on. - `tags` string[] — Tags associated to your monitor. - `type` 'composite' | 'event alert' | 'log alert' | 'metric alert' | 'process alert' | 'query alert' | 'rum alert' | 'service check' | 'synthetics alert' | 'trace-analytics alert' | 'slo alert' | 'event-v2 alert' | 'audit alert' | 'ci-pipelines alert' | 'ci-tests alert' | 'error-tracking alert' | 'database-monitoring alert' | 'network-performance alert' | 'cost alert' | 'data-quality alert' | 'network-path alert' | 'data-jobs alert', required — The type of the monitor. For more information about `type`, see the [monitor options](https://docs.datadoghq.com/monitors/guide/monitor_api_options/) docs. ## Response `200` OK - Monitor — Object describing a monitor. - `assets` MonitorAsset[] — The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks). - `category` 'runbook', required — Indicates the type of asset this entity represents on a monitor. - `name` string, required — Name for the monitor asset - `resource_key` string — Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings. - `resource_type` 'notebook' — Type of internal Datadog resource associated with a monitor asset. - `url` string, required — URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path. - `created` string, date-time — Timestamp of the monitor creation. - `creator` Creator — Object describing the creator of the shared element. - `email` string — Email of the creator. - `handle` string — Handle of the creator. - `name` string, nullable — Name of the creator. - `deleted` string, date-time, nullable — Whether or not the monitor is deleted. (Always `null`) - `draft_status` 'draft' | 'published' — Indicates whether the monitor is in a draft or published state. `draft`: The monitor appears as Draft and does not send notifications. `published`: The monitor is active and evaluates conditions and notify as configured. This field is in preview. The draft value is only available to customers with the feature enabled. - `id` integer — ID of this monitor. - `matching_downtimes` MatchingDowntime[] — A list of active v1 downtimes that match this monitor. - `end` integer, nullable — POSIX timestamp to end the downtime. - `id` integer, required — The downtime ID. - `scope` string[] — The scope(s) to which the downtime applies. Must be in `key:value` format. For example, `host:app2`. Provide multiple scopes as a comma-separated list like `env:dev,env:prod`. The resulting downtime applies to sources that matches ALL provided scopes (`env:dev` **AND** `env:prod`). - `start` integer — POSIX timestamp to start the downtime. - `message` string — A message to include with notifications for this monitor. - `modified` string, date-time — Last timestamp when the monitor was edited. - `multi` boolean — Whether or not the monitor is broken down on different groups. - `name` string — The monitor name. - `options` MonitorOptions — List of options associated with your monitor. - `aggregation` MonitorOptionsAggregation — Type of aggregation performed in the monitor query. - `group_by` string — Group to break down the monitor on. - `metric` string — Metric name used in the monitor. - `type` string — Metric type used in the monitor. - `device_ids` MonitorDeviceID[] — IDs of the device the Synthetics monitor is running on. - `enable_logs_sample` boolean — Whether or not to send a log sample when the log monitor triggers. - `enable_samples` boolean — Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors. - `escalation_message` string — We recommend using the [is_renotify](https://docs.datadoghq.com/monitors/notify/?tab=is_alert#renotify), block in the original message instead. A message to include with a re-notification. Supports the `@username` notification we allow elsewhere. Not applicable if `renotify_interval` is `None`. - `evaluation_delay` integer, nullable — Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to `300` (5min), the timeframe is set to `last_5m` and the time is 7:00, the monitor evaluates data from 6:50 to 6:55. This is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation. - `group_retention_duration` string — The time span after which groups with missing data are dropped from the monitor state. The minimum value is one hour, and the maximum value is 72 hours. Example values are: "60m", "1h", and "2d". This option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. - `groupby_simple_monitor` boolean — Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use `notify_by` instead. - `include_tags` boolean — A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title. **Examples** - If `True`, `[Triggered on {host:h1}] Monitor Title` - If `False`, `[Triggered] Monitor Title` - `locked` boolean — Whether or not the monitor is locked (only editable by creator and admins). Use `restricted_roles` instead. - `min_failure_duration` integer, nullable — How long the test should be in failure before alerting (integer, number of seconds, max 7200). - `min_location_failed` integer, nullable — The minimum number of locations in failure at the same time during at least one moment in the `min_failure_duration` period (`min_location_failed` and `min_failure_duration` are part of the advanced alerting rules - integer, >= 1). - `new_group_delay` integer, nullable — Time (in seconds) to skip evaluations for new groups. For example, this option can be used to skip evaluations