topic Re: Custom App deployment in Developer Q&A Forum

Custom App deployment

AjithaN — Thu, 26 Feb 2026 12:22:17 GMT

Hi All,

I was trying to create a Custom App which is having functionality to create Dynatrace workflows based on the data provided in the application. I was able to run the application successfully , but not able to deploy it even in lower tenants.

When trying to deploy it using npm run deploy command, I'm getting the error as below

✔ Creating bundles...
✔ Built the app
✔ Validating manifest
✔ Compressed app artifact
✖ Failed to deploy the app
Error: Failed to install the app
HTTP 400 Bad Request

Manifest of app 'my.workflow.app' violates schema

Only apps that are provided by Dynatrace can use the 'automation:workflows:write' scope.

I believe that its related to the workflow.write scope been added in the appconfig, but since the functionality involves creation of workflows, I cannot remove this scope as well. Is there any workaround to bypass this issue and deploy the app successfully. Please suggest

Re: Custom App deployment

doesterr — Thu, 26 Feb 2026 14:25:28 GMT

Hi AjithaN,
This restriction can't be bypassed, as it's an important measure to prevent a custom app from doing more than it should.

While your app can't create the workflow programmatically, you can still let users of your app create workflows by using intents. You can find more about this here: https://developer.dynatrace.com/develop/guides/workflows/use-intents/

Re: Custom App deployment

AjithaN — Fri, 27 Feb 2026 12:26:19 GMT

Thanks for the response. Let me have a look at this and come back

Re: Custom App deployment

AjithaN — Tue, 07 Apr 2026 06:48:58 GMT

I was able to fulfill the requirement and create the workflow this way(Just that I made the Deploy functionality of the workflow to be done from Workflows UI itself to bypass the automation:workflows:write scope.

Now I am trying to improve the app by trying to build the capability to create Anomaly Rules based on the input provided in the App. From the developer documentation, I understand that this is possible with Settings API /Dynatrace SDK. I tried some of the below approaches , but didnt get a successful outcome.

1) Create Anomaly Rules Directly from the App using Settings API

The app backend could not communicate securely with the Dynatrace tenant API ---> invalid peer certificate: UnknownIssuer

2) Create Anomaly Rules from the App backend using Dynatrace SDK -->no equivalent methods found for creation of Anomaly rules

3)Use Dynatrace Workflows HTTP action to call Settings API --> NotCapable: Blocked request to 'els27805'
(host not in allowlist)

Can you suggest if there is a reliable/feasible approach to fulfill this requirement,or this again has limitations.?

Re: Custom App deployment

Maheedhar_T — Wed, 08 Apr 2026 07:45:15 GMT

Hi @AjithaN ,
For host not in allow list, you can go to settings (New) -> General -> External requests and add patterns like <tenant-id>.apps.dynatrace.com and <tenant-id>.live.dynatrace.com

Re: Custom App deployment

doesterr — Wed, 08 Apr 2026 12:18:42 GMT

Thanks for jumping in, @Maheedhar_T !

@AjithaN , here is more info: https://developer.dynatrace.com/develop/guides/app-functions/allow-outbound-connections/

Re: Custom App deployment

AjithaN — Fri, 10 Apr 2026 10:13:27 GMT

Thanks for the response. But May I ask you one thing. How the <tenant-id>.apps.dynatrace.com comes as a external request.. Its in this same tenant and link that we are running the workflow or the custom App.

Any hints on the Settings API error if we wanted to have the API call from a custom App

Re: Custom App deployment

doesterr — Fri, 10 Apr 2026 11:44:21 GMT

About the external requests:
After some testing myself with doing HTTP Requests from a Workflow to your own tenant, I could spot a difference, depending on the API you're accessing:

A request to the Hub API, e.g. https://<tenant-id>.apps.dynatrace.com/platform/hub/v1/catalog/apps succeeds
A request to the Environment API v2, e.g. https://<tenant-id>.live.dynatrace.com/api/v2/settings/objects fails with the "host not in allowlist" error.

But notice the difference, the domain of the Environment API v2 is different than your normal tenant domain (it's ".live." instead of ".apps."). After adding <tenant-id>.live.dynatrace.com to the allow list, the HTTP Request in my workflow succeeded.

