How do AI agents use Grafana through Open Connector?

Your user connects Grafana once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Grafana tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Grafana MCP server?

Yes. Open Connector can serve Grafana as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Grafana actions with credentials injected server-side.

Where do Grafana credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Grafana integration

Grafana integration for AI agents.

Grafana integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Grafana tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real Grafana actions, managed and audited.

Your user connects Grafana once; your agent can then secure AI-agent actions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants Grafana access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Grafana tools.

314 tools are generated from the published Grafana catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 314 tools. All published catalog entries are included in this page's server-rendered HTML.

Create a data source.: By defining `password` and `basicAuthPassword` under secureJsonData property Grafana encrypts them securely as an encrypted blob in the database. The response then lists the encrypted fields under secureJsonFields. If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:create`; datasources
Add invite.: Add invite.; orginvites
Add a new user to the current organization.: Adds a global user to the current organization. If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:add` with scope `users:*`.; orgs
Add a new user to the current organization.: Adds a global user to the current organization. If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:add` with scope `users:*`.; org
Add External Group.: Add External Group.; sync_team_groupsenterprise
Add Team Member.: Add Team Member.; teams
Add team role.: You need to have a permission with action `teams.roles:add` and scope `permissions:type:delegate`.; access_controlenterprise
Add a user role assignment.: Assign a role to a specific user. For bulk updates consider Set user role assignments. You need to have a permission with action `users.roles:add` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only assign roles which have same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to assign a role which will allow to do that. This is done to prevent escalation of privileges.; access_controlenterprise
Create new user.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users:create`. Note that OrgId is an optional parameter that can be used to assign a new user to a different organization when `auto_assign_org` is set to `true`.; admin_users
Delete global User.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users:delete` and scope `global.users:*`.; admin_users
Disable user.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users:disable` and scope `global.users:1` (userIDScope).; admin_users
Enable user.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users:enable` and scope `global.users:1` (userIDScope).; admin_users
Fetch settings.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `settings:read` and scopes: `settings:*`, `settings:auth.saml:` and `settings:auth.saml:enabled` (property level).; admin
Fetch Grafana Stats.: Only works with Basic Authentication (username and password). See introduction for an explanation. If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `server:stats:read`.; admin
Return a list of all auth tokens (devices) that the user currently have logged in from.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.authtoken:list` and scope `global.users:*`.; admin_users
Logout user revokes all auth tokens (devices) for the user. User of issued auth tokens (devices) will no longer be logged in and will be required to authenticate again upon next activity.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.logout` and scope `global.users:*`.; admin_users
You need to have a permission with action `provisioning:reload` with scope `provisioners:accesscontrol`.: You need to have a permission with action `provisioning:reload` with scope `provisioners:accesscontrol`.; admin_provisioningaccess_controlenterprise
Reload dashboard provisioning configurations.: Reloads the provisioning config files for dashboards again. It won’t return until the new provisioned entities are already stored in the database. In case of dashboards, it will stop polling for changes in dashboard files and then restart it with new configurations after returning. If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `provisioning:reload` and scope `provisioners:dashboards`.; admin_provisioning
Reload datasource provisioning configurations.: Reloads the provisioning config files for datasources again. It won’t return until the new provisioned entities are already stored in the database. In case of dashboards, it will stop polling for changes in dashboard files and then restart it with new configurations after returning. If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `provisioning:reload` and scope `provisioners:datasources`.; admin_provisioning
Reload plugin provisioning configurations.: Reloads the provisioning config files for plugins again. It won’t return until the new provisioned entities are already stored in the database. In case of dashboards, it will stop polling for changes in dashboard files and then restart it with new configurations after returning. If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `provisioning:reload` and scope `provisioners:plugin`.; admin_provisioning
Revoke auth token for user.: Revokes the given auth token (device) for the user. User of issued auth token (device) will no longer be logged in and will be required to authenticate again upon next activity. If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.authtoken:update` and scope `global.users:*`.; admin_users
Set password for user.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.password:update` and scope `global.users:*`.; admin_users
Set permissions for user.: Only works with Basic Authentication (username and password). See introduction for an explanation. If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.permissions:update` and scope `global.users:*`.; admin_users