for new hosts while they initialize. Must be a non negative integer. - `new_host_delay` integer, nullable — Time (in seconds) to allow a host to boot and applications to fully start before starting the evaluation of monitor results. Should be a non negative integer. Use new_group_delay instead. - `no_data_timeframe` integer, nullable — The number of minutes before a monitor notifies after data stops reporting. Datadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks. If omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks. - `notification_preset_name` 'show_all' | 'hide_query' | 'hide_handles' | 'hide_all' | 'hide_query_and_handles' | 'show_only_snapshot' | 'hide_handles_and_footer' — Toggles the display of additional content sent in the monitor notification. - `notify_audit` boolean — A Boolean indicating whether tagged users is notified on changes to this monitor. - `notify_by` string[] — Controls what granularity a monitor alerts on. Only available for monitors with groupings. For instance, a monitor grouped by `cluster`, `namespace`, and `pod` can be configured to only notify on each new `cluster` violating the alert conditions by setting `notify_by` to `["cluster"]`. Tags mentioned in `notify_by` must be a subset of the grouping tags in the query. For example, a query grouped by `cluster` and `namespace` cannot notify on `region`. Setting `notify_by` to `["*"]` configures the monitor to notify as a simple-alert. - `notify_no_data` boolean — A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to `false`. - `on_missing_data` 'default' | 'show_no_data' | 'show_and_notify_no_data' | 'resolve' — Controls how groups or monitors are treated if an evaluation does not return any data points. The default option results in different behavior depending on the monitor query type. For monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions. For monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status. This option is available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. It is also required for metric monitors that use `scheduling_options.custom_schedule`. - `renotify_interval` integer, nullable — The number of minutes after the last notification before a monitor re-notifies on the current status. It only re-notifies if it’s not resolved. - `renotify_occurrences` integer, nullable — The number of times re-notification messages should be sent on the current status at the provided re-notification interval. - `renotify_statuses` MonitorRenotifyStatusType[], nullable — The types of monitor statuses for which re-notification messages are sent. Default: **null** if `renotify_interval` is **null**. If `renotify_interval` is set, defaults to renotify on `Alert` and `No Data`. - `require_full_window` boolean — A Boolean indicating whether this monitor needs a full window of data before it’s evaluated. We highly recommend you set this to `false` for sparse metrics, otherwise some evaluations are skipped. Default is false. This setting only applies to metric monitors. - `scheduling_options` MonitorOptionsSchedulingOptions — Configuration options for scheduling. - `custom_schedule` MonitorOptionsCustomSchedule — Configuration options for the custom schedule. **This feature is in private beta.** - `recurrences` MonitorOptionsCustomScheduleRecurrence[] — Array of custom schedule recurrences. - `rrule` string — Defines the recurrence rule (RRULE) for a given schedule. - `start` string — Defines the start date and time of the recurring schedule. - `timezone` string — Defines the timezone the schedule runs on. - `evaluation_window` MonitorOptionsSchedulingOptionsEvaluationWindow — Configuration options for the evaluation window. If `hour_starts` is set, no other fields may be set. Otherwise, `day_starts` and `month_starts` must be set together. - `day_starts` string — The time of the day at which a one day cumulative evaluation window starts. - `hour_starts` integer — The minute of the hour at which a one hour cumulative evaluation window starts. - `month_starts` integer — The day of the month at which a one month cumulative evaluation window starts. - `timezone` string — The timezone of the time of the day of the cumulative evaluation window start. - `silenced` object — Information about the downtime applied to the monitor. Only shows v1 downtimes. - `synthetics_check_id` string, nullable — ID of the corresponding Synthetic check. - `threshold_windows` MonitorThresholdWindowOptions — Alerting time window options. - `recovery_window` string, nullable — Describes how long an anomalous metric must be normal before the alert recovers. - `trigger_window` string, nullable — Describes how long a metric must be anomalous before an alert triggers. - `thresholds` MonitorThresholds — List of the different monitor threshold available. - `critical` number, double — The monitor `CRITICAL` threshold. - `critical_query` string — Query evaluated as a dynamic `CRITICAL` threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview. - `critical_recovery` number, double, nullable — The monitor `CRITICAL` recovery threshold. - `critical_recovery_query` string — Query evaluated as a dynamic `CRITICAL` recovery threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview. - `ok` number, double, nullable — The monitor `OK` threshold. - `unknown` number, double, nullable — The monitor UNKNOWN threshold. - `warning` number, double, nullable — The monitor `WARNING` threshold. - `warning_recovery` number, double, nullable — The monitor `WARNING` recovery threshold. - `timeout_h` integer, nullable — The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours. - `variables` MonitorFormulaAndFunctionQueryDefinition[] — List of requests that can be used in the monitor query. **This feature is currently in beta.