feat(dynatrace): add the write and configuration surfaces (#6398)

* feat(dynatrace): add the write and configuration surfaces

Takes the block from 22 operations to 47. The original PR shipped the read
paths plus a few ingests; this closes the gaps that made those reads
dead-end.

The one that was a real defect: security was read-only. The audit-vulnerabilities
skill promised "a remediation queue" and then gave you no way to act on it,
even though muting is the single most common triage action. Adds mute and
unmute, singly and in bulk, plus the remediation items behind a third-party
finding, plus the Attacks API so an exploited vulnerability can be traced to
the request that exploited it.

The rest, by how much they unblock:

- Custom tags (read/add/delete). Entity tags already drive every selector in
  the block; being able to write them closes a loop that was half open.
- Settings objects (schemas, list, get, create, update, delete). This is how
  maintenance windows, alerting profiles, and management zones are configured
  in modern Dynatrace, so "open a maintenance window before the deploy" was
  simply unreachable before. The value is a schema-defined blob, so the tool
  is honestly opaque rather than falsely typed; the docs tell you to mirror an
  existing object. Update and delete carry the updateToken so a concurrent
  change fails instead of being overwritten.
- Synthetic monitors and on-demand batch execution, which pairs with the
  deploy-marker tool to gate a release on a smoke test.
- Problem comment get/update/delete, and SLO create/update/delete, completing
  CRUD that was previously half-built.

Two structural notes. Synthetic monitors are the only endpoints still on
Environment API v1, so `buildDynatraceUrl` grew a v1 sibling and the shared
base-URL normalizer now strips either version; the query builder also learned
to repeat a param per value, which Synthetic's `tag` needs. And creating an
SLO returns 201 with an empty body and the new ID in the Location header, so
that tool reads the header rather than parsing nothing.

Deliberately excluded: the Grail/DQL query API. It is the long-term successor
to the deprecated logs/search endpoint, but it authenticates with a platform
token rather than an Api-Token, so it is a second auth path and belongs in
its own change.

* fix(dynatrace): drill the documented JSON shapes, and require the tag selector

Two problems, one found in review and one worth more than it was given.

The tag operations could run without an entity selector. All three tag tools
declare `entitySelector` required, but the shared block field was only marked
required for List Entities, so the block let a workflow reach those tools with
an invalid configuration and let Dynatrace do the rejecting. My own structural
auditor missed it because it only checked that *some* visible subBlock existed
for a required param, not that the specific one was required — that check is
now precise, and it confirms these three were the only instances across all 47
operations.

The larger one: outputs were declaring `type: 'json'` for shapes the API
reference documents in full. Thirty-five of them. The top-level entities were
mapped properly, but nested payloads — a problem's evidence and impact
analysis, a vulnerability's risk assessment and global counts, an attack's
attacker, request, entry point and exploited vulnerability, a remediation
item's assessment and mute state, the synthetic execution and failure records,
the metric ingest error envelope, the DQL translation — were passed through as
anonymous blobs. A downstream block could not reference `attacker.sourceIp`
without knowing to guess it. All of those now carry their fields.

What stays opaque is now only what genuinely is, and each says why in its
description: a settings object's schema-defined value, an entity's
type-dependent property bag and relationship keys, caller-supplied synthetic
metadata, an audit log's JSON patch, the undocumented partial-success body of
log ingestion, and the handful of security-detail shapes the reference names
without expanding.

* fix(dynatrace): make the synthetic enabled filter tri-state

Review catch. `enabled` on List Synthetic Monitors is a three-way filter —
enabled, disabled, or either — and I had it as a switch. The URL builder
deliberately serializes `false` (there is a test pinning that `evaluate=false`
survives), so leaving "Enabled Only" unchecked sent `enabled=false` and
returned only the disabled monitors: exactly backwards.

Made it a dropdown with Any / Enabled only / Disabled only, matching the
monitorType field directly above it, which had the same shape and already used
an empty-id "Any" option. The params mapper sends nothing for "Any".

