Skip to main content
Connect an AppDynamics (Cisco) Controller to let CloudThinker agents list your applications, tiers, nodes, and business transactions, rank the slowest or most error-prone transactions, triage active health-rule violations, and show whether a slow request spent its time in a database, an external call, a queue, or your own code. The connection signs in with an AppDynamics API client (OAuth2 client credentials), and every command agents run against the Controller is a read.

​
Prerequisites

  • An AppDynamics Controller, SaaS or on-premises, that monitors the applications you care about.
  • Admin access to the Controller, so you can create an API client.
  • If the Controller is on-premises: it must accept HTTPS from CloudThinker Cloud. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options.

​
Setup

1

Note your Controller URL and account name

Sign in to the Controller and copy the base address, for example https://myaccount.saas.appdynamics.com. Leave off any path such as /controller.On SaaS, the account name is usually the subdomain (myaccount in the example). You can also find it under Settings → License.
2

Create an API client

Go to Settings → Administration → API Clients and click Create.
  • Client Name: cloudthinker
  • Description: Read-only access for CloudThinker agents
  • Roles: a view-only role that can see the applications agents should read
Generate the secret and copy it right away. AppDynamics shows it only once.Leave the token expiration at its default. CloudThinker requests a fresh short-lived token whenever it needs one, so that setting doesn’t affect the connection.
3

Add the connection in CloudThinker

Open More → Workspace settings → Connections, stay on the Builtin Connections tab, and select AppDynamics. Fill in all four fields:
  • APPD_CONTROLLER_URL: the Controller base URL
  • APPD_ACCOUNT_NAME: the account name
  • APPD_CLIENT_NAME: the client name only, such as cloudthinker
  • APPD_CLIENT_SECRET: the secret you copied
Click Connect. CloudThinker runs a test call against the Controller with these credentials.Success state: AppDynamics shows Connected. Run the verify prompt below to confirm the client can see your applications.
Enter the client name without @<account>. CloudThinker builds the OAuth2 client ID as <APPD_CLIENT_NAME>@<APPD_ACCOUNT_NAME> for you, so cloudthinker@myaccount in the name field becomes cloudthinker@myaccount@myaccount and fails with 401.

​
Connection details

All four fields are required. To reach a second Controller, add it as a separate connection with its own API client.

​
Required permissions

Give the API client a view-only role scoped to the applications agents should read. Agents need to see: Agents never change AppDynamics configuration, so leave every configure and admin permission off this role. If an application is missing from results, the role can’t see it.

​
Agent capabilities

Agents start with a short window, such as the last 60 minutes, and widen only if there’s no signal. They use the real application, tier, and transaction names from discovery instead of guessing IDs.

​
Verify the connection

Expect the account, a list of applications with their tier and node counts, and any open violations. An empty application list usually means the role can’t see any applications.

​
Example prompts

Name the application in every prompt for large Controllers. It keeps each request to a handful of calls.

​
Troubleshooting

The client name, secret, or account name is wrong, or the name includes @<account>. Check that APPD_CLIENT_NAME is the bare name and APPD_ACCOUNT_NAME matches the Controller. If the secret was lost or regenerated, generate a new one in API Clients, then edit the connection.
Check APPD_CONTROLLER_URL: it should be the HTTPS base address with no path. For an on-premises Controller, confirm it accepts HTTPS traffic from CloudThinker’s egress IPs.
The API client’s role can’t see those applications, or the Controller has no data for the window. Grant view access to the application, then retry with a known application name and the last hour.
The name is misspelled or the application was renamed. Ask the agent to list applications or business transactions first, then use the exact name.
The Controller is rate limiting or overloaded. Wait a minute, narrow the time window, and ask again.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Read-only by design: agents only read applications, metrics, violations, events, and snapshots. They have no command that changes the Controller.
  • Dedicated API client: create a client used only by CloudThinker so you can revoke it without breaking other tools.
  • HTTPS only: always use an https:// Controller URL so the client secret is protected in transit.

Root cause analysis

See how Resolve uses APM data to find what broke.

Connections overview

Add the cloud, logs, and code that complete the picture.