** - union — A formula and function query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - `compute` MonitorFormulaAndFunctionEventQueryDefinitionCompute, required — Compute options. - `aggregation` 'count' | 'cardinality' | 'median' | 'pc75' | 'pc90' | 'pc95' | 'pc98' | 'pc99' | 'sum' | 'min' | 'max' | 'avg', required — Aggregation methods for event platform queries. - `interval` integer — A time interval in milliseconds. - `metric` string — Measurable attribute to compute. - `name` string — The name assigned to this aggregation, when multiple aggregations are defined for a query. - `source` string — Source reference for composite query payloads. - `data_source` 'rum' | 'ci_pipelines' | 'ci_tests' | 'audit' | 'events' | 'logs' | 'spans' | 'database_queries' | 'network' | 'network_path', required — Data source for event platform-based queries. - `group_by` MonitorFormulaAndFunctionEventQueryGroupBy[] — Group by options. - `facet` string, required — Event facet. - `limit` integer — Number of groups to return. - `sort` MonitorFormulaAndFunctionEventQueryGroupBySort — Options for sorting group by results. - … - `source` string — Source reference for composite query payloads. - `indexes` string[] — An array of index names to query in the stream. Omit or use `[]` to query all indexes at once. - `name` string, required — Name of the query for use in formulas. - `search` MonitorFormulaAndFunctionEventQueryDefinitionSearch — Search options. - `query` string, required — Events search string. - MonitorFormulaAndFunctionCostQueryDefinition — A formula and functions cost query. - `aggregator` 'avg' | 'sum' | 'max' | 'min' | 'last' | 'area' | 'l2norm' | 'percentile' | 'stddev' — Aggregation methods for metric queries. - `data_source` 'metrics' | 'cloud_cost' | 'datadog_usage', required — Data source for cost queries. - `name` string, required — Name of the query for use in formulas. - `query` string, required — The monitor query. - MonitorFormulaAndFunctionDataQualityQueryDefinition — A formula and functions data quality query. - `data_source` 'data_quality_metrics', required — Data source for data quality queries. - `filter` string, required — Filter expression used to match on data entities. Uses Aastra query syntax. - `group_by` string[] — Optional grouping fields for aggregation. - `measure` string, required — The data quality measure to query. Common values include: `bytes`, `cardinality`, `custom`, `freshness`, `max`, `mean`, `min`, `nullness`, `percent_negative`, `percent_zero`, `row_count`, `stddev`, `sum`, `uniqueness`. Additional values may be supported. - `monitor_options` MonitorFormulaAndFunctionDataQualityMonitorOptions — Monitor configuration options for data quality queries. - `crontab_override` string — Crontab expression to override the default schedule. - `custom_sql` string — Custom SQL query for the monitor. - `custom_where` string — Custom WHERE clause for the query. - `group_by_columns` string[] — Columns to group results by. - `model_type_override` 'freshness' | 'percentage' | 'any' — Override for the model type used in anomaly detection. - `name` string, required — Name of the query for use in formulas. - `schema_version` string — Schema version for the data quality query. - `scope` string — Optional scoping expression to further filter metrics. Uses metrics filter syntax. This is useful when an entity has been configured to emit metrics with additional tags. - MonitorFormulaAndFunctionDataJobsQueryDefinition — A formula and functions data jobs query. - `job_type` string, required — The type of job being monitored. Valid values include: `databricks.job`, `spark.application`, `airflow.dag`, `dbt.job`, `dbt.model`, `dbt.test`, `glue.job`. Custom job types are supported with the `custom.ol.` prefix. - `jobs_query` string, required — Filter expression used to select the jobs to monitor. - `name` string, required — Name of the query for use in formulas. Must be `run_query`. - `query_dialect` string, required — Query dialect for data jobs queries. Currently only `metric` is supported. - MonitorFormulaAndFunctionAggregateAugmentedQueryDefinition — A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table. - `augment_query` union, required — Augment query for aggregate augmented queries. Can be an events query or a reference table query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionReferenceTableQueryDefinition — A reference table query for use in aggregate queries. - … - `base_query` union, required — Base query for aggregate queries. Can be an events query or a metrics query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionMetricsQueryDefinition — A formula and functions metrics query for use in aggregate queries. - … - `compute` MonitorFormulaAndFunctionEventQueryDefinitionCompute[], required — Compute options for the query. - `aggregation` 'count' | 'cardinality' | 'median' | 'pc75' | 'pc90' | 'pc95' | 'pc98' | 'pc99' | 'sum' | 'min' | 