Skip to main content

Managing Users

1. Creating Users

Field Description Example
name User's full name John Doe
email User's email address john.doe@example.com
login Login identifier (username) johnd
password Password for authentication securePassword123
role Access level (e.g., Admin, Editor, Viewer) Editor

Example: Create User via API

{
  "name": "John Doe",
  "email": "john.doe@example.com",
  "login": "johnd",
  "password": "securePassword123",
  "role": "Editor"
}
Note: Ensure the password meets security requirements (minimum 8 characters, includes uppercase, lowercase, and numeric characters).

2. Setting User Roles

Role Description Permissions Notes
Viewer Read-only access to dashboards and data View dashboards, explore data, export data Default role for new users
Editor Can create and edit dashboards, data sources, and folders All Viewer permissions + Create/edit dashboards, data sources, folders Can manage their own dashboards and explore data
Admin Full access to all Grafana features and settings All Editor permissions + Manage users, data sources, plugins, and settings Can configure Grafana and manage all users
Grafana Admin Full access to Grafana instance and all features All Admin permissions + Manage organization, settings, and plugins Can manage all aspects of the Grafana instance

Example: Assigning a Role to a User via API

curl -X PUT "http://localhost:3000/api/org/users/123" \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"role": "Editor"}'
Note: User roles can also be managed via the Grafana UI under Configuration > Users.

3. Managing User Permissions

Permission Scope Description
Admin Global Full access to all Grafana features and settings
Editor Global Can create, edit, and delete dashboards and panels
Viewer Global Can view dashboards and panels but cannot make changes
Org Admin Organization Full access within the organization, including user and team management
Team Admin Team Manage team members and permissions within the team

Example: Assigning User Permissions via API

curl -X PUT "http://localhost:3000/api/org/users/1" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"role": "Editor"}'
Note: Permissions can also be managed through the Grafana UI under Configuration > Users.
Warning: Be cautious when assigning Admin permissions as they grant full access to all data and settings.

4. Configuring User Preferences

Preference Description Default Value Notes
theme Color theme for the Grafana interface dark Options: dark, light, auto
timezone Timezone used for displaying time values utc Can be set to any valid IANA timezone identifier
language Language for the Grafana UI en-US Supports multiple locales, default is English (US)
homeDashboard Dashboard to open by default when logging in default Can be set to a dashboard UID or path
autoRefreshInterval Auto-refresh interval for dashboards in seconds 0 Set to 0 to disable auto-refresh

Example: Setting User Preferences via API

const preferences = {
  theme: "light",
  timezone: "America/New_York",
  language: "en-US",
  homeDashboard: "dashboard-uid-here",
  autoRefreshInterval: 30
};

fetch("/api/user/preferences", {
  method: "PUT",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "Bearer <your-api-token>"
  },
  body: JSON.stringify(preferences)
});
Note: User preferences are stored per-user and can be overridden by organization settings.

5. Disabling User Accounts

Property Description Default
user.disabled Flag to disable a user account false

Example: Disable User via API

curl -X PUT "http://localhost:3000/api/admin/users/<user-id>/disable" \
  -H "Authorization: Bearer <api-token>"
Note: Disabling a user does not delete their account or data. They can be re-enabled later.

6. Deleting Users

Deleting users in Grafana is a critical administrative task that should be handled with care to avoid unintended access loss.

Option Values Notes
User ID 12345 Unique identifier for the user to be deleted
Deletion Method API Can be done via Grafana API or UI
Permissions Required Admin User must have admin privileges to delete other users

Example: Delete User via API

curl -X DELETE "http://grafana.example.com/api/users/12345" \\\n  -H "Authorization: Bearer <your_api_token>" \\\n  -H "Content-Type: application/json"
Note: Deleting a user will remove all their permissions and access to dashboards, but it will not delete any data or configurations associated with them.
Warning: This action is irreversible. Ensure that the user has been properly migrated or their data has been backed up before deletion.

7. Viewing User Activity

Activity Description Time User
Login Successful login to Grafana 2026-01-15 09:00:00 admin
Dashboard View Viewed dashboard "Server Metrics" 2026-01-15 09:05:00 admin
Dashboard Edit Edited dashboard "Server Metrics" 2026-01-15 09:10:00 admin
Query Execution Executed query "CPU Usage" 2026-01-15 09:15:00 admin
Logout User logged out 2026-01-15 09:20:00 admin

Example: User Activity Query

SELECT
  user_id,
  activity_type,
  description,
  timestamp
FROM
  user_activities
WHERE
  timestamp >= '2026-01-15 00:00:00'
ORDER BY
  timestamp ASC;
Note: Activity logs are stored for 30 days by default in Grafana.
Warning: Ensure audit logs are enabled for compliance purposes.

8. Managing User Sessions

Property Description Default Value Notes
session.timeout Duration after which a session expires 8h Configurable in grafana.ini
session.cookie.name Name of the session cookie grafana_session Used for tracking user sessions
session.cookie.secure Whether to set the Secure flag on session cookies false Set to true in HTTPS environments
session.cookie.httpOnly Whether to set the HttpOnly flag on session cookies true Prevents XSS attacks by blocking client-side JavaScript access

Example: Configuring Session Timeout

[session]
timeout = 12h
cookie.name = grafana_session
cookie.secure = true
cookie.httpOnly = true
Note: Session timeout can be adjusted per user via the Grafana UI under Configuration > Users.
Warning: Setting cookie.secure to true requires a secure HTTPS connection to function properly.

Session Management Best Practices

  • Set a reasonable session timeout to balance security and usability.
  • Enable Secure and HttpOnly flags for session cookies in production environments.
  • Regularly review and audit user sessions to detect unauthorized access.

9. Setting User Quotas

Property Description Default Value Notes
quota.org Maximum number of organizations a user can belong to 10 Applies to all users in the organization
quota.user Maximum number of users that can be created in an organization 100 Applies to all users in the organization
quota.dashboard Maximum number of dashboards a user can create 50 Applies to all users in the organization
quota.folder Maximum number of folders a user can create 20 Applies to all users in the organization
quota.alert Maximum number of alerts a user can create 100 Applies to all users in the organization
quota.datasource Maximum number of data sources a user can create 10 Applies to all users in the organization
quota.apikey Maximum number of API keys a user can create 10 Applies to all users in the organization
quota.team Maximum number of teams a user can create 5 Applies to all users in the organization

Example: Setting User Quotas in Grafana Configuration

[quota]
org = 10
user = 100
dashboard = 50
folder = 20
alert = 100
datasource = 10
apikey = 10
team = 5
Note: Quota settings can be overridden per organization via the Grafana UI or API.
Warning: Setting quotas too low may prevent users from creating necessary dashboards or alerts.

10. Using User API

Endpoint Method Description Notes
/api/users GET Get all users Requires admin permission
/api/users/<id> GET Get user by ID
/api/users POST Create a new user
/api/users/<id> PUT Update user details
/api/users/<id> DELETE Delete a user

Example: Create a new user

{
  "name": "John Doe",
  "email": "john.doe@example.com",
  "login": "johndoe",
  "password": "securePassword123"
}

Example: Update user role

{
  "role": "Admin"
}
Note: The password field is only required when creating a new user or changing the password.

Was this article helpful?