Fetch data source resources.: Fetch data source resources.; datasources
Cancel a snapshot, wherever it is in its processing chain.: TODO: Implement; migrations
Change Password.: Changes the password for the user.; signed_in_user
Sends a health check request to the plugin datasource identified by the UID.: Sends a health check request to the plugin datasource identified by the UID.; datasourceshealth
CleanDataSourceCache: clean cache for a single data source; enterprise
Create gcom access token.: Create gcom access token.; migrations
Add correlation.: Add correlation.; datasourcescorrelations
When creating a snapshot using the API, you have to provide the full dashboard payload including the snapshot data. This endpoint is designed for the Grafana UI.: Snapshot public mode should be enabled or authentication is required.; dashboardssnapshots
Create folder.: If nested folders are enabled then it additionally expects the parent folder UID. Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders/{folder_uid}; folders
Create library element.: Creates a new library element.; library_elements
Create Organization.: Only works if [users.allow_org_create](https://grafana.com/docs/grafana/latest/administration/configuration/#allow_org_create) is set.; orgs
Create playlist.: Please refer to [new API](?api=playlist.grafana.app-v1).; playlists
CreatePublicDashboard: Create public dashboard for a dashboard; dashboardsdashboard_public
Add query to query history.: Adds new query to query history.; query_history
Create a recording rule that is then registered and started.: Create a recording rule that is then registered and started.; recording_rulesenterprise
Create a remote write target.: It returns a 422 if there is not an existing prometheus data source configured.; recording_rulesenterprise
Create a report.: Available to org admins only and with a valid license. You need to have a permission with action `reports.admin:create`.; reportsenterprise
Create a new custom role.: Creates a new custom role and maps given permissions to that role. Note that roles with the same prefix as Fixed Roles can’t be created. You need to have a permission with action `roles:write` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only create custom roles with the same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to create a custom role which allows to do that. This is done to prevent escalation of privileges.; access_controlenterprise
Create service account: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:write` scope: `serviceaccounts:*` Requires basic authentication and that the authenticated user is a Grafana Admin.; service_accounts
Create a migration session.: Create a migration session.; migrations
Trigger the creation of an instance snapshot associated with the provided session.: If the snapshot initialization is successful, the snapshot uid is returned.; migrations
Add Team.: Add Team.; teams
CreateNewToken adds a token to a service account: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:write` scope: `serviceaccounts:id:1` (single service account); service_accounts
Data source proxy DELETE calls.: Proxies all calls to the actual data source.; datasources
Data source proxy GET calls.: Proxies all calls to the actual data source.; datasources
Data source proxy POST calls.: Proxies all calls to the actual data source. The data source should support POST methods for the specific path and role as defined; datasources
Delete Annotation By ID.: Deletes the annotation that matches the specified ID.; annotations
Deletes a cloud migration token.: Deletes a cloud migration token.; migrations
Delete a correlation.: Delete a correlation.; datasourcescorrelations
Delete dashboard by uid.: Will delete the dashboard given the specified unique identifier (uid). Use: /apis/dashboard.grafana.app/v1/namespaces/{ns}/dashboards/{uid}; dashboards
Delete Snapshot by Key.: Delete Snapshot by Key.; dashboardssnapshots
Delete Snapshot by deleteKey.: Snapshot public mode should be enabled or authentication is required.; dashboardssnapshots
Delete an existing data source by name. This function will be removed in the future.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:delete` and scopes: `datasources:*`, `datasources:name:*` and `datasources:name:test_datasource` (single data source).; datasources
Delete an existing data source by UID.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:delete` and scopes: `datasources:*`, `datasources:uid:*` and `datasources:uid:kLtEtcRGk` (single data source).; datasources
Delete folder.: Deletes an existing folder identified by UID along with all dashboards (and their alerts) stored in the folder. This operation cannot be reverted. If nested folders are enabled then it also deletes all the subfolders. Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders/{folder_uid}; folders
Delete library element.: Deletes an existing library element as specified by the UID. This operation cannot be reverted. You cannot delete a library element that is connected. This operation cannot be reverted.; library_elements
Remove license from database.: Removes the license stored in the Grafana database. Available in Grafana Enterprise v7.4+. You need to have a permission with action `licensing:delete`.; licensingenterprise
Delete Organization.: Delete Organization.; orgs
Delete playlist.: Please refer to [new API](?api=playlist.grafana.app-v1).; playlists
DeletePublicDashboard: Delete public dashboard for a dashboard; dashboardsdashboard_public
Delete query in query history.: Deletes an existing query in query history as specified by the UID. This operation cannot be reverted.; query_history
Delete removes the rule from the registry and stops it.: Delete removes the rule from the registry and stops it.; recording_rulesenterprise
Delete the remote write target.: Delete the remote write target.; recording_rulesenterprise
Delete a report.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports.delete` with scope `reports:id:<report ID>`. Requesting reports using the internal id will stop workgin in the future Use the reporting apiserver to manage reports. See: /apis/reporting.grafana.app/; reportsenterprise
