Connecting Dynatrace to Bicycle
Connect to Dynatrace for infrastructure monitoring and full-stack observability. Bicycle uses the Dynatrace MCP gateway so agents can run tools such as DQL, Davis AI, problems, logs, metrics, and documentation lookup in CAUSE (investigation) workflows.
MCP access uses OAuth 2.0 with the client credentials grant (service-to-service). Do not use a personal access token, a Dynatrace classic API token, or a pasted static Platform token in the Bicycle form unless your deployment docs explicitly say otherwise.
Scopes: You choose permissions when creating the Dynatrace OAuth client. Bicycle does not ask you to paste scopes — the token request omits scope, so Dynatrace grants whatever was configured on that client.
Requirements
To follow the steps in this guide, you'll need:
- Permission to create connectors in Bicycle
- A Dynatrace SaaS environment with MCP gateway access
- An account admin who can create OAuth clients in Account Management
- An OAuth 2.0 client with the Client credentials grant and the MCP permissions you need
- Your environment’s apps URL —
https://{environment-id}.apps.dynatrace.com(not*.live.dynatrace.com)
| Item | Description |
|---|---|
| Environment URL | Platform URL, for example https://{your-environment-id}.apps.dynatrace.com (no trailing slash) |
| OAuth Client ID | Client ID from the Dynatrace OAuth client |
| OAuth Client secret | Client secret (shown only once at creation) |
| Authentication | OAuth 2.0 client credentials (machine-to-machine) |
Use the Dynatrace platform host (*.apps.dynatrace.com). Do not use classic environment URLs such as *.live.dynatrace.com. Wrong host → connection or tool calls fail even with a valid OAuth client.
Prepare Dynatrace access
Create a dedicated OAuth client for Bicycle. Do not use personal Dynatrace credentials for production connections.
Create an OAuth client
Create a confidential OAuth client with the Client credentials grant.
- Go to Account Management. If you have more than one account, select the account you want to manage.
- On the top navigation bar, go to Identity & access management → OAuth clients.
- Select Create client.
- Under Grant type, select Client credentials.
- Provide a Subject user email — an active user (or service user) whose permissions will bound the token.
- Provide a description (optional), then select the permissions (scopes) the client is allowed to request (see next step).
- Select Create client.
- Copy the Client ID and Client secret immediately and store them in your organization's secrets manager. The client secret is shown only once.
Effective token permissions are the intersection of:
- Scopes configured on the OAuth client, and
- Permissions of the subject user
If the subject user lacks a permission, MCP tools that need it fail even when the scope is listed on the client. Only account admins can create OAuth clients.
Select MCP permissions on the OAuth client
Select permissions in Dynatrace Account Management when creating the client. Bicycle inherits them automatically — there is no scopes field in the Bicycle form.
Always include gateway access:
mcp-gateway:servers:invoke
mcp-gateway:servers:read
For full MCP tool coverage, also select:
ai:operator:execute
davis-copilot:conversations:execute
davis-copilot:nl2dql:execute
davis-copilot:document-search:execute
davis-copilot:dql2nl:execute
davis:analyzers:read
davis:analyzers:execute
document:documents:read
storage:bizevents:read
storage:buckets:read
storage:system:read
storage:spans:read
storage:entities:read
storage:user.events:read
storage:user.sessions:read
storage:user.replays:read
storage:smartscape:read
storage:events:read
storage:metrics:read
storage:logs:read
storage:files:read
storage:security.events:read
Bicycle omits the scope parameter on the Dynatrace SSO token request. Dynatrace then returns a token with all permissions configured on that OAuth client. Configure scopes once in Dynatrace; you do not paste them into Bicycle.
Note your environment URL
Copy your Dynatrace environment URL from the product:
https://{your-environment-id}.apps.dynatrace.com
Do not include a trailing slash. Bicycle derives the MCP gateway path from this base URL:
https://{env-id}.apps.dynatrace.com/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp
Store the OAuth client secret in your organization's secrets manager, rotate it according to your security policy, and redact it from screenshots.
Setup in Bicycle
Open Connectors and select Dynatrace
In Bicycle, go to Connectors. Find Dynatrace and click + Connect.
Choose OAuth (client credentials)
Enter a connection name that identifies the environment (for example, Dynatrace Production). Select the OAuth / client-credentials connector method if prompted, then click Next.
Some UIs may still show a generic API token label. For this integration, use OAuth (client credentials) only — not a static Dynatrace access token or Platform token.
Enter connection details
On the Add details step, fill in the Dynatrace connection fields.
Environment URLRequiredYour Dynatrace platform URL, for example https://abc12345.apps.dynatrace.com. Must be *.apps.dynatrace.com, with no trailing slash.
OAuth Client IDRequiredClient ID from the Dynatrace OAuth client.
OAuth Client secretRequiredClient secret from the Dynatrace OAuth client. Token permissions come from scopes selected on this client in Dynatrace — you do not enter scopes in Bicycle.
Example Environment URL: https://abc12345.apps.dynatrace.com
Test the connection
Click Test connection. Bicycle exchanges the client credentials for an access token against Dynatrace SSO (https://sso.dynatrace.com/sso/oauth2/token) without sending a scope list, so the token inherits the OAuth client’s configured permissions. It then verifies the MCP gateway is reachable.
Access tokens typically last ~300 seconds. Bicycle refreshes them automatically via client credentials before expiry.
When the test succeeds, you will see that the connection is ready to add.
After a successful test, list tools and run a simple logs or DQL read if those scopes were granted on the OAuth client. A green handshake means the gateway is reachable; missing tool scopes on the Dynatrace client still limit which tools work.
Add the connection
Click Add connection. When the connection is created successfully, confirm the connection name and method, then click Close to return to the Connectors page.
Troubleshooting
If Test connection fails or tools misbehave after a successful connect, check the following.
| Error or symptom | Likely cause | Fix |
|---|---|---|
| Cannot reach MCP gateway / 404 | Wrong environment URL, trailing slash, or classic *.live.dynatrace.com URL | Use https://{environment-id}.apps.dynatrace.com with no trailing slash |
| Unauthorized / invalid client / SSO 4xx | Wrong client ID or secret, wrong grant type, or missing/invalid resource | Recreate client with Client credentials; verify secret; if Dynatrace requires resource=urn:dtaccount:{account-UUID}, confirm account UUID with your admin |
| Forbidden / missing scopes | OAuth client was created without MCP or tool scopes | Edit/recreate the client in Dynatrace and select mcp-gateway:* plus the tool scopes you need |
| Connection tests OK but most tools missing or fail | Partial scopes on the OAuth client, or subject user lacks matching permissions | Add MCP scopes on the client and grant the same capabilities to the subject user |
| Logs/DQL work but Davis / docs / problems do not | Those permissions were not selected on the OAuth client | Add davis-copilot:*, davis:analyzers:*, document:documents:read, and other storage:*:read scopes on the client |
| Works briefly then fails ~5 minutes later | Token expiry without refresh / pasted static bearer | Confirm Bicycle is using client-credentials refresh; retest; do not paste a one-off Platform token |
| Permission denied on a specific tool | Scope on client but not on subject user (intersection rule) | Elevate the subject user’s Dynatrace permissions or pick a subject user that already has them |
Outside Bicycle, you can confirm client credentials by requesting a token from https://sso.dynatrace.com/sso/oauth2/token with grant_type=client_credentials (omit scope), then calling your environment's MCP gateway with Authorization: Bearer {access_token}.
Capabilities
| Capability | Description |
|---|---|
| CAUSE | Run Dynatrace MCP tools (DQL, Davis, docs, observability data) as investigative evidence in RCA |
What's next?
Now that Dynatrace is connected, you can:
- Use Dynatrace as a CAUSE connector in observability workflows
- Run Dynatrace MCP tools such as DQL query and documentation lookup (subject to the scopes on your OAuth client and the subject user’s permissions)
- Investigate problems, logs, metrics, and related signals from Dynatrace in Bicycle agent flows