feat(dynatrace): add the write and configuration surfaces

Takes the block from 22 operations to 47. The original PR shipped the read
paths plus a few ingests; this closes the gaps that made those reads
dead-end.

The one that was a real defect: security was read-only. The audit-vulnerabilities
skill promised "a remediation queue" and then gave you no way to act on it,
even though muting is the single most common triage action. Adds mute and
unmute, singly and in bulk, plus the remediation items behind a third-party
finding, plus the Attacks API so an exploited vulnerability can be traced to
the request that exploited it.

The rest, by how much they unblock:

- Custom tags (read/add/delete). Entity tags already drive every selector in
  the block; being able to write them closes a loop that was half open.
- Settings objects (schemas, list, get, create, update, delete). This is how
  maintenance windows, alerting profiles, and management zones are configured
  in modern Dynatrace, so "open a maintenance window before the deploy" was
  simply unreachable before. The value is a schema-defined blob, so the tool
  is honestly opaque rather than falsely typed; the docs tell you to mirror an
  existing object. Update and delete carry the updateToken so a concurrent
  change fails instead of being overwritten.
- Synthetic monitors and on-demand batch execution, which pairs with the
  deploy-marker tool to gate a release on a smoke test.
- Problem comment get/update/delete, and SLO create/update/delete, completing
  CRUD that was previously half-built.

Two structural notes. Synthetic monitors are the only endpoints still on
Environment API v1, so `buildDynatraceUrl` grew a v1 sibling and the shared
base-URL normalizer now strips either version; the query builder also learned
to repeat a param per value, which Synthetic's `tag` needs. And creating an
SLO returns 201 with an empty body and the new ID in the Location header, so
that tool reads the header rather than parsing nothing.

Deliberately excluded: the Grail/DQL query API. It is the long-term successor
to the deprecated logs/search endpoint, but it authenticates with a platform
token rather than an Api-Token, so it is a second auth path and belongs in
its own change.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/dynatrace.mdx

@@ -1,5 +1,5 @@
 {
-  "updatedAt": "2026-08-07",
+  "updatedAt": "2026-08-08",
   "integrations": [
     {
       "type": "onepassword",
@@ -5431,8 +5431,8 @@
       "type": "dynatrace",
       "slug": "dynatrace",
       "name": "Dynatrace",
-      "description": "Query Dynatrace problems, metrics, entities, logs, SLOs, and vulnerabilities",
-      "longDescription": "Integrate Dynatrace into workflows. Investigate and close Davis problems, query metrics and monitored entities, search and ingest logs, push deployment events, track SLO burn rates, review Application Security vulnerabilities, and read the audit log.",
+      "description": "Manage Dynatrace problems, metrics, entities, logs, SLOs, settings, and security",
+      "longDescription": "Integrate Dynatrace into workflows. Investigate and close Davis problems, query metrics and monitored entities, search and ingest logs, push deployment events, manage SLOs and their burn rates, triage and mute Application Security vulnerabilities, review runtime attacks, tag entities, manage settings objects such as maintenance windows and alerting profiles, run synthetic monitors on demand, and read the audit log.",
       "bgColor": "#FFFFFF",
       "iconName": "DynatraceIcon",
       "docsUrl": "https://docs.sim.ai/integrations/dynatrace",
@@ -5521,12 +5521,112 @@
           "name": "Get Security Problem",
           "description": "Get a single vulnerability with its description, remediation guidance, affected entities, and risk assessment."
         },
+        {
+          "name": "Mute Security Problem",
+          "description": "Mute a single Dynatrace vulnerability with a reason, for triaging false positives or accepted risk."
+        },
+        {
+          "name": "Unmute Security Problem",
+          "description": "Unmute a single Dynatrace vulnerability, returning it to the active triage queue."
+        },
+        {
+          "name": "Mute Security Problems (Bulk)",
+          "description": "Mute several Dynatrace vulnerabilities at once with a shared reason, for bulk triage."
+        },
+        {
+          "name": "Unmute Security Problems (Bulk)",
+          "description": "Unmute several Dynatrace vulnerabilities at once, returning them to active triage."
+        },
+        {
+          "name": "List Remediation Items",
+          "description": "List the remediation items of a third-party vulnerability — the components to upgrade, their affected entities, and their mute state."
+        },
+        {
+          "name": "List Attacks",
+          "description": "List runtime attacks Dynatrace Application Protection detected — injection attempts, their source, and whether they were blocked."
+        },
+        {
+          "name": "Get Attack",
+          "description": "Get a single attack with its entry point, payload, attacker, and the vulnerability it exploited."
+        },
+        {
+          "name": "List Tags",
+          "description": "List the custom tags applied to the monitored entities an entity selector matches."
+        },
+        {
+          "name": "Add Tags",
+          "description": "Add custom tags to every monitored entity an entity selector matches. Tags drive selectors, management zones, and alerting."
+        },
+        {
+          "name": "Delete Tag",
+          "description": "Remove a custom tag from every monitored entity an entity selector matches. Deletes one key-value pair, or every tag with the key."
+        },
+        {
+          "name": "List Settings Schemas",
+          "description": "List the settings schemas available in the environment. Use it to find the schema ID for a configuration type such as builtin:alerting.profile."
+        },
+        {
+          "name": "List Settings Objects",
+          "description": "List settings objects — the configuration behind maintenance windows, alerting profiles, management zones, and anomaly detection."
+        },
+        {
+          "name": "Get Settings Object",
+          "description": "Get a single settings object with its value and its update token. Read it before updating so the token can guard against a concurrent change."
+        },
+        {
+          "name": "Create Settings Object",
+          "description": "Create a settings object — a maintenance window, alerting profile, management zone, or any other schema-backed configuration."
+        },
+        {
+          "name": "Update Settings Object",
+          "description": "Update an existing settings object. Pass the update token from Get Settings Object to fail rather than overwrite a concurrent change."
+        },
+        {
+          "name": "Delete Settings Object",
+          "description": "Delete a settings object. Dynatrace cannot undo this."
+        },
+        {
+          "name": "List Synthetic Monitors",
+          "description": "List synthetic monitors and their IDs. Use it to find the monitor IDs to feed into an on-demand execution."
+        },
+        {
+          "name": "Execute Synthetic Monitors",
+          "description": "Trigger an on-demand batch execution of synthetic monitors, for gating a deploy on a smoke test. Returns a batch ID to poll."
+        },
+        {
+          "name": "Get Synthetic Batch",
+          "description": "Get the status and failures of an on-demand synthetic batch execution. Poll it after triggering to gate a deploy on the result."
+        },
+        {
+          "name": "Get Problem Comment",
+          "description": "Get a single comment on a Dynatrace problem."
+        },
+        {
+          "name": "Update Problem Comment",
+          "description": "Replace the text of an existing comment on a Dynatrace problem."
+        },
+        {
+          "name": "Delete Problem Comment",
+          "description": "Delete a comment from a Dynatrace problem."
+        },
+        {
+          "name": "Create SLO",
+          "description": "Create a service-level objective from a metric expression, target, and evaluation timeframe."
+        },
+        {
+          "name": "Update SLO",
+          "description": "Update an existing service-level objective. Every field is replaced, so send the complete definition."
+        },
+        {
+          "name": "Delete SLO",
+          "description": "Delete a service-level objective."
+        },
         {
           "name": "Get Audit Logs",
           "description": "Read the Dynatrace audit log — who changed which configuration, when, and whether it succeeded."
         }
       ],
-      "operationCount": 22,
+      "operationCount": 47,
       "triggers": [],
       "triggerCount": 0,
       "authType": "api-key",

