Managing Users
1. Creating Users
| Field | Description | Example |
|---|---|---|
| name | User's full name | John Doe |
| User's email address | john.doe@example.com |
|
| login | Login identifier (username) | johnd |
| password | Password for authentication | securePassword123 |
| role | Access level (e.g., Admin, Editor, Viewer) | Editor |
Example: Create User via API
{
"name": "John Doe",
"email": "john.doe@example.com",
"login": "johnd",
"password": "securePassword123",
"role": "Editor"
}
Note: Ensure the password meets security requirements (minimum 8 characters, includes uppercase, lowercase, and numeric characters).
2. Setting User Roles
| Role | Description | Permissions | Notes |
|---|---|---|---|
| Viewer | Read-only access to dashboards and data | View dashboards, explore data, export data | Default role for new users |
| Editor | Can create and edit dashboards, data sources, and folders | All Viewer permissions + Create/edit dashboards, data sources, folders | Can manage their own dashboards and explore data |
| Admin | Full access to all Grafana features and settings | All Editor permissions + Manage users, data sources, plugins, and settings | Can configure Grafana and manage all users |
| Grafana Admin | Full access to Grafana instance and all features | All Admin permissions + Manage organization, settings, and plugins | Can manage all aspects of the Grafana instance |
Example: Assigning a Role to a User via API
curl -X PUT "http://localhost:3000/api/org/users/123" \
-H "Authorization: Bearer <API_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"role": "Editor"}'
Note: User roles can also be managed via the Grafana UI under
Configuration > Users.
3. Managing User Permissions
| Permission | Scope | Description |
|---|---|---|
| Admin | Global | Full access to all Grafana features and settings |
| Editor | Global | Can create, edit, and delete dashboards and panels |
| Viewer | Global | Can view dashboards and panels but cannot make changes |
| Org Admin | Organization | Full access within the organization, including user and team management |
| Team Admin | Team | Manage team members and permissions within the team |
Example: Assigning User Permissions via API
curl -X PUT "http://localhost:3000/api/org/users/1" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"role": "Editor"}'
Note: Permissions can also be managed through the Grafana UI under
Configuration > Users.
Warning: Be cautious when assigning
Admin permissions as they grant full access to all data and settings.
4. Configuring User Preferences
| Preference | Description | Default Value | Notes |
|---|---|---|---|
| theme | Color theme for the Grafana interface | dark |
Options: dark, light, auto |
| timezone | Timezone used for displaying time values | utc |
Can be set to any valid IANA timezone identifier |
| language | Language for the Grafana UI | en-US |
Supports multiple locales, default is English (US) |
| homeDashboard | Dashboard to open by default when logging in | default |
Can be set to a dashboard UID or path |
| autoRefreshInterval | Auto-refresh interval for dashboards in seconds | 0 |
Set to 0 to disable auto-refresh |
Example: Setting User Preferences via API
const preferences = {
theme: "light",
timezone: "America/New_York",
language: "en-US",
homeDashboard: "dashboard-uid-here",
autoRefreshInterval: 30
};
fetch("/api/user/preferences", {
method: "PUT",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer <your-api-token>"
},
body: JSON.stringify(preferences)
});
Note: User preferences are stored per-user and can be overridden by organization settings.
5. Disabling User Accounts
| Property | Description | Default |
|---|---|---|
| user.disabled | Flag to disable a user account | false |
Example: Disable User via API
curl -X PUT "http://localhost:3000/api/admin/users/<user-id>/disable" \
-H "Authorization: Bearer <api-token>"
Note: Disabling a user does not delete their account or data. They can be re-enabled later.
6. Deleting Users
Deleting users in Grafana is a critical administrative task that should be handled with care to avoid unintended access loss.
| Option | Values | Notes |
|---|---|---|
| User ID | 12345 |
Unique identifier for the user to be deleted |
| Deletion Method | API |
Can be done via Grafana API or UI |
| Permissions Required | Admin |
User must have admin privileges to delete other users |
Example: Delete User via API
curl -X DELETE "http://grafana.example.com/api/users/12345" \\\n -H "Authorization: Bearer <your_api_token>" \\\n -H "Content-Type: application/json"
Note: Deleting a user will remove all their permissions and access to dashboards, but it will not delete any data or configurations associated with them.
