# Set up Audit Log Retention

This is a read-only composite, but it needs a model credential and every listed data source configured before it can run. Set up isolated test accounts or workspaces first, grant only the smallest read scope that exposes the test data, and store every credential only in Dome's secret inputs. Never put a key or secret in this repository, an agent prompt, or a chat message.

## Create the model credential

- Create an API key in the [Anthropic Console](https://console.anthropic.com/settings/keys).
- Enter the raw key as `anthropic_api_key` during import. Do not prepend `Bearer `.
- The template uses that key only for its managed `claude-sonnet-5` model connection.

## Create the provider credentials

- `google_oauth_client_id`: A Google OAuth client ID for an AI-powered agent.
- `google_oauth_client_secret`: The Google OAuth client secret.

For a provider that asks you to register a manual OAuth app, use this callback URL exactly:

`https://api.domesystems.ai/oauth/callback`

## Set up each connected provider

### Vanta

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test organization with an identity limited to the required compliance data. The provider OAuth scope is broad, so verify the gateway's read-only tool list before use.

### Datadog

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

Before starting OAuth, a Datadog organization administrator must open
**Organization Settings → MCP OAuth Redirect URLs** and add this exact URL:

`https://api.domesystems.ai/oauth/callback`

Datadog rejects the consent flow with **Mismatching redirect URI** until that
allowlist entry exists. Dome uses Dynamic Client Registration, so no separate
Datadog OAuth client or client secret is needed. Dome requests Datadog's
published `mcp_all` scope during consent.

Before connecting, an organization administrator must also enable **MCP Access**
in Datadog. The authorizing test user needs **MCP Read** and the underlying
resource permissions (for example, Monitors Read); custom roles need those
permissions added explicitly. This composite starts with Datadog's generally
available `core` toolset. Add the Preview `apm` toolset only after obtaining
Datadog's APM Preview access.


After saving, complete OAuth with a test user that has read access only to the selected services, logs, and dashboards. This composite targets US1 and uses the `core` toolset.

### Sentry

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, complete OAuth with a test user that can view only the target organization and projects. Use project-scoped Sentry access wherever available.

### Google Drive

Before import, open [Google Cloud OAuth clients](https://console.cloud.google.com/auth/clients/create) and create a **Web application** OAuth client. Enable **Use this client for an AI-powered agent**, add `https://api.domesystems.ai/oauth/callback` as an authorized redirect URI, and copy the client ID and secret. In **APIs & Services → Library**, enable both **Google Drive API** and **Google Drive MCP API** for that same project. Configure the consent screen as **Internal**, or add the test user if it is **External**.

- `google_oauth_client_id` and `google_oauth_client_secret`: enter values from a Google Cloud Web OAuth client configured as an AI-powered agent.

Enable the Drive and Drive MCP APIs, register the redirect URI shown by Dome, and request only `https://www.googleapis.com/auth/drive.readonly`.

### Notion

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

Importing the template creates the Notion connection and
attaches it to the gateway without waiting for a tool catalog. In the
connection step, sign in to Notion with an account that can access the
workspace or pages the agent should search, then approve the requested
connection. After authorization, refresh the Notion connection's tools so the
gateway can use the discovered catalog. Dome uses the API key only to create
the shared model connection; Sandbox does not retain the value.

## Import and verify

1. Import the template and provide the values above.
2. Complete every browser OAuth flow with the intended dedicated test user. Token-based sources do not open a browser.
3. Open **Tools**, refresh discovery, and confirm every connection is attached to the template gateway.
4. Run the managed agent against known test data. Treat the template as verified only when the run succeeds **and calls at least one expected read-only tool**.

If a connection is unreachable, check the provider section above for its callback, API/MCP enablement, token prefix, consent scopes, and user/workspace access before retrying.