How do I add JSON API endpoints to the evidence an AI SRE reads when Datadog monitors fire?

Tares takes Datadog monitor alerts through a webhook source and polls your JSON API endpoints with an http_poll source, so both sit in Tares as event sources. Datadog reaches Tares through the webhook connector and a Datadog-side setup, because Tares has no connector of its own for Datadog today. The API is a second source that Tares calls itself on a schedule, with no script on your side. Each source stores its events with labels you declare.

How it works

Two sources do two different jobs.

• Datadog monitors reach Tares through the webhook connector. Datadog calls the Tares ingest URL when a monitor fires. You write the payload yourself from Datadog variables such as $ALERT_ID, $EVENT_MSG and $LINK, so the shape is yours. Tares stores the payload lossless and maps fields into labels you declare, with one label marked primary.
• JSON API endpoints use the http_poll connector. Tares calls the endpoint on the source’s schedule and stores one event per item in the reply. Use it for an API that returns the accounts, customers or services you care about. Nested values are reachable by dotted name, so a label can read a field like customer.plan.

With http_poll, payload_key points at the part of the reply that holds the items. An object is one event and a list is one event per entry. id_field is the deduplication key, so an item seen in recent polls is not stored again. text_template writes a one-line summary per event.

If the data you want sits in a database instead of behind an API, the Postgres connector reads new and changed rows of a table and keeps your application data in the timeline. The AI SRE guide covers the wider setup these sources belong to.

Set it up

1. Create the Datadog webhook source in Tares. Declare a label for each field your Datadog payload carries and mark one primary. Keep the payload flat, because event_type_field and text_template read top-level fields only.

- name: datadog-monitors
  connector: webhook
  config:
    event_type_field: action
    text_template: '{action} by {sender}'
    labels:
      - { name: service, field: service, primary: true }

2. Copy the ingest endpoint from the source page. Producers POST to /ingest/<ingest_key>.

3. Add the webhook in Datadog. Open the Webhooks integration and add a webhook whose URL is the Tares ingest URL. Write the payload as JSON from Datadog variables. When Tares has auth on, add custom headers as JSON with an Authorization Bearer header holding an ingest-scoped API key.

4. Call it from the monitor. Put @webhook-<name> in the monitor message so the monitor calls the webhook.

5. Add the JSON API source. In Sources, Add source, HTTP API (poll), enter the method, URL and credentials if the API wants any, then press Discover. Tares calls the API once, shows the reply and fills in what becomes an event. Or post the same object to /api/sources.

- name: weather_berlin
  connector: http_poll
  poll: 10m
  config:
    url: https://api.open-meteo.com/v1/forecast?latitude=52.52&longitude=13.41&current_weather=true
    event_type: weather
    event_time_field: current_weather.time
    id_field: current_weather.time
    text_template: 'Berlin wind {current_weather.windspeed} km/h, {current_weather.temperature} C'
    labels:
      - { name: city, const: berlin, primary: true }
      - { name: windspeed, field: current_weather.windspeed, type: number }

Replace the URL, event_type, text_template and labels with your own endpoint and fields. If the API needs a key, put the whole value in credential and name the header in credential_header. It is stored as a secret and never returned by the API. Headers that are not secret go in headers.

6. Verify both sources. Open each source. Recent events shows the events with their summary line, and Fields lists every field seen, dotted names included, with its coverage. Fire a test monitor and confirm the Datadog event arrives.

What you get

• Datadog monitor alerts stored in Tares as events from a webhook source, with the labels you declared.
• Rows or responses from your own API stored as events from an http_poll source, polled on the schedule you set, with no script to run.
• Payloads stored as received, so labels you declare later can still reach every field.
• Rate limiting handled for you. The connector refuses a poll under 10 seconds, backs off on a 429 or any 5xx with a wait that doubles up to an hour, and shows the state in the source’s health.
• A clear config error on the source’s health when the API returns another 4xx, with the status and a slice of the reply.

When something else fits

• If the evidence you want is a table in your own database, use the Postgres connector instead of an API.
• If the other system can call Tares itself, use the webhook connector. Use http_poll for APIs that Tares has to call.
• If you need a Tares source that reads Datadog on its own, there is none today. Datadog reaches Tares through the webhook connector.

Related