Skip to main content
The Dynatrace integration lets Serval workflows inspect monitoring data, manage problem comments, ingest events and metrics, query Grail, and run existing Dynatrace Automation workflows.

​
Choose a connection method

For Dynatrace Managed, use https://<managed-host>/e/<environment-id> with a classic API token. ActiveGate URLs can include a port, for example https://<activegate-host>:9999/e/<environment-id>. Serval must be able to reach that HTTPS endpoint. Use a private worker when the endpoint is on your private network. Do not include /api/v2 in the environment URL. Create separate connections if your workflows need both classic and Platform APIs. This integration does not expose the Platform bridge to classic APIs.

​
Create credentials

​
Classic API token

In Dynatrace, create an access token and grant only the scopes needed by your workflows. Copy the token when it is displayed, and store it securely. Paste only the token in Serval’s Access token field. Serval supplies the Api-Token authorization prefix.

​
Platform token

Create a Platform token in Dynatrace for a user or service user with access to the intended environment and data. Platform tokens begin with dt0s16.. Select scopes for the operations you need, then paste the token in Access token. Serval supplies the Bearer prefix. For Grail, permissions depend on the DQL query: commonly storage:buckets:read and the corresponding data scope such as storage:logs:read, storage:metrics:read, storage:events:read, storage:entities:read, or storage:spans:read. Bucket and record permissions can further restrict results. Automation reads use automation:workflows:read; running and cancelling executions use automation:workflows:run. The token cannot exceed its subject user’s permissions.

​
OAuth client credentials

Create an OAuth client in Dynatrace Account Management. Give its subject user the required environment permissions and allow only the required scopes. Copy the Client ID, Client secret, and Account URN into Serval. The URN has the form urn:dtaccount:<account-UUID>. Select the scopes your workflows need in OAuth scopes. Use the same Platform scope guidance above, and ensure the OAuth client allows each selected scope. Scopes are separate entries, not a comma-separated string. Serval obtains and renews short-lived access tokens automatically. Do not paste the client secret into the Access token field.

​
Connect in Serval

  1. Open Integrations, select Dynatrace, and add a connection.
  2. Choose the authentication method and enter the matching environment URL.
  3. Enter the token or OAuth client details and save the connection.
  4. Run the connection check. Classic connections need problems.read. Platform connections validate a DQL query without reading your monitoring data.
  5. Run the optional metrics, entities, or Automation access checks for the capabilities your workflows will use. Checks for a different API family are reported as not applicable; a connection check does not prove access to every endpoint or data bucket.
When rotating credentials, enter the new token or client secret in the existing connection. Changing the OAuth client ID or account requires re-entering the client secret. To use a different environment or authentication method, add a new connection.

​
Request and response formats

  • Most endpoints use JSON. Metric ingestion accepts a string of metric lines and sends it as plain text, with a JSON ingestion report returned.
  • Classic list responses can include nextPageKey. Follow the endpoint’s pagination instructions; subsequent calls commonly accept only that key. Automation responses retain their count, next, previous, and results.
  • Grail query execution may return a pending state and requestToken. Poll with request-token until the query completes. Start polling promptly: completed query results are retained for at least one minute. Preserve type metadata alongside records when processing DQL results.
  • Rate limits return HTTP 429. Reduce concurrent requests and apply a bounded retry policy to safe reads. Writes are not retried automatically. Metric HTTP 400 can mean that valid lines were ingested while other lines failed; inspect the ingestion report before retrying.
This version does not manage accounts, access tokens, credentials, workflow definitions, or log/OTLP ingestion. Available monitoring fields and operations can vary with Dynatrace release and license.

​
Troubleshooting

401: Check token expiry, the selected authentication method and the environment URL. For OAuth, check the client secret and account URN. 403: Check both token/client scopes and the subject user’s permissions, including environment and Grail bucket access. Adding a scope to the Serval connection does not grant that permission in Dynatrace. OAuth exchange rejected: Confirm that the OAuth client permits every selected scope and belongs to the account in the URN. The token endpoint is Dynatrace’s fixed public SSO endpoint, so private workers also need access to it. Cannot reach Managed or ActiveGate: Check DNS, certificate trust, the port, and network access from Serval or the selected private worker. HTTPS is required. See Dynatrace’s API authentication documentation, Platform token guide, and OAuth guide.