search-logs returns 403 Forbidden despite valid credentials and correct permissions

[MikeG-PAR]

The search-logs tool returns a 403 Forbidden authorization error on every call, despite the following being confirmed correct:

API Key and Application Key are valid and active (verified — other tools like get-monitors and get-events work successfully with the same keys)
Datadog user role has full Logs Read Data and Logs Read Index Data permissions
Application Key is either unscoped (full access) or explicitly scoped with logs_read_data and logs_read_index_data
DATADOG_STORAGE_TIER: indexes environment variable is set
--logsSite datadoghq.com argument is configured
Server version: 1.0.9
Datadog site: datadoghq.com (US1)

Error message returned:
Datadog API authorization failed. Please verify your API and Application keys have the correct permissions to access logs.
MCP server log output:
Authorization failed (403 Forbidden): Check that your API key and Application key are valid and have sufficient permissions to access logs.
Config used:
json{
"datadog": {
"command": "npx",
"args": [
"-y",
"datadog-mcp-server",
"--apiKey", "",
"--appKey", "",
"--site", "datadoghq.com",
"--logsSite", "datadoghq.com"
],
"env": {
"DD_API_KEY": "",
"DD_APP_KEY": "",
"DD_SITE": "datadoghq.com",
"DATADOG_STORAGE_TIER": "indexes"
}
}
}
Suspected cause:
The logs API endpoint or request construction in v1.0.9 appears to be incorrect. The same credentials successfully authenticate against the monitors and events endpoints, so the issue is isolated to the logs API call. Possible causes include incorrect endpoint URL, missing or malformed auth headers specific to the v2 logs API, or an issue with how the storage tier parameter is passed.
Expected behavior: search-logs should return log results when called with valid credentials and sufficient permissions.
Actual behavior: 403 Forbidden on every call regardless of query parameters.