Delete a custom role.: Delete a role with the given UID, and it’s permissions. If the role is assigned to a built-in role, the deletion operation will fail, unless force query param is set to true, and in that case all assignments will also be deleted. You need to have a permission with action `roles:delete` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only delete a custom role with the same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to delete a custom role which allows to do that.; access_controlenterprise
Delete service account: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:delete` scope: `serviceaccounts:id:1` (single service account); service_accounts
Delete a migration session by its uid.: Delete a migration session by its uid.; migrations
Delete Team By ID.: Delete Team By ID.; teams
DeleteToken deletes service account tokens: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:write` scope: `serviceaccounts:id:1` (single service account) Requires basic authentication and that the authenticated user is a Grafana Admin.; service_accounts
DisableDataSourceCache: disable cache for a single data source; enterprise
EnableDataSourceCache: enable cache for a single data source; enterprise
Get status.: Returns an indicator to check if fine-grained access control is enabled or not. You need to have a permission with action `status:accesscontrol` and scope `services:accesscontrol`.; access_controlenterprise
Get Annotation by ID.: Get Annotation by ID.; annotations
Find Annotations Tags.: Find all the event tags created in the annotations.; annotations
Find Annotations.: Starting in Grafana v6.4 regions annotations are now returned in one entity that now includes the timeEnd property.; annotations
Fetch the cloud migration token if it exists.: Fetch the cloud migration token if it exists.; migrations
Gets a correlation.: Gets a correlation.; datasourcescorrelations
Gets all correlations.: Gets all correlations.; datasourcescorrelations
Gets all correlations originating from the given data source.: Gets all correlations originating from the given data source.; datasourcescorrelations
Get current Organization.: Get current Organization.; org
Fetch Organization quota.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `orgs.quotas:read` and scope `org:id:1` (orgIDScope).; quotaorg
Get custom permissions report in CSV format.: You need to have a permission with action `licensing.reports:read`.; licensingenterprise
Get custom permissions report.: You need to have a permission with action `licensing.reports:read`.; licensingenterprise
Get dashboard by uid.: Optional query parameter `apiVersion` selects the Kubernetes API version used to load the dashboard first (for example `v1beta1`). If that request fails, the default version is used instead. When omitted, only the default is used. Will return the dashboard given the dashboard unique identifier (uid). Use: /apis/dashboard.grafana.app/v1/namespaces/{ns}/dashboards/{uid}; dashboards
Gets all existing permissions for the given dashboard.: Use: /apis/dashboard.grafana.app/v1/namespaces/{ns}/dashboards/{uid}/access; dashboardspermissions
Get Snapshot by Key.: Get Snapshot by Key.; dashboardssnapshots
Get all dashboards tags of an organization.: Get all dashboards tags of an organization.; dashboards
Get a specific dashboard version using UID.: Get a specific dashboard version using UID.; dashboardsversions
Gets all existing versions for the dashboard using UID.: Gets all existing versions for the dashboard using UID.; dashboardsversions
Get a single data source by Name. This function will be removed in the future.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:read` and scopes: `datasources:*`, `datasources:name:*` and `datasources:name:test_datasource` (single data source).; datasources
Get a single data source by UID.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:read` and scopes: `datasources:*`, `datasources:uid:*` and `datasources:uid:kLtEtcRGk` (single data source).; datasources
GetDataSourceCacheConfig: get cache config for a single data source; enterprise
Get data source Id by Name. This function will be removed in the future.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:read` and scopes: `datasources:*`, `datasources:name:*` and `datasources:name:test_datasource` (single data source).; datasources
Get all data sources.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:read` and scope: `datasources:*`.; datasources
Get folder by uid.: Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders/{folder_uid}; folders
Gets the count of each descendant of a folder by kind. The folder is identified by UID.: Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders/{folder_uid}; folders
Gets all existing permissions for the folder with the given `uid`.: Gets all existing permissions for the folder with the given `uid`.; folderspermissions
Get all folders.: It returns all folders that the authenticated user has permission to view. If nested folders are enabled, it expects an additional query parameter with the parent folder UID and returns the immediate subfolders that the authenticated user has permission to view. If the parameter is not supplied then it returns immediate subfolders under the root that the authenticated user has permission to view. Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders; folders
GetHealth: apiHealthHandler will return ok if Grafana's web server is running and it can access the database. If the database cannot be accessed it will return http status code 503.; health
GetHomeDashboard: NOTE: the home dashboard is configured in preferences. This API will be removed in G13; dashboards
Attempts to connect to all the configured LDAP servers and returns information on whenever they're available or not.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.status:read`.; admin_ldap
Get library element by name.: Returns a library element with the given name.; library_elements
Get library element by UID.: Returns a library element with the given UID.; library_elements
Get library element connections.: Returns a list of connections for a library element based on the UID specified.; library_elements