apps/sim/blocks/blocks/dynatrace.ts

@@ -0,0 +1,105 @@
+import { tagProperties } from '@/tools/dynatrace/outputs'
+import type { DynatraceAddTagsParams, DynatraceAddTagsResponse } from '@/tools/dynatrace/types'
+import {
+  buildDynatraceUrl,
+  dynatraceHeaders,
+  mapTags,
+  parseJsonParam,
+  readJsonBody,
+} from '@/tools/dynatrace/utils'
+import { ErrorExtractorId } from '@/tools/error-extractors'
+import type { ToolConfig } from '@/tools/types'
+
+export const addTagsTool: ToolConfig<DynatraceAddTagsParams, DynatraceAddTagsResponse> = {
+  id: 'dynatrace_add_tags',
+  name: 'Dynatrace Add Tags',
+  description:
+    'Add custom tags to every monitored entity an entity selector matches. Tags drive selectors, management zones, and alerting.',
+  version: '1.0.0',
+  errorExtractor: ErrorExtractorId.DYNATRACE_ERRORS,
+
+  params: {
+    environmentUrl: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description:
+        'Dynatrace environment URL (e.g., https://abc12345.live.dynatrace.com, or https://your-activegate:9999/e/abc12345 for Managed)',
+    },
+    apiToken: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'Dynatrace access token (dt0c01...) with the entities.write scope',
+    },
+    entitySelector: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Entity selector for the entities to tag, e.g. type("HOST"),tag("env:staging")',
+    },
+    tags: {
+      type: 'json',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'Tags to add, as an array of objects with a key and an optional value (e.g. [{"key":"owner","value":"platform"},{"key":"reviewed"}])',
+    },
+    from: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description:
+        'Start of the timeframe as UTC milliseconds, ISO 8601, or a relative expression. Defaults to now-24h',
+    },
+    to: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'End of the timeframe in the same formats as From. Defaults to now',
+    },
+  },
+
+  request: {
+    url: (params) =>
+      buildDynatraceUrl(params.environmentUrl, '/tags', {
+        entitySelector: params.entitySelector,
+        from: params.from,
+        to: params.to,
+      }),
+    method: 'POST',
+    headers: (params) => dynatraceHeaders(params.apiToken),
+    body: (params) => {
+      const tags = parseJsonParam(params.tags)
+      if (!Array.isArray(tags) || tags.length === 0) {
+        throw new Error('tags must be a non-empty array of objects with a key')
+      }
+      return { tags }
+    },
+  },
+
+  transformResponse: async (response: Response) => {
+    const data = await readJsonBody(response)
+
+    return {
+      success: true,
+      output: {
+        appliedTags: mapTags(data.appliedTags),
+        matchedEntitiesCount: (data.matchedEntitiesCount as number) ?? null,
+      },
+    }
+  },
+
+  outputs: {
+    appliedTags: {
+      type: 'array',
+      description: 'Tags that were applied',
+      items: { type: 'object', properties: tagProperties },
+    },
+    matchedEntitiesCount: {
+      type: 'number',
+      description: 'How many entities the selector matched and were tagged',
+      nullable: true,
+    },
+  },
+}

apps/sim/lib/integrations/integrations.json

@@ -0,0 +1,145 @@
+import type {
+  DynatraceCreateSettingsObjectParams,
+  DynatraceCreateSettingsObjectResponse,
+} from '@/tools/dynatrace/types'
+import {
+  buildDynatraceUrl,
+  dynatraceHeaders,
+  mapSettingsWriteResult,
+  parseJsonParam,
+} from '@/tools/dynatrace/utils'
+import { ErrorExtractorId } from '@/tools/error-extractors'
+import type { ToolConfig } from '@/tools/types'
+
+export const createSettingsObjectTool: ToolConfig<
+  DynatraceCreateSettingsObjectParams,
+  DynatraceCreateSettingsObjectResponse
+> = {
+  id: 'dynatrace_create_settings_object',
+  name: 'Dynatrace Create Settings Object',
+  description:
+    'Create a settings object — a maintenance window, alerting profile, management zone, or any other schema-backed configuration.',
+  version: '1.0.0',
+  errorExtractor: ErrorExtractorId.DYNATRACE_ERRORS,
+
+  params: {
+    environmentUrl: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description:
+        'Dynatrace environment URL (e.g., https://abc12345.live.dynatrace.com, or https://your-activegate:9999/e/abc12345 for Managed)',
+    },
+    apiToken: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'Dynatrace access token (dt0c01...) with the settings.write scope',
+    },
+    schemaId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'Schema of the object to create, e.g. builtin:alerting.maintenance-window. List Settings Schemas returns the available IDs',
+    },
+    scope: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'Scope the object applies to, e.g. environment or an entity ID such as HOST-06F288EE2A930951',
+    },
+    value: {
+      type: 'json',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'The configuration itself. Its shape is defined by the schema — read an existing object of the same schema to see the expected fields',
+    },
+    schemaVersion: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Schema version to validate against. Defaults to the latest',
+    },
+    externalId: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'External ID to correlate the object with a system outside Dynatrace',
+    },
+    validateOnly: {
+      type: 'boolean',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Validate the payload without creating anything',
+    },
+  },
+
+  request: {
+    url: (params) =>
+      buildDynatraceUrl(params.environmentUrl, '/settings/objects', {
+        validateOnly: params.validateOnly,
+      }),
+    method: 'POST',
+    headers: (params) => dynatraceHeaders(params.apiToken),
+    // The endpoint takes an array; this tool creates exactly one object.
+    body: (params) => {
+      const value = parseJsonParam(params.value)
+      if (value === undefined) throw new Error('value is required')
+      const entry: Record<string, unknown> = {
+        schemaId: params.schemaId,
+        scope: params.scope,
+        value,
+      }
+      if (params.schemaVersion) entry.schemaVersion = params.schemaVersion
+      if (params.externalId) entry.externalId = params.externalId
+      return JSON.stringify([entry])
+    },
+  },
+
+  transformResponse: async (response: Response) => {
+    const text = await response.text()
+    const parsed = text.trim() ? JSON.parse(text) : []
+    const entries = Array.isArray(parsed) ? (parsed as Array<Record<string, unknown>>) : []
+    const results = entries.map(mapSettingsWriteResult)
+
+    return {
+      success: true,
+      output: {
+        results,
+        objectId: results[0]?.objectId ?? null,
+      },
+    }
+  },
+
+  outputs: {
+    results: {
+      type: 'array',
+      description: 'One result per submitted object',
+      items: {
+        type: 'object',
+        properties: {
+          code: { type: 'number', description: 'Per-object HTTP status', nullable: true },
+          objectId: { type: 'string', description: 'ID of the created object', nullable: true },
+          writeError: {
+            type: 'json',
+            description: 'Validation error for this object, when it failed',
+            nullable: true,
+          },
+          invalidValue: {
+            type: 'json',
+            description: 'The value that was rejected',
+            optional: true,
+          },
+        },
+      },
+    },
+    objectId: {
+      type: 'string',
+      description: 'ID of the created object, lifted from the first result',
+      nullable: true,
+    },
+  },
+}