> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# New Relic

> Let agents run NRQL, list open alert issues and find entities with their alert status

The New Relic connector talks to NerdGraph in the US or EU data center with a user key.

## Tools

| Tool                  | What it returns                                                                                                       |
| --------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **Test Connection**   | The key's user email and the account name, and a warning when the key is not a user key                               |
| **Run NRQL**          | Result rows of one NRQL query plus metadata (time window, facets, event types)                                        |
| **List Alert Issues** | Open alert issues (or all in the window) with title, priority, state, condition, policy, entities and times           |
| **Search Entities**   | Applications, hosts, services and monitors by name, domain or type, with GUID, alert severity and whether they report |

## Safety

* **Read-only.** Every tool sends a GraphQL query, never a mutation, and NRQL itself cannot write.
* **No injection.** The NRQL text, the account ID and the entity search text travel as GraphQL variables, never written into the query document, so nothing an agent types can turn a read into something else.
* **Limits on every call.** 15 s timeout by default (up to 55 s with `timeout_seconds`, also passed to NRQL), 500 rows (up to 5,000 with `max_rows`) and 1 MB per result. A cut result has `truncated: true`.
* **No secrets in results.** The user key is removed from every error message.

## Create a read-only user key

A user key acts with the permissions of the user who owns it, so create a user that can only read:

1. In **Administration > Access management**, create a group (for example `danube-readonly`) with the **Read only** role on the accounts agents should see.
2. Add a user to that group, for example a `danube@yourcompany.com` basic user.
3. Signed in as that user, open **API keys**, click **Create a key**, choose **User**, and copy the key (`NRAK-...`).

License keys and browser keys do not work with NerdGraph; Test Connection warns if the key does not start with `NRAK-`.

## Connect

Open **New Relic** in the dashboard's tool catalog and click **Connect**, or let the agent call `store_credential`. Fill in the user key, the numeric account ID (in the account picker, or the URL of any page) and the data center (US or EU).

<Tabs>
  <Tab title="Direct">
    New Relic is a public service, so the connection is direct. Nothing needs to be allowlisted.
  </Tab>

  <Tab title="Data-plane agent">
    To keep the key inside your network, run the [data-plane agent](/organizations/data-plane) and store the key as a reference, for example `env://NEW_RELIC_USER_KEY`. The agent needs outbound HTTPS to `api.newrelic.com` (or `api.eu.newrelic.com`) in `DANUBE_ALLOWED_DESTINATIONS`.
  </Tab>
</Tabs>

Run **Test Connection** after saving. `auth_required` means the key was refused; `permission_denied` means the key's user cannot read that account.

## Example prompts

* "What alert issues are open right now, and which entities do they affect?"
* "Which transactions in `checkout-service` got slower in the last 24 hours compared with the day before?"
* "Show error counts by app for the last hour."
* "Which APM applications are critical and still reporting?"