The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 
grafana/pkg/api
github-actions[bot] b8bbe017d4 patch(security): restrict SSO token injection to allowlisted GCOM proxy paths 4 weeks ago
..
apierrors Folders: Add max depth check with descendant to /apis (#115305) 6 months ago
avatar Avatar: Require sign-in, remove queue, respect timeout (#116891) 4 months ago
datasource Datasource Permissions: Allow sending in query param `ds_type` and add database migration (#121501) 2 months ago
dtos Auth: Remove passwordless (magic link) authentication backend implementation (#118881) 2 months ago
frontendlogging
pluginproxy Data Source: Proxy fallback routes must match all inputs (#116274) 5 months ago
response
routing [chore] Update go to v1.26.0, and the golangci-lint action to v9 (#118436) 4 months ago
static
webassets React 19: Build assets with React 19 (#118457) 4 months ago
README.md
accesscontrol.go patch(security): Access Control: Fix Editor can remove any annotation 4 weeks ago
admin.go
admin_encryption.go
admin_provisioning.go
admin_provisioning_test.go
admin_test.go
admin_users.go
admin_users_test.go
alerting.go Alerting: Update alerting module to 77a1e2f35be87bebc41a0bf634f336282f0b9b53 (#115498) 6 months ago
annotations.go patch(security): Access Control: Fix Editor can remove any annotation 4 weeks ago
annotations_test.go RBAC: Remove annotationPermissionUpdate feature toggle (#117213) 4 months ago
api.go Auth: Remove passwordless (magic link) authentication backend implementation (#118881) 2 months ago
api_test.go
basic_auth.go
basic_auth_test.go
common_test.go
dashboard.go [release-13.0.1] Library panel connections: Always use unistore for connection info (#122061) 2 months ago
dashboard_permission.go Dashboards: Deprecate the dashboard and folder apis in swagger (#121222) 3 months ago
dashboard_permission_test.go
dashboard_snapshot.go patch(security): patch(security): fix broken access control in snapshot delete handler 4 weeks ago
dashboard_snapshot_test.go
dashboard_test.go Dashboards: Remove db store (#121815) 2 months ago
dataproxy.go Datasources: Disable deprecated numeric id using APIs by default (#119930) 3 months ago
datasources.go Datasources: Disable deprecated numeric id using APIs by default (#119930) 3 months ago
datasources_k8s.go Datasource Permissions: Allow sending in query param `ds_type` and add database migration (#121501) 2 months ago
datasources_k8s_test.go Datasource Permissions: Allow sending in query param `ds_type` and add database migration (#121501) 2 months ago
datasources_test.go add redirect for resource endpoints (#120269) 3 months ago
ds_query.go Query: Rename query.grafana.app to datasource.grafana.app (#118267) 4 months ago
ds_query_test.go datasources: refactor the request validator api (#116619) 5 months ago
fakes.go
folder.go Dashboards: Deprecate the dashboard and folder apis in swagger (#121222) 3 months ago
folder_bench_test.go Dashboards: Remove db store (#121815) 2 months ago
folder_permission.go Dashboards: Deprecate the dashboard and folder apis in swagger (#121222) 3 months ago
folder_permission_test.go Provisioning: Remove backend restrictions on permission API calls for provisioned folders (#118997) 3 months ago
folder_test.go Folders: Move to v1 (#119954) 3 months ago
frontend_logging.go
frontend_logging_test.go
frontend_metrics.go
frontendsettings.go Security: Fix CVE-2026-27876, CVE-2026-27877, CVE-2026-28375, CVE-2026-27879, CVE-2026-27880 (#121514) 2 months ago
frontendsettings_test.go Security: Fix CVE-2026-27876, CVE-2026-27877, CVE-2026-28375, CVE-2026-27879, CVE-2026-27880 (#121514) 2 months ago
grafana_com_proxy.go patch(security): restrict SSO token injection to allowlisted GCOM proxy paths 4 weeks ago
health.go
health_test.go
http_server.go add redirect for resource endpoints (#120269) 3 months ago
http_server_test.go Server: Support simultaneous TCP and Unix domain socket serving (#118627) 3 months ago
index.go CSP: Add configurable form-action directive via $FORM_ACTION_ADDITIONAL_HOSTS (#121473) 2 months ago
live_test.go Live: Add RBAC for pushing to live (#120547) 3 months ago
login.go Auth: Remove passwordless (magic link) authentication backend implementation (#118881) 2 months ago
login_oauth.go
login_oauth_test.go
login_test.go
org.go
org_invite.go
org_invite_test.go
org_test.go
org_users.go Fix: Move the hidden users exclusion to the DB layer (#115254) 6 months ago
org_users_test.go IAM: Add support for kubernetes APIs in user service (#120502) 3 months ago
password.go
playlist.go Playlist: Remove legacy playlist service (#117655) 3 months ago
plugin_checks.go
plugin_checks_test.go
plugin_dashboards.go
plugin_dashboards_test.go
plugin_metrics.go
plugin_metrics_test.go
plugin_proxy.go
plugin_proxy_test.go
plugin_resource.go patch(security): fix(plugins): limit input resource sizes 4 weeks ago
plugin_resource_test.go patch(security): fix(plugins): limit input resource sizes 4 weeks ago
plugins.go Plugins: Move loading strategy into pkg/plugins (#116207) 5 months ago
plugins_test.go revert 1.26 (#118568) 4 months ago
preferences.go Chore: Remove experimental feature individualCookiePreferences (#116374) 5 months ago
preferences_test.go
quota.go
quota_test.go
render.go Rendering: Remove support for unimplemented render session (#119962) 3 months ago
search.go [chore] Update go to v1.26.0, and the golangci-lint action to v9 (#118436) 4 months ago
short_url.go ShortURL: Validate target URL to always be relative (#120618) 3 months ago
short_url_test.go
signup.go
swagger.go CSP: Add configurable form-action directive via $FORM_ACTION_ADDITIONAL_HOSTS (#121473) 2 months ago
swagger_responses.go
swagger_tags.json
user.go
user_test.go IAM: Add support for kubernetes APIs in user service (#120502) 3 months ago
user_token.go Redirect logic update (#118663) 4 months ago
user_token_test.go
utils.go Redirect logic update (#118663) 4 months ago