Get all library elements.: Returns a list of all library elements the authenticated user has permission to view. Use the `perPage` query parameter to control the maximum number of library elements returned; the default limit is `100`. You can also use the `page` query parameter to fetch library elements from any page other than the first one.; library_elements
Get license token.: You need to have a permission with action `licensing:read`.; licensingenterprise
It exposes the SP (Grafana's) metadata for the IdP's consumption.: It exposes the SP (Grafana's) metadata for the IdP's consumption.; samlenterprise
Get Organization by ID.: Get Organization by ID.; orgs
Get Organization by Name.: Get Organization by Name.; orgs
Get Current Org Prefs.: Use /apis/preferences.grafana.app/v1/namespaces/{namespace}/preferences/namespace; orgpreferences
Fetch Organization quota.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `orgs.quotas:read` and scope `org:id:1` (orgIDScope).; quotaorgs
Get Users in Organization.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:read` with scope `users:*`.; orgs
Get all users within the current organization.: Returns all org users within the current organization. Accessible to users with org admin role. If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:read` with scope `users:*`.; org
Get all users within the current organization (lookup): Returns all org users within the current organization, but with less detailed information. Accessible to users with org admin role, admin in any folder or admin of any team. Mainly used by Grafana UI for providing list of users when adding team members and when editing folder/dashboard permissions.; org
Get pending invites.: Get pending invites.; orginvites
Get playlist.: Please refer to [new API](?api=playlist.grafana.app-v1).; playlists
Get playlist items.: Please refer to [new API](?api=playlist.grafana.app-v1) instead (items are included in the playlist spec).; playlists
Get an SSO Settings entry by Key: You need to have a permission with action `settings:read` with scope `settings:auth.<provider>:*`.; sso_settings
GetPublicAnnotations: Get annotations for a public dashboard; dashboardsannotationsdashboard_public
GetPublicDashboard: Get public dashboard by dashboardUid; dashboardsdashboard_public
Return the prometheus remote write target.: Return the prometheus remote write target.; recording_rulesenterprise
Get a report.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports:read` with scope `reports:id:<report ID>`. Requesting reports using the internal id will stop workgin in the future Use the reporting apiserver to manage reports. See: /apis/reporting.grafana.app/; reportsenterprise
Get report settings.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports.settings:read`x.; reportsenterprise
List reports.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports:read` with scope `reports:*`.; reportsenterprise
List reports by dashboard uid.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports:read` with scope `reports:*`.; reportsenterprise
Get the resource dependencies graph for the current set of migratable resources.: Get the resource dependencies graph for the current set of migratable resources.; migrations
Get a description of a resource's access control properties.: Get a description of a resource's access control properties.; access_control
Get permissions for a resource.: Get permissions for a resource.; access_control
Get a role.: Get a role for the given UID. You need to have a permission with action `roles:read` and scope `roles:*`.; access_controlenterprise
Get role assignments.: Get role assignments for the role with the given UID. Does not include role assignments mapped through group attribute sync. You need to have a permission with action `teams.roles:list` and scope `teams:id:*` and `users.roles:list` and scope `users:id:*`.; access_controlenterprise
GetLogout initiates single logout process.: GetLogout initiates single logout process.; samlenterprise
Get a cloud migration session by its uid.: Get a cloud migration session by its uid.; migrations
Get a list of all cloud migration sessions that have been created.: Get a list of all cloud migration sessions that have been created.; migrations
Get custom branding report image.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports.settings:read`.; reportsenterprise
Get a list of snapshots for a session.: Get a list of snapshots for a session.; migrations
Get snapshot sharing settings.: Get snapshot sharing settings.; snapshots
GetSignedInUser: Get (current authenticated user); signed_in_user
Organizations of the actual User.: Return a list of all organizations of the current user.; signed_in_user
Teams that the actual User is member of.: Return a list of all teams that the current user is member of.; signed_in_user
It performs Single Logout (SLO) callback.: There might be two possible requests: 1. Logout response (callback) when Grafana initiates single logout and IdP returns response to logout request. 2. Logout request when another SP initiates single logout and IdP sends logout request to the Grafana, or in case of IdP-initiated logout.; samlenterprise
Get metadata about a snapshot, including where it is in its processing and final results.: Get metadata about a snapshot, including where it is in its processing and final results.; migrations
Check license availability.: Check license availability.; licensingenterprise
Returns the current state of the LDAP background sync integration.: You need to have a permission with action `ldap.status:read`.; admin_ldapenterprise
Get Team By ID.: Get Team By ID.; teams
Get External Groups.: Get External Groups.; sync_team_groupsenterprise
Retrieves LBAC rules for a team.: Retrieves LBAC rules for a team.; enterprise
Get Team Members.: Get Team Members.; teams
Get Team Preferences.: Get Team Preferences.; teamspreferences
Auth tokens of the actual User.: Return a list of all auth tokens (devices) that the actual user currently have logged in from.; signed_in_user
Get user by id.: Get user by id.; users
Get user by login or email.: Get user by login or email.; users
Finds an user based on a username in LDAP. This helps illustrate how would the particular user be mapped in Grafana when synced.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.user:read`.; admin_ldap
