API

The Datadog Agent exposes several APIs. None of them are public-facing in the sense of being intended for arbitrary external use — they are all developer- and operator-oriented surfaces. They include:

• Agent IPC API — the HTTP API that the various Agent binaries use to talk to each other and that the local CLI subcommands (agent status, agent flare, agent config) call into.
• Agent gRPC API — the gRPC server for tagger and workloadmeta clients.
• System Probe socket — a privileged HTTP-over-UDS server exposed by the System Probe.
• DogStatsD listeners — the inbound metric reception surface.
• Trace Agent receiver — the inbound trace reception surface (HTTP and gRPC).
• Cluster Agent API — used by node Agents and the External Metrics Provider.
• expvar / pprof — Go's standard introspection surfaces.

Detail per surface is below. Where there is a longer write-up in docs/dev/agent_api.md, it is the canonical reference.

Agent IPC API

The core Agent runs an HTTP server on a configurable port (default 5002, see cmd_port). The server is also reachable via the IPC token file shipped under /etc/datadog-agent/auth_token.

Endpoints fall into a few categories:

• Status, version, hostname — /agent/status, /agent/version, /agent/hostname.
• Flare — /agent/flare.
• Config — /config, /config/list-runtime, /config/set-runtime (read/write runtime-changeable settings).
• DogStatsD — /dogstatsd/stats, /dogstatsd-stats-by-source.
• Tagger — /tagger-list.
• Workloadmeta — /workload-list.
• Autodiscovery — /configcheck.
• Health — /healthcheck.
• Streaming — /stream-logs, /stream-events.
• Profiling — /debug/pprof/* (registered automatically when running).
• expvar — /debug/vars.
• Remote Config — /remote-config/state.

The implementation lives in comp/api/api/ (component framework) and pkg/api/ (legacy). The agent CLI subcommands talk to this API.

The docs/dev/agent_api.md document is the long-form reference and is kept up to date with new endpoints.

Agent gRPC API

comp/api/grpcserver/ exposes a gRPC server on a separate UDS or TCP socket. The most-used services are:

• Tagger — TagsForEntity, Stream events. Used by Process Agent, Trace Agent, Security Agent, OTel Agent.
• Workloadmeta — Stream of entity changes. Used by the same set of clients.
• Capture replay — debug-only capture-and-replay support for support escalations.

The protobuf definitions live in pkg/proto/.

System Probe socket

The System Probe binds to a Unix Domain Socket (system_probe_config.sysprobe_socket, default /var/run/datadog/sysprobe.sock) and serves HTTP on it. Each module registers its own routes:

• /network_tracer/* — NPM data dumps.
• /universal_service_monitoring/* — USM data dumps.
• /oom_kill/check, /tcp_queue_length/check — eBPF core check data.
• /runtime_security/* — CWS module endpoints.
• /dynamic_instrumentation/* — dyninst module endpoints.
• /diagnose/* — module-level diagnostics.

All endpoints are scoped to the local host, secured by the socket's filesystem permissions.

DogStatsD listeners

DogStatsD listens for inbound StatsD lines. Not really an API in the usual sense, but it is the largest reception surface by traffic volume.

Listener	Default
UDP	port 8125
UDS datagram	/var/run/datadog/dsd.socket
UDS stream	/var/run/datadog/dsd_stream.socket
Windows named pipe	\\.\pipe\datadog-dogstatsd

The protocol is the StatsD protocol with Datadog extensions; a thorough description lives at docs.datadoghq.com.

Trace Agent receiver

The Trace Agent listens on TCP, UDS, or Windows named pipe. Endpoints:

• /v0.3/traces, /v0.4/traces, /v0.5/traces — MessagePack trace payloads.
• /v0.6/stats, /v0.7/stats — Client-computed stats.
• /v0.5/traces string-table extension — efficient string interning.
• /profiling/v1/input — Profiles from APM SDKs.
• /info — receiver capabilities and per-language stats.
• gRPC OTLP — handled by pkg/trace/otel/.

The Trace Agent rate-limits at the listener and tracks per-language and per-service traffic.

Cluster Agent API

The Cluster Agent exposes:

• Node Agent endpoints for cluster check dispatching and external metrics resolution.
• External Metrics Provider — a Kubernetes-API-compatible endpoint for HPA queries.
• Admission webhook — receives incoming admission requests and returns mutated objects.

Implementation: cmd/cluster-agent/api/, pkg/clusteragent/api/, and pkg/clusteragent/admission/.

OTel Agent API

When the Agent runs as the OTel flavor, it exposes the standard OTel Collector telemetry endpoint plus the Datadog flare extension on the same port. Details live under Apps: OTel Agent.

expvar and pprof

These are not Datadog-specific, but they are the most-used debugging surfaces. Every long-running binary registers them on its API port:

• /debug/vars — expvar JSON dump.
• /debug/pprof/* — Go runtime profiles.

The Trace Agent, System Probe, Process Agent, and Security Agent each have their own pprof endpoints on their own ports.

API security

• IPC token: every Agent binary that uses the core Agent's HTTP API authenticates via a shared token in /etc/datadog-agent/auth_token. The token is generated at first run and rotates on demand. comp/api/api/ and comp/core/ipc/ implement the auth.
• Socket permissions: UDS sockets are typically 0660 and owned by the dd-agent user/group.
• TLS: when the API is exposed over TCP across a network boundary (rare; mostly for cluster check runners), TLS is supported.

Related pages

• Apps: Agent — the binary that hosts the IPC API.
• Apps: System Probe — the privileged socket server.
• Apps: Trace Agent — the trace receiver.
• Apps: Cluster Agent — the cluster API.