README.md

OpenAPI specifications

Since version 8.4, HTTP API details are specified using OpenAPI v2. Starting from version 9.1, there is also an OpenAPI v3 specification (generated by the v2 one using this script).

OpenAPI annotations

The OpenAPI v2 specification is generated automatically from the annotated Go code using go-swagger which scans the source code for annotation rules. Refer to this getting started guide for getting familiar with the toolkit.

Developers modifying the HTTP API endpoints need to make sure to add the necessary annotations so that their changes are reflected into the generated specifications.

Example of endpoint annotation

The following route defines a PATCH endpoint under the /serviceaccounts/{serviceAccountId} path with tag service_accounts (used for grouping together several routes) and operation ID updateServiceAccount (used for uniquely identifying routes and associate parameters and response with them).

For enterprise endpoints make sure you add the enterprise tag as well.


// swagger:route PATCH /serviceaccounts/{serviceAccountId} service_accounts updateServiceAccount
//
// # Update service account
//
// Required permissions (See note in the [introduction](https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/#service-account-api) for an explanation):
// action: `serviceaccounts:write` scope: `serviceaccounts:id:1` (single service account)
//
// Responses:
// 200: updateServiceAccountResponse
// 400: badRequestError
// 401: unauthorisedError
// 403: forbiddenError
// 404: notFoundError
// 500: internalServerError

The go-swagger can discover such annotations by scanning any code imported by pkg/server but by convention we place the endpoint annotations above the endpoint definition.

Example of endpoint parameters

The following struct defines the route parameters for the updateServiceAccount endpoint. The route expects:

  • a path parameter denoting the service account identifier and
  • a body parameter with the new values for the specific service account

// swagger:parameters updateServiceAccount
type UpdateServiceAccountParams struct {
	// in:path
	ServiceAccountId int64 `json:"serviceAccountId"`
	// in:body
	Body serviceaccounts.UpdateServiceAccountForm
}

Example of endpoint response

The following struct defines the response for the updateServiceAccount endpoint in case of a successful 200 response.


// swagger:response updateServiceAccountResponse
type UpdateServiceAccountResponse struct {
	// in:body
	Body struct {
		Message        string                                    `json:"message"`
		ID             int64                                     `json:"id"`
		Name           string                                    `json:"name"`
		ServiceAccount *serviceaccounts.ServiceAccountProfileDTO `json:"serviceaccount"`
	}
}

OpenAPI generation

Developers can re-create the OpenAPI v2 and v3 specifications using the following command:

make swagger-clean && make openapi3-gen

They can observe its output into the public/api-merged.json and public/openapi3.json files.

Finally, they can browser and try out both the OpenAPI v2 and v3 via the Swagger UI editor (served by the grafana server) by navigating to /swagger.

If there are any issues generating the specifications (e.g., diff containing unrelated changes to your PR or unusually large diff), please run the following command to ensure your Swagger version is up to date, then re-run the make commands.

  • go tool github.com/go-swagger/go-swagger/cmd/swagger@v0.30.6