Get organizations for user.: Get organizations for user identified by id.; users
Get user preferences.: Use /apis/preferences.grafana.app/v1/namespaces/{namespace}/preferences/user-{uid}; signed_in_userpreferences
Fetch user quota.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.quotas:list` and scope `global.users:1` (userIDScope).; quotaadmin_users
Fetch user quota.: Fetch user quota.; quotasigned_in_user
Get teams for user.: Get teams for user identified by id.; users
Import dashboard.: Import dashboard.; dashboards
Interpolate dashboard. This is an experimental endpoint under dashboardLibrary or suggestedDashboards feature flags and is subject to change.: Interpolate dashboard. This is an experimental endpoint under dashboardLibrary or suggestedDashboards feature flags and is subject to change.; dashboards
List all SSO Settings entries: You need to have a permission with action `settings:read` with scope `settings:auth.<provider>:*`.; sso_settings
Lists all devices within the last 30 days: Lists all devices within the last 30 days; devices
ListPublicDashboards: Get list of public dashboards; dashboardsdashboard_public
Lists all rules in the database: active or deleted.: Lists all rules in the database: active or deleted.; recording_rulesenterprise
Get all roles.: Gets all existing roles. The response contains all global and organization local roles, for the organization which user is signed in. You need to have a permission with action `roles:read` and scope `roles:*`. The `delegatable` flag reduces the set of roles to only those for which the signed-in user has permissions to assign.; access_controlenterprise
List search sorting options.: List search sorting options.; search
Get team roles.: You need to have a permission with action `teams.roles:read` and scope `teams:id:<team ID>`.; access_controlenterprise
List roles assigned to multiple teams.: Lists the roles that have been directly assigned to the given teams. You need to have a permission with action `teams.roles:read` and scope `teams:id:*`.; access_controlenterprise
Get service account tokens: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:read` scope: `global:serviceaccounts:id:1` (single service account) Requires basic authentication and that the authenticated user is a Grafana Admin.; service_accounts
List roles assigned to a user.: Lists the roles that have been directly assigned to a given user. The list does not include built-in roles (Viewer, Editor, Admin or Grafana Admin), and it does not include roles that have been inherited from a team. You need to have a permission with action `users.roles:read` and scope `users:id:<user ID>`.; access_controlenterprise
List roles assigned to multiple users.: Lists the roles that have been directly assigned to the given users. The list does not include built-in roles (Viewer, Editor, Admin or Grafana Admin), and it does not include roles that have been inherited from a team. You need to have a permission with action `users.roles:read` and scope `users:id:*`.; access_controlenterprise
Delete multiple annotations.: Delete multiple annotations.; annotations
Move folder.: Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders/{folder_uid}, Changing the parent folder annotation; folders
Patch Annotation.: Updates one or more properties of an annotation that matches the specified ID. This operation currently supports updating of the `text`, `tags`, `time` and `timeEnd` properties. This is available in Grafana 6.0.0-beta2 and above.; annotations
Patch Current Org Prefs.: Use /apis/preferences.grafana.app/v1/namespaces/{namespace}/preferences/namespace; orgpreferences
Patch SSO Settings: Partially updates the SSO Settings for a provider. Only provided fields are updated. You need to have a permission with action `settings:write` and scope `settings:auth.<provider>:*`.; sso_settings
Update comment for query in query history.: Updates comment for query in query history as specified by the UID.; query_history
Patch user preferences.: Use /apis/preferences.grafana.app/v1/namespaces/{namespace}/preferences/user-{uid}; signed_in_userpreferences
It performs Assertion Consumer Service (ACS).: It performs Assertion Consumer Service (ACS).; samlenterprise
Create Annotation.: Creates an annotation in the Grafana database. The dashboardId and panelId fields are optional. If they are not specified then an organization annotation is created and can be queried in any dashboard that adds the Grafana annotations data source. When creating a region annotation include the timeEnd property. The format for `time` and `timeEnd` should be epoch numbers in millisecond resolution. The response for this HTTP request is slightly different in versions prior to v6.4. In prior versions you would also get an endId if you where creating a region. But in 6.4 regions are represented using a single event with time and timeEnd properties.; annotations
Create / Update dashboard: Creates a new dashboard or updates an existing dashboard. Note: This endpoint is not intended for creating folders, use `POST /api/folders` for that. Use: /apis/dashboard.grafana.app/v1/namespaces/{ns}/dashboards; dashboards
Create Annotation in Graphite format.: Creates an annotation by using Graphite-compatible event format. The `when` and `data` fields are optional. If `when` is not specified then the current time will be used as annotation’s timestamp. The `tags` field can also be in prior to Graphite `0.10.0` format (string with multiple tags being separated by a space).; annotations
Create license token.: You need to have a permission with action `licensing:write`.; licensingenterprise
Manually force license refresh.: Manually ask license issuer for a new token. Available in Grafana Enterprise v7.4+. You need to have a permission with action `licensing:write`.; licensingenterprise
It performs Single Logout (SLO) callback.: There might be two possible requests: 1. Logout response (callback) when Grafana initiates single logout and IdP returns response to logout request. 2. Logout request when another SP initiates single logout and IdP sends logout request to the Grafana, or in case of IdP-initiated logout.; samlenterprise