Checked the other nine switches rather than assuming. None share the bug: for
each of them off genuinely means false, and false is Dynatrace's own default,
so serializing it is correct. A test now pins that list so the trap cannot be
re-introduced by converting one of them, alongside a test covering all three
states of the filter.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/dynatrace.mdx

@@ -1,5 +1,5 @@
 {
-  "updatedAt": "2026-08-07",
+  "updatedAt": "2026-08-08",
   "integrations": [
     {
       "type": "onepassword",
@@ -5431,8 +5431,8 @@
       "type": "dynatrace",
       "slug": "dynatrace",
       "name": "Dynatrace",
-      "description": "Query Dynatrace problems, metrics, entities, logs, SLOs, and vulnerabilities",
-      "longDescription": "Integrate Dynatrace into workflows. Investigate and close Davis problems, query metrics and monitored entities, search and ingest logs, push deployment events, track SLO burn rates, review Application Security vulnerabilities, and read the audit log.",
+      "description": "Manage Dynatrace problems, metrics, entities, logs, SLOs, settings, and security",
+      "longDescription": "Integrate Dynatrace into workflows. Investigate and close Davis problems, query metrics and monitored entities, search and ingest logs, push deployment events, manage SLOs and their burn rates, triage and mute Application Security vulnerabilities, review runtime attacks, tag entities, manage settings objects such as maintenance windows and alerting profiles, run synthetic monitors on demand, and read the audit log.",
       "bgColor": "#FFFFFF",
       "iconName": "DynatraceIcon",
       "docsUrl": "https://docs.sim.ai/integrations/dynatrace",
@@ -5521,12 +5521,112 @@
           "name": "Get Security Problem",
           "description": "Get a single vulnerability with its description, remediation guidance, affected entities, and risk assessment."
         },
+        {
+          "name": "Mute Security Problem",
+          "description": "Mute a single Dynatrace vulnerability with a reason, for triaging false positives or accepted risk."
+        },
+        {
+          "name": "Unmute Security Problem",
+          "description": "Unmute a single Dynatrace vulnerability, returning it to the active triage queue."
+        },
+        {
+          "name": "Mute Security Problems (Bulk)",
+          "description": "Mute several Dynatrace vulnerabilities at once with a shared reason, for bulk triage."
+        },
+        {
+          "name": "Unmute Security Problems (Bulk)",
+          "description": "Unmute several Dynatrace vulnerabilities at once, returning them to active triage."
+        },
+        {
+          "name": "List Remediation Items",
+          "description": "List the remediation items of a third-party vulnerability — the components to upgrade, their affected entities, and their mute state."
+        },
+        {
+          "name": "List Attacks",
+          "description": "List runtime attacks Dynatrace Application Protection detected — injection attempts, their source, and whether they were blocked."
+        },
+        {
+          "name": "Get Attack",
+          "description": "Get a single attack with its entry point, payload, attacker, and the vulnerability it exploited."
+        },
+        {
+          "name": "List Tags",
+          "description": "List the custom tags applied to the monitored entities an entity selector matches."
+        },
+        {
+          "name": "Add Tags",
+          "description": "Add custom tags to every monitored entity an entity selector matches. Tags drive selectors, management zones, and alerting."
+        },
+        {
+          "name": "Delete Tag",
+          "description": "Remove a custom tag from every monitored entity an entity selector matches. Deletes one key-value pair, or every tag with the key."
+        },
+        {
+          "name": "List Settings Schemas",
+          "description": "List the settings schemas available in the environment. Use it to find the schema ID for a configuration type such as builtin:alerting.profile."
+        },
+        {
+          "name": "List Settings Objects",
+          "description": "List settings objects — the configuration behind maintenance windows, alerting profiles, management zones, and anomaly detection."
+        },
+        {
+          "name": "Get Settings Object",
+          "description": "Get a single settings object with its value and its update token. Read it before updating so the token can guard against a concurrent change."
+        },
+        {
+          "name": "Create Settings Object",
+          "description": "Create a settings object — a maintenance window, alerting profile, management zone, or any other schema-backed configuration."
+        },
+        {
+          "name": "Update Settings Object",
+          "description": "Update an existing settings object. Pass the update token from Get Settings Object to fail rather than overwrite a concurrent change."
+        },
+        {
+          "name": "Delete Settings Object",
+          "description": "Delete a settings object. Dynatrace cannot undo this."
+        },
+        {
+          "name": "List Synthetic Monitors",
+          "description": "List synthetic monitors and their IDs. Use it to find the monitor IDs to feed into an on-demand execution."
+        },
+        {
+          "name": "Execute Synthetic Monitors",
+          "description": "Trigger an on-demand batch execution of synthetic monitors, for gating a deploy on a smoke test. Returns a batch ID to poll."
+        },
+        {
+          "name": "Get Synthetic Batch",
+          "description": "Get the status and failures of an on-demand synthetic batch execution. Poll it after triggering to gate a deploy on the result."
+        },
+        {
+          "name": "Get Problem Comment",
+          "description": "Get a single comment on a Dynatrace problem."
+        },
+        {
+          "name": "Update Problem Comment",
+          "description": "Replace the text of an existing comment on a Dynatrace problem."
+        },
+        {
+          "name": "Delete Problem Comment",
+          "description": "Delete a comment from a Dynatrace problem."
+        },
+        {
+          "name": "Create SLO",
+          "description": "Create a service-level objective from a metric expression, target, and evaluation timeframe."
+        },
+        {
+          "name": "Update SLO",
+          "description": "Update an existing service-level objective. Every field is replaced, so send the complete definition."
+        },
+        {
+          "name": "Delete SLO",
+          "description": "Delete a service-level objective."
+        },
         {
           "name": "Get Audit Logs",
           "description": "Read the Dynatrace audit log — who changed which configuration, when, and whether it succeeded."
         }
       ],
-      "operationCount": 22,
+      "operationCount": 47,
       "triggers": [],
       "triggerCount": 0,
       "authType": "api-key",

