Service users in Dynatrace are special types of users created to enable automated access to the Dynatrace API. Unlike regular users, service users are not associated with a person but are used by systems or applications (e.g., CI/CD tools or monitoring scripts) that need to interact with Dynatrace programmatically. These users are assigned permissions through groups and policies, and they authenticate using OAuth client credentials (client ID and secret). This setup allows secure, automated, and controlled access to Dynatrace resources.
Follow this steps to generate a user for secure automations:
Create a service user. Through the account management page (a service user needs a name, e.g., what function they are supposed to perform).
After creating the service user, assign the service user to a group
-> Edit service user and, as usual, assign a group that contains the necessary permissions as if it were a normal user.
(Save the service user email to clipboard)
Create an OAuth client using the service user that we will use for environment token creation and automation
Enter the service user email as the subject user email.
Assign at least following permissions to the OAuth client: environment-api:api-tokens:write , environment-api:api-tokens:read , environment-api:deployment:download
curl --location 'https://sso.dynatrace.com/sso/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=dt0s02.NEHYTCAK' \
--data-urlencode 'client_secret=dt0s02.NEHYTCAK.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' \
--data-urlencode 'resource=urn:dtaccount:456bce5cxxxxxxxxxxxxxxxxxxxxxxxxxxxx' \
--data-urlencode 'scope=environment-api:api-tokens:write environment-api:api-tokens:read'
Then generate the Environment API token using the bearer
curl --location 'https://<tenant_app_url>/platform/classic/environment-api/v2/apiTokens' \
--header 'Authorization: Bearer xxxxxxxx' \
--header 'Content-Type: application/json' \
--data '{
"expirationDate": "now+14d",
"name": "tokenName",
"personalAccessToken": false,
"scopes": [
"metrics.read"
]
}'
Featured Posts