Enables a single Grafana user to be synchronized against LDAP.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.user:sync`.; admin_ldap
DataSource query metrics with expressions.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:query`.; datasources
QueryPublicDashboard: Get results for a given panel on a public dashboard; dashboardsdashboard_public
Refresh license stats.: You need to have a permission with action `licensing:read`.; licensingenterprise
Reloads the LDAP configuration.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.config:reload`.; admin_ldap
Delete user in current organization.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:remove` with scope `users:*`.; orgs
Delete user in current organization.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:remove` with scope `users:*`.; org
Remove SSO Settings: Removes the SSO Settings for a provider. You need to have a permission with action `settings:write` and scope `settings:auth.<provider>:*`.; sso_settings
Remove External Group.: Remove External Group.; sync_team_groupsenterprise
Remove Member From Team.: Remove Member From Team.; teams
Remove team role.: You need to have a permission with action `teams.roles:remove` and scope `permissions:type:delegate`.; access_controlenterprise
Remove a user role assignment.: Revoke a role from a user. For bulk updates consider Set user role assignments. You need to have a permission with action `users.roles:remove` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only unassign roles which have same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to unassign a role which will allow to do that. This is done to prevent escalation of privileges.; access_controlenterprise
Download a CSV report.: Available to all users and with a valid license.; reportsenterprise
Render report for multiple dashboards.: Available to all users and with a valid license.; reportsenterprise
Restore a dashboard to a given dashboard version using UID.: This API will be removed when /apis/dashboard.grafana.app/v1 is released. You can restore a dashboard by reading it from history, then creating it again.; dashboardsversions
Get JSON Web Key Set (JWKS) with all the keys that can be used to verify tokens (public keys): Required permissions None; signing_keys
Get single serviceaccount by Id: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:read` scope: `serviceaccounts:id:1` (single service account); service_accounts
Revoke invite.: Revoke invite.; orginvites
Revoke an auth token of the actual User.: Revokes the given auth token (device) for the actual user. User of issued auth token (device) will no longer be logged in and will be required to authenticate again upon next activity.; signed_in_user
Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace.: Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace.; convert_prometheus
Deletes a specific rule group if it was imported from a Prometheus-compatible source.: Deletes a specific rule group if it was imported from a Prometheus-compatible source.; convert_prometheus
Gets Grafana-managed alert rules that were imported from Prometheus-compatible sources for a specified namespace (folder).: Gets Grafana-managed alert rules that were imported from Prometheus-compatible sources for a specified namespace (folder).; convert_prometheus
Gets a single rule group in Prometheus-compatible format if it was imported from a Prometheus-compatible source.: Gets a single rule group in Prometheus-compatible format if it was imported from a Prometheus-compatible source.; convert_prometheus
Gets all Grafana-managed alert rules that were imported from Prometheus-compatible sources, grouped by namespace.: Gets all Grafana-managed alert rules that were imported from Prometheus-compatible sources, grouped by namespace.; convert_prometheus
Converts a Prometheus rule group into a Grafana rule group and creates or updates it within the specified namespace.: If the group already exists and was not imported from a Prometheus-compatible source initially, it will not be replaced and an error will be returned.; convert_prometheus
Converts the submitted rule groups into Grafana-Managed Rules.: Converts the submitted rule groups into Grafana-Managed Rules.; convert_prometheus
Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace.: Deletes all rule groups that were imported from Prometheus-compatible sources within the specified namespace.; convert_prometheus
Deletes a specific rule group if it was imported from a Prometheus-compatible source.: Deletes a specific rule group if it was imported from a Prometheus-compatible source.; convert_prometheus
Gets Grafana-managed alert rules that were imported from Prometheus-compatible sources for a specified namespace (folder).: Gets Grafana-managed alert rules that were imported from Prometheus-compatible sources for a specified namespace (folder).; convert_prometheus
Gets a single rule group in Prometheus-compatible format if it was imported from a Prometheus-compatible source.: Gets a single rule group in Prometheus-compatible format if it was imported from a Prometheus-compatible source.; convert_prometheus
Gets all Grafana-managed alert rules that were imported from Prometheus-compatible sources, grouped by namespace.: Gets all Grafana-managed alert rules that were imported from Prometheus-compatible sources, grouped by namespace.; convert_prometheus
Converts a Prometheus rule group into a Grafana rule group and creates or updates it within the specified namespace.: If the group already exists and was not imported from a Prometheus-compatible source initially, it will not be replaced and an error will be returned.; convert_prometheus
Converts the submitted rule groups into Grafana-Managed Rules.: Converts the submitted rule groups into Grafana-Managed Rules.; convert_prometheus
Delete a specific alert rule by UID.: Delete a specific alert rule by UID.; provisioning
RouteDeleteAlertRuleGroup: Delete rule group; provisioning
Delete a contact point.: Delete a contact point.; provisioning
Delete a mute timing.: Delete a mute timing.; provisioning
Delete a notification template group.: Delete a notification template group.; provisioning
Export a mute timing in provisioning format.: Export a mute timing in provisioning format.; provisioning
