Claude-skill-registry datadog-incidents

Work with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd get-incident/update-incident commands.

install

source · Clone the upstream repo

git clone https://github.com/majiayu000/claude-skill-registry

Claude Code · Install into ~/.claude/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/majiayu000/claude-skill-registry "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/data/datadog-incidents" ~/.claude/skills/majiayu000-claude-skill-registry-datadog-incidents && rm -rf "$T"

manifest: skills/data/datadog-incidents/SKILL.md

Datadog Incidents API

CLI Commands

# Get incident by ID (public ID like 152, or UUID)
dd get-incident 152

# Get enriched incident with user details
dd get-incident 152 --include users

# Get fully enriched with incident type and integrations
dd get-incident 152 --include users --enrich

# Update incident
dd update-incident 152 --title "New Title" --severity SEV-2 --state resolved

Enrichment Levels

Basic (no flags)

Returns incident data with UUIDs for users - less useful for human analysis.

With

--include users

Transforms user references:

"created_by": {
  "data": {
    "type": "users",
    "id": "0082a465-...",
    "attributes": {
      "name": "Peter Chang",
      "email": "peterc@wonder.com"
    }
  }
}

With

--enrich

Adds

enrichment

section with:

Incident type: Name, description, prefix
Integrations: Slack channels, Jira tickets with direct links

Update Fields

Standard fields

```
--title
```
- Incident title
```
--severity
```
- SEV-1, SEV-2, etc.
```
--state
```
- active, stable, resolved
```
--customer-impacted
```
- true/false
```
--customer-impact-scope
```
- Description of impact

Custom fields

dd update-incident 152 --field "root_cause=Database timeout" --field "teams=backend"

Key Notes

CLI accepts public IDs: Use
```
152
```
instead of full UUID
API requires UUIDs: CLI handles conversion internally
Permission requirements: App key owner needs incident management permissions
The
```
include
```
parameter only works for
```
users
```
and
```
attachments
```

curl Examples

# Get with user enrichment
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID?include=users" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Get integrations (Slack/Jira)
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID/relationships/integrations" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Get incident type config
curl -X GET "https://api.$DD_SITE/api/v2/incidents/config/types/$TYPE_UUID" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"