Grafana

Overview

Use Grafana credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	grafana
Category	Monitoring & Observability
Credential Type	Bearer Token

Step 1: Get Credentials

Log in to Grafana Cloud

Log in to Grafana Cloud at grafana.com/auth/sign-in.

Open your Grafana instance

Open your Grafana instance and go to Administration → Service Accounts.

Create a service account

Follow the Grafana service-account guide to create a service account and add a token.

Copy your token

Copy the generated token (starts with glsa_).

Enter your Grafana domain

Enter your Grafana domain in the Grafana Domain field (e.g. your-stack.grafana.net).

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Grafana

Go to Managed Secrets > Add Provider > Grafana.

Enter credentials

Paste your Service Account Token and Grafana Domain into their respective fields.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://YOUR_GRAFANA_STACK.grafana.net/api/dashboards/home",
    grant_id="YOUR_GRANT_ID",
)

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
search	read	GET	/search
getDashboardByUID	read	GET	/dashboards/uid/{uid}
getDashboardVersionsByUID	read	GET	/dashboards/uid/{uid}/versions
postDashboard	write	POST	/dashboards/db
importDashboard	write	POST	/dashboards/import
deleteDashboardByUID	delete	DELETE	/dashboards/uid/{uid}
getFolders	read	GET	/folders
getFolderByUID	read	GET	/folders/{folder_uid}
createFolder	write	POST	/folders
moveFolder	write	POST	/folders/{folder_uid}/move
deleteFolder	delete	DELETE	/folders/{folder_uid}
getAnnotations	read	GET	/annotations
postAnnotation	write	POST	/annotations
patchAnnotation	write	PATCH	/annotations/{annotation_id}
deleteAnnotationByID	delete	DELETE	/annotations/{annotation_id}
massDeleteAnnotations	delete	POST	/annotations/mass-delete
getDataSources	read	GET	/datasources
getDataSourceByUID	read	GET	/datasources/uid/{uid}
addDataSource	admin	POST	/datasources
deleteDataSourceByUID	admin, delete	DELETE	/datasources/uid/{uid}
queryMetricsWithExpressions	read	POST	/ds/query
getCurrentOrg	read	GET	/org
getOrgUsersForCurrentOrg	read	GET	/org/users
addOrgUserToCurrentOrg	admin	POST	/org/users
removeOrgUserForCurrentOrg	admin, delete	DELETE	/org/users/{user_id}
searchUsers	read	GET	/users
searchTeams	read	GET	/teams/search
createTeam	admin	POST	/teams
addTeamMember	admin	POST	/teams/{team_id}/members
removeTeamMember	admin, delete	DELETE	/teams/{team_id}/members/{user_id}
createServiceAccount	admin	POST	/serviceaccounts
createToken	admin	POST	/serviceaccounts/{serviceAccountId}/tokens
deleteServiceAccount	admin, delete	DELETE	/serviceaccounts/{serviceAccountId}
getHealth	read	GET	/health