Export all mute timings in provisioning format.: Export all mute timings in provisioning format.; provisioning
Get a specific alert rule by UID.: Get a specific alert rule by UID.; provisioning
Export an alert rule in provisioning file format.: Export an alert rule in provisioning file format.; provisioning
Get a rule group.: Get a rule group.; provisioning
Export an alert rule group in provisioning file format.: Export an alert rule group in provisioning file format.; provisioning
Get all the alert rules.: Get all the alert rules.; provisioning
Export all alert rules in provisioning file format.: Export all alert rules in provisioning file format.; provisioning
Get all the contact points.: Get all the contact points.; provisioning
Export all contact points in provisioning file format.: Export all contact points in provisioning file format.; provisioning
Get a mute timing.: Get a mute timing.; provisioning
Get all the mute timings.: Get all the mute timings.; provisioning
Get the notification policy tree.: Get the notification policy tree.; provisioning
Export the notification policy tree in provisioning file format.: Export the notification policy tree in provisioning file format.; provisioning
Get a notification template group.: Get a notification template group.; provisioning
Get all notification template groups.: Get all notification template groups.; provisioning
Create a new alert rule.: Create a new alert rule.; provisioning
Create a contact point.: Create a contact point.; provisioning
Create a new mute timing.: Create a new mute timing.; provisioning
Update an existing alert rule.: Update an existing alert rule.; provisioning
Create or update alert rule group.: Create or update alert rule group.; provisioning
Update an existing contact point.: Update an existing contact point.; provisioning
Replace an existing mute timing.: Replace an existing mute timing.; provisioning
Sets the notification policy tree.: Sets the notification policy tree.; provisioning
Updates an existing notification template group.: Updates an existing notification template group.; provisioning
Clears the notification policy tree.: Clears the notification policy tree.; provisioning
Save settings.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports.settings:write`xx.; reportsenterprise
Search: Search; search
List snapshots.: List snapshots.; dashboardssnapshots
Lists all devices within the last 30 days: Lists all devices within the last 30 days; devices
Search service accounts with paging: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:read` scope: `serviceaccounts:*`; service_accounts
Search Users in Organization.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users:read` with scope `users:*`.; orgs
Search all Organizations.: Search all Organizations.; orgs
Get playlists.: Please refer to [new API](?api=playlist.grafana.app-v1).; playlists
Query history search.: Returns a list of queries in the query history that matches the search criteria. Query history search supports pagination. Use the `limit` parameter to control the maximum number of queries returned; the default limit is 100. You can also use the `page` query parameter to fetch queries from any page other than the first one.; query_history
Search for team groups with optional filtering and pagination.: Search for team groups with optional filtering and pagination.; sync_team_groupsenterprise
Team Search With Paging.: Team Search With Paging.; teams
Get users.: Returns all users that the authenticated user has permission to view, admin permission required.; users
Get users with paging.: Get users with paging.; users
Send a report.: Generate and send a report. This API waits for the report to be generated before returning. We recommend that you set the client’s timeout to at least 60 seconds. Available to org admins only and with a valid license. Only available in Grafana Enterprise v7.0+. This API endpoint is experimental and may be deprecated in a future release. On deprecation, a migration strategy will be provided and the endpoint will remain functional until the next major release of Grafana. You need to have a permission with action `reports:send`.; reportsenterprise
Send test report via email.: Available to org admins only and with a valid license. You need to have a permission with action `reports:send`.; reportsenterprise
SetDataSourceCacheConfig: set cache config for a single data source; enterprise
Set resource permissions.: Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to one or many assignment types. Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`. Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.; access_control
Set resource permissions for a built-in role.: Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to a built-in role. Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`. Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.; access_control
Set resource permissions for a team.: Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to a team. Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`. Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.; access_control
Set resource permissions for a user.: Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to a user or a service account. Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`. Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.; access_control
Set role assignments.: Set role assignments for the role with the given UID. You need to have a permission with action `teams.roles:add` and `teams.roles:remove` and scope `permissions:type:delegate`, and `users.roles:add` and `users.roles:remove` and scope `permissions:type:delegate`.; access_controlenterprise
Set team memberships.: Takes user emails, and updates team members and admins to the provided lists of users. Any current team members and admins not in the provided lists will be removed.; teams
Update team role.: You need to have a permission with action `teams.roles:add` and `teams.roles:remove` and scope `permissions:type:delegate` for each.; access_controlenterprise
