Public Dashboard Sharing access controls and expiration

Answer to the Question

Datadog does not provide a native Time‑to‑Live (TTL) setting for public dashboard links, and there is no built‑in IP allowlisting or CIDR restriction for those links. Public URLs remain active until they are manually revoked via the UI or API.

Likely Explanation

The public‑share feature is intended for quick, high‑level visibility and relies on the secrecy of the URL. Datadog’s security model treats public links as “security‑by‑obscurity”; therefore, no network‑level guardrails are offered out of the box.

Confirmed Facts

• Public dashboard URLs are created from the dashboard’s sharing dialog and persist indefinitely until revoked.
• Revocation can be performed through the UI (stop sharing) or via the Datadog API endpoint /api/v1/shared_dashboard/{id}.
• No options for setting an expiration date, TTL, or IP‑based allowlist appear in the current UI or documented API responses.
• All viewers of a public link see the dashboard state at the moment of sharing; any data visible then is exposed to anyone with the URL.

Steps to Mitigate Exposure

1. Create the public link only when the stakeholder explicitly needs ad‑hoc access.
2. Periodically audit active public links via the UI or by calling GET /api/v1/shared_dashboard to identify stale URLs.
3. Immediately revoke a link when the stakeholder no longer requires access using the UI “Stop sharing” button or the API.
4. If you need expiration or IP restrictions, wrap the public URL behind an authenticated portal or a reverse‑proxy that enforces allowlisting and time‑based rules.

Missing Diagnostic Detail

To confirm whether your Datadog plan includes any extended sharing features (e.g., API‑driven TTL or IP controls), please indicate which Datadog product tier you are on (Free, Pro, Enterprise, etc.).