Skip to content

[CRED-2815] Document PAT/SAT scope, TTL, and app-key restrictions #38326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
emubello wants to merge 2 commits into
base: master
Choose a base branch
from
+20 −0
Draft

[CRED-2815] Document PAT/SAT scope, TTL, and app-key restrictions #38326

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7255546
[CRED-2815] Document PAT/SAT scope, TTL, and app-key restrictions
emubello Jul 20, 2026
0f94a01
[CRED-2815] Clarify PAT/SAT token creation restrictions
emubello Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions content/en/account_management/personal-access-tokens.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,16 @@ curl -X GET "https://api.datadoghq.com/api/v2/users" \

**Note:** When a valid PAT is provided in the `dd-application-key` header, Datadog authenticates with the PAT only. The `dd-api-key` header is optional and its value is not evaluated.

## Restrictions

To limit how a PAT can escalate its own access, Datadog restricts what an API call authenticated with a PAT can do. These restrictions apply regardless of the API client making the call:

- **Application keys**: A PAT cannot create or update application keys. Revoking application keys is still allowed.
- **Scopes on new tokens**: A PAT can create or update a PAT or a SAT only if the new token's scopes are a subset of its own scopes.
- **Time-to-live (TTL) on new tokens**: A PAT cannot create a PAT or a SAT with a TTL that outlives itself.

@tyjet tyjet Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question (blocking): My interpretation of this is that if my PAT is expiring and I want to mint a new PAT for myself, I cannot use the expiring PAT to do so. Is this correct.

@emubello emubello Jul 20, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes this is correct

@anthony-dgx anthony-dgx Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is why having a "rotate" endpoint would be useful. WDTY @tyjet?


These restrictions apply only to API calls authenticated with a PAT or SAT. A call that violates one of these restrictions returns a `403 Forbidden` response.

## Manage Personal Access Tokens

### View your tokens
Expand Down
10 changes: 10 additions & 0 deletions content/en/account_management/service-access-tokens.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,16 @@ curl -X GET "https://api.datadoghq.com/api/v2/users" \
**Note:** When a valid SAT is provided in the `dd-application-key` header, Datadog authenticates
with the SAT only. The `dd-api-key` header is optional and its value is not evaluated.

## Restrictions

To limit how a SAT can escalate its own access, Datadog restricts what an API call authenticated with a SAT can do, regardless of the API client making the call:

- **Application keys**: A SAT cannot create or update application keys. Revoking application keys is still allowed.
- **Scopes on new tokens**: A SAT can create or update another SAT only if the new token's scopes are a subset of its own scopes.
- **Time-to-live (TTL) on new tokens**: A SAT cannot create a SAT with a TTL that outlives itself.

These restrictions apply only to API calls authenticated with a PAT or SAT. A call that violates one of these restrictions returns a `403 Forbidden` response.

## Manage Service Access Tokens

### View tokens
Expand Down
Loading