About the Invalid peer certificate: UnknownIssuer error:
If you're not using the Classic Environment V2 SDK yet for your request to the API from your app, I'd recommend giving this a try.
https://developer.dynatrace.com/develop/sdks/client-classic-environment-v2/#settingsobjectsclient

Re: Custom App deployment

AjithaN — Wed, 22 Apr 2026 12:46:19 GMT

Hi,

Thanks again for responding. While, I guess I tried this approach as well using DYnatrace SDk.

Basically, I tried 2 approaches now .

1) Settings API (direct API calls )

Calling Dynatrace’s Settings API endpoints directly

const url =

"https://{environmentid}.apps.dynatrace.com/api/v2/settings/objects";

const response = await fetch(url, {

method: "POST",

headers: {

"Content-Type": "application/json",

"Authorization": `Bearer ${process.env.DT_API_TOKEN}`

-->Received invalid peer certificate

2) Using Dynatrace SDK (settingsObjectsClient)

Here I saw , two types of errors: settingsObjectsClient.postSettingsObjects(...)

Method-related errors, e.g.:

TypeError: settingsObjectsClient.createSettingsObjects is not a function

And later, even with the correct method: settingsObjectsClient.postSettingsObjects(...)

invalid peer certificate: UnknownIssuer

Re: Custom App deployment

doesterr — Fri, 24 Apr 2026 11:35:20 GMT

Using the Dynatrace SDK from within an app function is the correct approach. Are you maybe trying to use it from the UI rather than an app function?

Re: Custom App deployment

AjithaN — Fri, 24 Apr 2026 14:27:38 GMT

If using the settingsObjectsClient inside *.function.ts file is what you refer by app function, then yes I was using it that way only. It looks like the invalid peer certificate error comes at the time of sending request itself before it looks for any authentication/token.So seems to be something at the network layer. Any opinions/suggestions would be of great help.

Re: Custom App deployment

doesterr — Wed, 29 Apr 2026 13:50:45 GMT

Can you share the code of your app function? (the *.function.ts) file.
And have you added "<tenant-id>.live.dynatrace.com" to Settings → General → External Requests?

Re: Custom App deployment

AjithaN — Wed, 29 Apr 2026 18:32:56 GMT

here is my createRule.function.ts file using settingsObjectClient. <tenant-id>.live.dynatrace.com is already there in the external requests host pattern.

import {settingsObjectsClient}

from "@dynatrace-sdk/client-classic-environment-v2";

export default async function (payload: any) {

try {

if (!payload) {

return {

success: false,

error: "Payload missing",

};

}

// ✅ IMPORTANT:

// postSettingsObjects expects an ARRAY, not { objects: [...] }

const result = await settingsObjectsClient.postSettingsObjects({

body: [

{

schemaId: "builtin:davis.anomaly-detectors",

scope: "environment",

value: {

title: payload.ruleName, // ✅ correct field for your tenant

enabled: true,

cpuUsage: {

enabled: true,

threshold: payload.threshold,

memoryUsage: {

enabled: false,

tagFilters: payload.entityTags,

});

return {

success: true,

result,

};

} catch (err: any) {

console.error("ERROR:", err.message);

return {

success: false,

error: err.message,

};

}

Re: Custom App deployment

doesterr — Thu, 30 Apr 2026 15:25:40 GMT

Thanks! There's nothing wrong with that implementation.

Are you hitting the certificate error when running locally (npm run dev) or when the app and it's app function is deployed to the tenant?

If locally, then maybe something in your corporate network is in the way. In that case, talking to your IT team to obtain the right CA cert and setting it via NODE_EXTRA_CA_CERTS might do the trick.

If deployed, that would mean that something is not right on your tenant - in that case please open a support ticket so they can have a closer look.

I hope this helps to get you closer to the real solution 🤞

Re: Custom App deployment

AjithaN — Mon, 04 May 2026 11:50:15 GMT

NODE_EXTRA_CA_CERTS is already in place in environment variable where the path to certificate.pem file(CA) is already added. I was getting the certificate error at running the application not deployment.. npm run start is the command used.

As I said, I was trying to create an anomaly detection rule using the App and the error comes up after providing the input and while submitting using the below type button..

<button

type="submit"

style={{

padding: "12px 0",

background: "var(--dt-color-action-primary)",

color: "white",

borderRadius: 8,

border: "none",

cursor: "pointer",

fontSize: 16,

}}

Create Rule (If needed)

</button>

Also, currently, I get this error in the app UI now after I tweaked few things in the code

'Rule creation failed: Failed. Schema validation failed.'