> ## Documentation Index > Fetch the complete documentation index at: https://docs.serval.com/llms.txt > Use this file to discover all available pages before exploring further. # Dynatrace > Connect Dynatrace monitoring, Grail queries, and Automation workflows to Serval. The Dynatrace integration lets Serval workflows inspect monitoring data, manage problem comments, ingest events and metrics, query Grail, and run existing Dynatrace Automation workflows. ## Choose a connection method | Method | Use it for | Environment URL | | - | - | - | | Classic API token | Problems, events, metrics, entities, SLOs, and settings reads | `https://.live.dynatrace.com` | | Platform token | Grail queries and Automation workflows | `https://.apps.dynatrace.com` | | OAuth client credentials | Grail and Automation with automatically renewed access tokens | `https://.apps.dynatrace.com` | For Dynatrace Managed, use `https:///e/` with a classic API token. ActiveGate URLs can include a port, for example `https://:9999/e/`. Serval must be able to reach that HTTPS endpoint. Use a private worker when the endpoint is on your private network. Do not include `/api/v2` in the environment URL. Create separate connections if your workflows need both classic and Platform APIs. This integration does not expose the Platform bridge to classic APIs. ## Create credentials ### Classic API token In Dynatrace, create an access token and grant only the scopes needed by your workflows. Copy the token when it is displayed, and store it securely. | Operations | Token scope | | - | - | | List/read problems and comments; connection check | `problems.read` | | Close problems or add, edit, delete comments | `problems.write` | | List/read events and event types | `events.read` | | Ingest events | `events.ingest` | | Read metrics and query metric values | `metrics.read` | | Ingest metric lines | `metrics.ingest` | | Read entities and entity types | `entities.read` | | Read service-level objectives | `slo.read` | | Read settings objects and schemas | `settings.read` | Paste only the token in Serval's **Access token** field. Serval supplies the `Api-Token` authorization prefix. ### Platform token Create a Platform token in Dynatrace for a user or service user with access to the intended environment and data. Platform tokens begin with `dt0s16.`. Select scopes for the operations you need, then paste the token in **Access token**. Serval supplies the `Bearer` prefix. For Grail, permissions depend on the DQL query: commonly `storage:buckets:read` and the corresponding data scope such as `storage:logs:read`, `storage:metrics:read`, `storage:events:read`, `storage:entities:read`, or `storage:spans:read`. Bucket and record permissions can further restrict results. Automation reads use `automation:workflows:read`; running and cancelling executions use `automation:workflows:run`. The token cannot exceed its subject user's permissions. ### OAuth client credentials Create an OAuth client in Dynatrace Account Management. Give its subject user the required environment permissions and allow only the required scopes. Copy the **Client ID**, **Client secret**, and **Account URN** into Serval. The URN has the form `urn:dtaccount:`. Select the scopes your workflows need in **OAuth scopes**. Use the same Platform scope guidance above, and ensure the OAuth client allows each selected scope. Scopes are separate entries, not a comma-separated string. Serval obtains and renews short-lived access tokens automatically. Do not paste the client secret into the Access token field. ## Connect in Serval 1. Open **Integrations**, select **Dynatrace**, and add a connection. 2. Choose the authentication method and enter the matching environment URL. 3. Enter the token or OAuth client details and save the connection. 4. Run the connection check. Classic connections need `problems.read`. Platform connections validate a DQL query without reading your monitoring data. 5. Run the optional metrics, entities, or Automation access checks for the capabilities your workflows will use. Checks for a different API family are reported as not applicable; a connection check does not prove access to every endpoint or data bucket. When rotating credentials, enter the new token or client secret in the existing connection. Changing the OAuth client ID or account requires re-entering the client secret. To use a different environment or authentication method, add a new connection. ## Request and response formats * Most endpoints use JSON. Metric ingestion accepts a string of metric lines and sends it as plain text, with a JSON ingestion report returned. * Classic list responses can include `nextPageKey`. Follow the endpoint's pagination instructions; subsequent calls commonly accept only that key. Automation responses retain their `count`, `next`, `previous`, and `results`. * Grail query execution may return a pending state and `requestToken`. Poll with `request-token` until the query completes. Start polling promptly: completed query results are retained for at least one minute. Preserve type metadata alongside records when processing DQL results. * Rate limits return HTTP 429. Reduce concurrent requests and apply a bounded retry policy to safe reads. Writes are not retried automatically. Metric HTTP 400 can mean that valid lines were ingested while other lines failed; inspect the ingestion report before retrying. This version does not manage accounts, access tokens, credentials, workflow definitions, or log/OTLP ingestion. Available monitoring fields and operations can vary with Dynatrace release and license. ## Troubleshooting **401:** Check token expiry, the selected authentication method and the environment URL. For OAuth, check the client secret and account URN. **403:** Check both token/client scopes and the subject user's permissions, including environment and Grail bucket access. Adding a scope to the Serval connection does not grant that permission in Dynatrace. **OAuth exchange rejected:** Confirm that the OAuth client permits every selected scope and belongs to the account in the URN. The token endpoint is Dynatrace's fixed public SSO endpoint, so private workers also need access to it. **Cannot reach Managed or ActiveGate:** Check DNS, certificate trust, the port, and network access from Serval or the selected private worker. HTTPS is required. See Dynatrace's [API authentication documentation](https://docs.dynatrace.com/docs/dynatrace-api/basics/dynatrace-api-authentication), [Platform token guide](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens), and [OAuth guide](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/oauth-clients). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.