'max' | 'avg', required — Aggregation methods for event platform queries. - `interval` integer — A time interval in milliseconds. - `metric` string — Measurable attribute to compute. - `name` string — The name assigned to this aggregation, when multiple aggregations are defined for a query. - `source` string — Source reference for composite query payloads. - `data_source` 'aggregate_augmented_query', required — Data source for aggregate augmented queries. - `group_by` MonitorFormulaAndFunctionEventQueryGroupBy[], required — Group by options for the query. - `facet` string, required — Event facet. - `limit` integer — Number of groups to return. - `sort` MonitorFormulaAndFunctionEventQueryGroupBySort — Options for sorting group by results. - … - `source` string — Source reference for composite query payloads. - `join_condition` MonitorFormulaAndFunctionAggregateQueryJoinCondition, required — Join condition for aggregate augmented queries. - `augment_attribute` string, required — Attribute from the augment query to join on. - `base_attribute` string, required — Attribute from the base query to join on. - `join_type` 'inner' | 'left', required — Join type for aggregate query join conditions. - `name` string — Name of the query for use in formulas. - MonitorFormulaAndFunctionAggregateFilteredQueryDefinition — A formula and functions aggregate filtered query. Used to filter base query results using data from another source. - `base_query` union, required — Base query for aggregate queries. Can be an events query or a metrics query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionMetricsQueryDefinition — A formula and functions metrics query for use in aggregate queries. - … - `compute` MonitorFormulaAndFunctionEventQueryDefinitionCompute[] — Compute options for the query. - `aggregation` 'count' | 'cardinality' | 'median' | 'pc75' | 'pc90' | 'pc95' | 'pc98' | 'pc99' | 'sum' | 'min' | 'max' | 'avg', required — Aggregation methods for event platform queries. - `interval` integer — A time interval in milliseconds. - `metric` string — Measurable attribute to compute. - `name` string — The name assigned to this aggregation, when multiple aggregations are defined for a query. - `source` string — Source reference for composite query payloads. - `data_source` 'aggregate_filtered_query', required — Data source for aggregate filtered queries. - `filter_query` union, required — Filter query for aggregate filtered queries. Can be an events query or a reference table query. - MonitorFormulaAndFunctionEventQueryDefinition — A formula and functions events query. - … - MonitorFormulaAndFunctionReferenceTableQueryDefinition — A reference table query for use in aggregate queries. - … - `filters` MonitorFormulaAndFunctionAggregateQueryFilter[], required — Filter conditions for the query. - `base_attribute` string, required — Attribute from the base query to filter on. - `exclude` boolean — Whether to exclude matching records instead of including them. - `filter_attribute` string, required — Attribute from the filter query to match against. - `group_by` MonitorFormulaAndFunctionEventQueryGroupBy[] — Group by options for the query. - `facet` string, required — Event facet. - `limit` integer — Number of groups to return. - `sort` MonitorFormulaAndFunctionEventQueryGroupBySort — Options for sorting group by results. - … - `source` string — Source reference for composite query payloads. - `name` string — Name of the query for use in formulas. - `overall_state` 'Alert' | 'Ignored' | 'No Data' | 'OK' | 'Skipped' | 'Unknown' | 'Warn' — The different states your monitor can be in. - `priority` integer, nullable — Integer from 1 (high) to 5 (low) indicating alert severity. - `query` string, required — The monitor query. - `restricted_roles` string[], nullable — A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the [Roles API](https://docs.datadoghq.com/api/latest/roles/#list-roles) and are located in the `data.id` field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the [Restriction Policies API](https://docs.datadoghq.com/api/latest/restriction-policies/) to manage write authorization for individual monitors by teams and users, in addition to roles. - `state` MonitorState — Wrapper object with the different monitor states. - `groups` object — Dictionary where the keys are groups (comma separated lists of tags) and the values are the list of groups your monitor is broken down on. - `tags` string[] — Tags associated to your monitor. - `type` 'composite' | 'event alert' | 'log alert' | 'metric alert' | 'process alert' | 'query alert' | 'rum alert' | 'service check' | 'synthetics alert' | 'trace-analytics alert' | 'slo alert' | 'event-v2 alert' | 'audit alert' | 'ci-pipelines alert' | 'ci-tests alert' | 'error-tracking alert' | 'database-monitoring alert' | 'network-performance alert' | 'cost alert' | 'data-quality alert' | 'network-path alert' | 'data-jobs alert', required — The type of the monitor. For more information about `type`, see the [monitor options](https://docs.datadoghq.com/monitors/guide/monitor_api_options/) docs. ## Other responses - `400` — Bad Request - `403` — Forbidden - `429` — Too many requests --- [API](https://skmtc.net/datadog/apis/api-v1.md) · [All operations](https://skmtc.net/datadog/apis/api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v1/revisions/ca5871004d26/schema)