apps/sim/blocks/blocks/dynatrace.ts

@@ -0,0 +1,105 @@
+import { tagProperties } from '@/tools/dynatrace/outputs'
+import type { DynatraceAddTagsParams, DynatraceAddTagsResponse } from '@/tools/dynatrace/types'
+import {
+  buildDynatraceUrl,
+  dynatraceHeaders,
+  mapTags,
+  parseJsonParam,
+  readJsonBody,
+} from '@/tools/dynatrace/utils'
+import { ErrorExtractorId } from '@/tools/error-extractors'
+import type { ToolConfig } from '@/tools/types'
+
+export const addTagsTool: ToolConfig<DynatraceAddTagsParams, DynatraceAddTagsResponse> = {
+  id: 'dynatrace_add_tags',
+  name: 'Dynatrace Add Tags',
+  description:
+    'Add custom tags to every monitored entity an entity selector matches. Tags drive selectors, management zones, and alerting.',
+  version: '1.0.0',
+  errorExtractor: ErrorExtractorId.DYNATRACE_ERRORS,
+
+  params: {
+    environmentUrl: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description:
+        'Dynatrace environment URL (e.g., https://abc12345.live.dynatrace.com, or https://your-activegate:9999/e/abc12345 for Managed)',
+    },
+    apiToken: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'Dynatrace access token (dt0c01...) with the entities.write scope',
+    },
+    entitySelector: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Entity selector for the entities to tag, e.g. type("HOST"),tag("env:staging")',
+    },
+    tags: {
+      type: 'json',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'Tags to add, as an array of objects with a key and an optional value (e.g. [{"key":"owner","value":"platform"},{"key":"reviewed"}])',
+    },
+    from: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description:
+        'Start of the timeframe as UTC milliseconds, ISO 8601, or a relative expression. Defaults to now-24h',
+    },
+    to: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'End of the timeframe in the same formats as From. Defaults to now',
+    },
+  },
+
+  request: {
+    url: (params) =>
+      buildDynatraceUrl(params.environmentUrl, '/tags', {
+        entitySelector: params.entitySelector,
+        from: params.from,
+        to: params.to,
+      }),
+    method: 'POST',
+    headers: (params) => dynatraceHeaders(params.apiToken),
+    body: (params) => {
+      const tags = parseJsonParam(params.tags)
+      if (!Array.isArray(tags) || tags.length === 0) {
+        throw new Error('tags must be a non-empty array of objects with a key')
+      }
+      return { tags }
+    },
+  },
+
+  transformResponse: async (response: Response) => {
+    const data = await readJsonBody(response)
+
+    return {
+      success: true,
+      output: {
+        appliedTags: mapTags(data.appliedTags),
+        matchedEntitiesCount: (data.matchedEntitiesCount as number) ?? null,
+      },
+    }
+  },
+
+  outputs: {
+    appliedTags: {
+      type: 'array',
+      description: 'Tags that were applied',
+      items: { type: 'object', properties: tagProperties },
+    },
+    matchedEntitiesCount: {
+      type: 'number',
+      description: 'How many entities the selector matched and were tagged',
+      nullable: true,
+    },
+  },
+}