Warning: This action is irreversible. Ensure that the user has been properly migrated or their data has been backed up before deletion.
7. Viewing User Activity
| Activity | Description | Time | User |
|---|---|---|---|
| Login | Successful login to Grafana | 2026-01-15 09:00:00 | admin |
| Dashboard View | Viewed dashboard "Server Metrics" | 2026-01-15 09:05:00 | admin |
| Dashboard Edit | Edited dashboard "Server Metrics" | 2026-01-15 09:10:00 | admin |
| Query Execution | Executed query "CPU Usage" | 2026-01-15 09:15:00 | admin |
| Logout | User logged out | 2026-01-15 09:20:00 | admin |
Example: User Activity Query
SELECT
user_id,
activity_type,
description,
timestamp
FROM
user_activities
WHERE
timestamp >= '2026-01-15 00:00:00'
ORDER BY
timestamp ASC;
Note: Activity logs are stored for 30 days by default in Grafana.
Warning: Ensure audit logs are enabled for compliance purposes.
8. Managing User Sessions
| Property | Description | Default Value | Notes |
|---|---|---|---|
| session.timeout | Duration after which a session expires | 8h |
Configurable in grafana.ini |
| session.cookie.name | Name of the session cookie | grafana_session |
Used for tracking user sessions |
| session.cookie.secure | Whether to set the Secure flag on session cookies |
false |
Set to true in HTTPS environments |
| session.cookie.httpOnly | Whether to set the HttpOnly flag on session cookies |
true |
Prevents XSS attacks by blocking client-side JavaScript access |
Example: Configuring Session Timeout
[session]
timeout = 12h
cookie.name = grafana_session
cookie.secure = true
cookie.httpOnly = true
Note: Session timeout can be adjusted per user via the Grafana UI under
Configuration > Users.
Warning: Setting
cookie.secure to true requires a secure HTTPS connection to function properly.
Session Management Best Practices
- Set a reasonable session timeout to balance security and usability.
- Enable
SecureandHttpOnlyflags for session cookies in production environments. - Regularly review and audit user sessions to detect unauthorized access.
9. Setting User Quotas
| Property | Description | Default Value | Notes |
|---|---|---|---|
| quota.org | Maximum number of organizations a user can belong to | 10 | Applies to all users in the organization |
| quota.user | Maximum number of users that can be created in an organization | 100 | Applies to all users in the organization |
| quota.dashboard | Maximum number of dashboards a user can create | 50 | Applies to all users in the organization |
| quota.folder | Maximum number of folders a user can create | 20 | Applies to all users in the organization |
| quota.alert | Maximum number of alerts a user can create | 100 | Applies to all users in the organization |
| quota.datasource | Maximum number of data sources a user can create | 10 | Applies to all users in the organization |
| quota.apikey | Maximum number of API keys a user can create | 10 | Applies to all users in the organization |
| quota.team | Maximum number of teams a user can create | 5 | Applies to all users in the organization |
Example: Setting User Quotas in Grafana Configuration
[quota]
org = 10
user = 100
dashboard = 50
folder = 20
alert = 100
datasource = 10
apikey = 10
team = 5
Note: Quota settings can be overridden per organization via the Grafana UI or API.
Warning: Setting quotas too low may prevent users from creating necessary dashboards or alerts.
10. Using User API
| Endpoint | Method | Description | Notes |
|---|---|---|---|
| /api/users | GET | Get all users | Requires admin permission |
/api/users/<id> |
GET | Get user by ID | |
| /api/users | POST | Create a new user | |
/api/users/<id> |
PUT | Update user details | |
/api/users/<id> |
DELETE | Delete a user |
Example: Create a new user
{
"name": "John Doe",
"email": "john.doe@example.com",
"login": "johndoe",
"password": "securePassword123"
}
Note: The
password field is only required when creating a new user or changing the password.