Tutorial: Call Grafana APIs programmatically

In this tutorial, you learn how to:

• Assign an Azure Managed Grafana role to the service principal of your application
• Retrieve application details
• Get an access token
• Call Grafana APIs

Prerequisites

• An Azure account with an active subscription. Create an account for free.
• An Azure Managed Grafana workspace. Create an Azure Managed Grafana instance.
• A Microsoft Entra application with a service principal. Create a Microsoft Entra application and service principal. For simplicity, use an application located in the same Microsoft Entra tenant as your Azure Managed Grafana instance.

Sign in to Azure

Sign in to the Azure portal at https://portal.azure.com/ with your Azure account.

Assign an Azure Managed Grafana role to the service principal of your application

1. In the Azure portal, open your Managed Grafana instance.

2. Select Access control (IAM) in the navigation menu.

3. Select Add, then Add role assignment.

4. Select the Grafana Editor role and then Next.

5. Under Assign access to, select User,group, or service principal.

6. Select Select members, select your service principal, and hit Select.

7. Select Review + assign.

   

Retrieve application details

You now need to gather some information, which you'll use to get a Grafana API access token, and call Grafana APIs.

1. Find your tenant ID:

   1. In the Azure portal, enter Microsoft Entra ID in the Search resources, services, and docs (G+ /).
   2. Select Microsoft Entra ID.
   3. Select Properties from the left menu.
   4. Locate the field Tenant ID and save its value.

   

2. Find your client ID:

   1. In the Azure portal, in Microsoft Entra ID, select App registrations from the left menu.
   2. Select your app.
   3. In Overview, find the Application (client) ID field and save its value.

   

3. Create an application secret:

   1. In the Azure portal, in Microsoft Entra ID, select App registrations from the left menu.
   2. Select your app.
   3. Select Certificates & secrets from the left menu.
   4. Select New client secret.
   5. Create a new client secret and save its value.

   

   Note

   You can only access a secret's value immediately after creating it. Copy the value before leaving the page to use it in the next step of this tutorial.

4. Find the Grafana endpoint URL:

   1. In the Azure portal, enter Azure Managed Grafana in the Search resources, services, and docs (G+ /) bar.
   2. Select Azure Managed Grafana and open your Managed Grafana workspace.
   3. Select Overview from the left menu and save the Endpoint value.

   

Get an access token

To access Grafana APIs, you need to get an access token. You can get the access token using the Azure CLI or making a POST request.

Azure CLI

Sign in to the Azure CLI by running the az login command and replace <client-id>, <client-secret>, and <tenant-id> with the application (client) ID, client secret, and tenant ID collected in the previous step:

az login --service-principal --username "<client-id>" --password "<client-secret>" --tenant "<tenant-id>"

Use the command az grafana api-key create to create a key. Here's an example output:

az grafana api-key create --key keyname --name <name> --resource-group <rg> --role editor --output json

{
  "id": 3,
  "key": "<redacted>",
  "name": "keyname"
}

Note

You can only view this key here once. Save it in a secure place.

POST request

Follow the example below to call Microsoft Entra ID and retrieve a token. Replace <tenant-id>, <client-id>, and <client-secret> with the tenant ID, application (client) ID, and client secret collected in the previous step.

curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=client_credentials&client_id=<client-id>&client_secret=<client-secret>&resource=ce34e7e5-485f-4d76-964f-b3d2b16d1e4f' \
https://login.microsoftonline.com/<tenant-id>/oauth2/token

Here's an example of response:

{
  "token_type": "Bearer",
  "expires_in": "599",
  "ext_expires_in": "599",
  "expires_on": "1575500555",
  "not_before": "1575499766",
  "resource": "ce34...1e4f",
  "access_token": "eyJ0eXAiOiJ......AARUQ"
}

Call Grafana APIs

You can now call Grafana APIs using the access token retrieved in the previous step as the Authorization header. For example:

curl -X GET \
-H 'Authorization: Bearer <access-token>' \
https://<grafana-url>/api/user

Replace <access-token> and <grafana-url> with the access token retrieved in the previous step and the endpoint URL of your Grafana instance. For example https://my-grafana-abcd.cuse.grafana.azure.com.

Clean up resources

If you're not going to continue to use these resources, delete them with the following steps:

1. Delete Azure Managed Grafana:

   1. In the Azure portal, in Azure Managed Grafana, select Overview from the left menu.
   2. Select Delete.
   3. Enter the resource name to confirm deletion and select Delete.

2. Delete the Microsoft Entra application:

   1. In the Azure portal, in Microsoft Entra ID, select App registrations from the left menu.
   2. Select your app.
   3. In the Overview tab, select Delete.
   4. Select Delete.

Next steps

How to configure data sources