Set user role assignments.: Update the user’s role assignments to match the provided set of UIDs. This will remove any assigned roles that aren’t in the request and add roles that are in the set but are not already assigned to the user. Roles mapped through group attribute sync are not impacted. If you want to add or remove a single role, consider using Add a user role assignment or Remove a user role assignment instead. You need to have a permission with action `users.roles:add` and `users.roles:remove` and scope `permissions:type:delegate` for each. `permissions:type:delegate` scope ensures that users can only assign or unassign roles which have same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to assign or unassign a role which will allow to do that. This is done to prevent escalation of privileges.; access_controlenterprise
Star a dashboard.: Stars the given Dashboard for the actual user.; signed_in_user
Add star to query in query history.: Adds star to query in query history as specified by the UID.; query_history
Test a recording rule.: Test a recording rule.; recording_rulesenterprise
Unstar a dashboard.: Deletes the starring of the given Dashboard for the actual user.; signed_in_user
Remove star to query in query history.: Removes star from query in query history as specified by the UID.; query_history
Update Annotation.: Updates all properties of an annotation that matches the specified id. To only update certain property, consider using the Patch Annotation operation.; annotations
Updates a correlation.: Updates a correlation.; datasourcescorrelations
Update current Organization.: Update current Organization.; org
Update current Organization's address.: Update current Organization's address.; org
Updates permissions for a dashboard.: This operation will remove existing permissions if they’re not included in the request.; dashboardspermissions
Update an existing data source.: Similar to creating a data source, `password` and `basicAuthPassword` should be defined under secureJsonData in order to be stored securely as an encrypted blob in the database. Then, the encrypted fields are listed under secureJsonFields section in the response. If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `datasources:write` and scopes: `datasources:*`, `datasources:uid:*` and `datasources:uid:1` (single data source).; datasources
Update folder.: Use: /apis/folder.grafana.app/v1/namespaces/{ns}/folders/{folder_uid}; folders
Updates permissions for a folder. This operation will remove existing permissions if they’re not included in the request.: Updates permissions for a folder. This operation will remove existing permissions if they’re not included in the request.; folderspermissions
Update library element.: Updates an existing library element identified by uid.; library_elements
Update Organization.: Update Organization.; orgs
Update Organization's address.: Update Organization's address.; orgs
Update Current Org Prefs.: Use /apis/preferences.grafana.app/v1/namespaces/{namespace}/preferences/namespace; orgpreferences
Update user quota.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `orgs.quotas:write` and scope `org:id:1` (orgIDScope).; quotaorgs
Update Users in Organization.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users.role:update` with scope `users:*`.; orgs
Updates the given user.: If you are running Grafana Enterprise and have Fine-grained access control enabled you need to have a permission with action: `org.users.role:update` with scope `users:*`.; org
Update playlist.: Please refer to [new API](?api=playlist.grafana.app-v1).; playlists
Update SSO Settings: Inserts or updates the SSO Settings for a provider. You need to have a permission with action `settings:write` and scope `settings:auth.<provider>:*`.; sso_settings
UpdatePublicDashboard: Update public dashboard for a dashboard; dashboardsdashboard_public
Update the active status of a rule.: Update the active status of a rule.; recording_rulesenterprise
Update a report.: Available to org admins only and with a valid or expired license. You need to have a permission with action `reports.admin:write` with scope `reports:id:<report ID>`. Requesting reports using the internal id will stop workgin in the future Use the reporting apiserver to manage reports. See: /apis/reporting.grafana.app/; reportsenterprise
Update a custom role.: You need to have a permission with action `roles:write` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only create custom roles with the same, or a subset of permissions which the user has.; access_controlenterprise
Update service account: Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation): action: `serviceaccounts:write` scope: `serviceaccounts:id:1` (single service account); service_accounts
Update signed in User.: Update signed in User.; signed_in_user
Update Team.: Update Team.; teams
Updates LBAC rules for a team.: Updates LBAC rules for a team.; enterprise
Update Team Member.: Update Team Member.; teams
Update Team Preferences.: Update Team Preferences.; teamspreferences
Update user.: Update the user identified by id.; users
Update user email.: Update the email of user given a verification code.; user
Update user preferences.: Use /apis/preferences.grafana.app/v1/namespaces/{namespace}/preferences/user-{uid}; signed_in_userpreferences
Update user quota.: If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `users.quotas:update` and scope `global.users:1` (userIDScope).; quotaadmin_users
Upload a snapshot to the Grafana Migration Service for processing.: Upload a snapshot to the Grafana Migration Service for processing.; migrations
Switch user context for signed in user.: Switch user context to the given organization.; signed_in_user
ViewPublicDashboard: Get public dashboard for view; dashboardsdashboard_public

FAQ

Grafana integration, answered

How do AI agents use Grafana through Open Connector?: Your user connects Grafana once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Grafana tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Grafana MCP server?: Yes. Open Connector can serve Grafana as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Grafana actions with credentials injected server-side.
Where do Grafana credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Grafana — keep the keys.

Open source, self-hostable, with Grafana credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →