Public Access API

• Latest Dynatrace
• Reference
• Published Oct 13, 2026

Share Dynatrace dashboards publicly with the Public Access API: create share links with passcodes, IP allowlists, expiry dates, and admin controls.

The Public Access Service Public API lets authenticated Dynatrace users create and manage dashboard share configurations.

A share links a dashboard document to a set of access rules: passcode protection, IP allowlist, expiry date, locale, timezone, and timeframe overrides. Once created, a share can be distributed as a public URL; anonymous viewers follow that URL to access a sanitised snapshot of the dashboard through the reserved API, without requiring a Dynatrace account.

Share lifecycle

Filtering and sorting

GET /shares supports rich filter and sort expressions following DT REST API Guidelines.

Supported filter fields: id, documentId, actorId, expirationDate, type, locale, timezone, refreshIntervalMinutes.

Boolean operators and, or, not are supported. String operators: =, !=, contains, starts-with, ends-with, in. Date/time operators: =, !=, ``, >=, in (ISO 8601). Maximum parenthesis nesting depth: 3.

Filter examples:

documentId = 'b164c95f-da88-4967-8c4d-e5ff2619cfdb'
expirationDate > '2026-01-01T00:00:00Z'
type = 'dashboard' and locale starts-with 'en'

Sort example: -expirationDate,documentId (the - prefix means descending, with newest expiry first, then by document ID ascending).

IP allowlist

The IP allowlist restricts which source IP addresses are permitted to access the shared dashboard through the reserved API. When enabled, the API gateway enforces the allowlist before the request reaches this service; requests from addresses not on the list are rejected with 403 Forbidden.

Enable or disable the allowlist with PUT /shares/{shareId}/ip-allowlist:

{ "enabled": true }

The actual list of allowed IP ranges is managed separately in the Dynatrace platform settings, not through this API. This endpoint only controls whether the allowlist check is active for a given share.

Disabling the allowlist (enabled: false) makes the share accessible from any IP address, subject to any other access rules (passcode, expiry) that may still apply.

Passcode-protected shares

Create a share with passcode.enabled: true, then call POST /shares/{shareId}/passcode to generate the passcode value. Distribute the passcode to authorised viewers, who must supply it as a query parameter when calling the reserved API. Calling POST /shares/{shareId}/passcode again rotates the passcode and invalidates the previous one.

Error responses

All errors use a consistent envelope:

{
  "error": {
    "code": 404,
    "message": "Share not found",
    "details": { "traceId": "abc123" }
  }
}

Include the traceId when reporting issues to support.

Authentication

Platform API endpoints use Platform token and OAuth client authentication. Attach a platform token or OAuth access token to the Authorization HTTP header using the Bearer scheme.

--header 'Authorization: Bearer <platform-token-or-oauth-access-token>'

For details, see Tokens and authentication and Platform tokens.

Endpoints