POST to 'https://api.datadoghq.com/api/v1/monitors' with DD-API-KEY and DD-APPLICATION-KEY headers and a JSON body specifying 'type', 'query', 'name', 'message', and 'options'
Set 'type' to values like 'metric alert', 'service check', or 'log alert' depending on the signal source; the 'query' field syntax varies by monitor type
For a metric alert query use the form 'avg(last_5m):avg:your.metric{env:prod} > 100' adjusting the aggregator, window, metric, scope, and threshold
Set 'options' fields including 'thresholds' (critical/warning/ok values), 'notify_no_data', 'no_data_timeframe', and 'escalation_message' for complete monitor behavior
To update, PUT to '/api/v1/monitors/{monitor_id}' with the full or partial updated body; retrieve existing monitors with GET '/api/v1/monitors' filtered by name or tags
Known gotchas
Both an API key AND an application key are required for monitor create/update; requests with only the API key return 403 even though metric submission only needs the API key
Monitor query syntax differs between monitor types; a query valid for 'metric alert' will fail with a parse error if used in a 'log alert' monitor without adjustment
Muting a monitor via the API sets a downtime, not a monitor property; the monitor itself remains active and the downtime object must be managed separately
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp