mirror of
https://github.com/grafana/grafana.git
synced 2025-08-02 00:01:48 +08:00
a20b3e2d59
* fleshing out About topic * docs, fgac refactor initial draft * updated FGAC with service account details * finalized restructure * make prettier, corrects spelling * fixes typo * adds rollout strategy topic * started name change * renamed to rbac throughout docs * copy edit to about and actions and scopes docs * finishes content reorg * draft of refactored refactored docs * corrects relrefs * formatting tweaks * fixes typo * copy updates to about rbac * rbac rollout docs edits * update rbac role assignment docs * content update to manage rbac roles doc * sort and reorder roles reference in rbac docs * alphabetize permissions table * Update docs/sources/enterprise/settings-updates.md Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com> * incorporates feedback, makes prettier * update http api references in rbac docs * fix broken refs and improve wording on enabling RBAC provisioning Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Mitchel Seaman <mitchel.seaman@gmail.com> Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com>
299 lines
8.1 KiB
Markdown
299 lines
8.1 KiB
Markdown
+++
|
|
title = "Datasource Permissions HTTP API "
|
|
description = "Data Source Permissions API"
|
|
keywords = ["grafana", "http", "documentation", "api", "datasource", "permission", "permissions", "acl", "enterprise"]
|
|
aliases = ["/docs/grafana/latest/http_api/datasourcepermissions/"]
|
|
+++
|
|
|
|
# Data Source Permissions API
|
|
|
|
> The Data Source Permissions is only available in Grafana Enterprise. Read more about [Grafana Enterprise]({{< relref "../enterprise" >}}).
|
|
|
|
> If you are running Grafana Enterprise and have [Role-based access control]({{< relref "../enterprise/access-control/_index.md" >}}) enabled, for some endpoints you would need to have relevant permissions.
|
|
> Refer to specific resources to understand what permissions are required.
|
|
|
|
This API can be used to enable, disable, list, add and remove permissions for a data source.
|
|
|
|
Permissions can be set for a user or a team. Permissions cannot be set for Admins - they always have access to everything.
|
|
|
|
The permission levels for the permission field:
|
|
|
|
- 1 = Query
|
|
|
|
## Enable permissions for a data source
|
|
|
|
`POST /api/datasources/:id/enable-permissions`
|
|
|
|
Enables permissions for the data source with the given `id`. No one except Org Admins will be able to query the data source until permissions have been added which permit certain users or teams to query the data source.
|
|
|
|
### Required permissions
|
|
|
|
See note in the [introduction]({{< ref "#data-source-permissions-api" >}}) for an explanation.
|
|
|
|
| Action | Scope |
|
|
| ----------------------------- | ---------------------------------------------------------------------------- |
|
|
| datasources.permissions:write | datasources:\*<br>datasources:id:\*<br>datasources:id:1 (single data source) |
|
|
|
|
### Examples
|
|
|
|
**Example request:**
|
|
|
|
```http
|
|
POST /api/datasources/1/enable-permissions
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
|
|
|
|
{}
|
|
```
|
|
|
|
**Example response:**
|
|
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=UTF-8
|
|
Content-Length: 35
|
|
|
|
```
|
|
|
|
Status codes:
|
|
|
|
- **200** - Ok
|
|
- **400** - Permissions cannot be enabled, see response body for details
|
|
- **401** - Unauthorized
|
|
- **403** - Access denied
|
|
- **404** - Datasource not found
|
|
|
|
## Disable permissions for a data source
|
|
|
|
`POST /api/datasources/:id/disable-permissions`
|
|
|
|
Disables permissions for the data source with the given `id`. All existing permissions will be removed and anyone will be able to query the data source.
|
|
|
|
### Required permissions
|
|
|
|
See note in the [introduction]({{< ref "#data-source-permissions-api" >}}) for an explanation.
|
|
|
|
| Action | Scope |
|
|
| ----------------------------- | ---------------------------------------------------------------------------- |
|
|
| datasources.permissions:write | datasources:\*<br>datasources:id:\*<br>datasources:id:1 (single data source) |
|
|
|
|
### Examples
|
|
|
|
**Example request:**
|
|
|
|
```http
|
|
POST /api/datasources/1/disable-permissions
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
|
|
|
|
{}
|
|
```
|
|
|
|
**Example response:**
|
|
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=UTF-8
|
|
Content-Length: 35
|
|
|
|
```
|
|
|
|
Status codes:
|
|
|
|
- **200** - Ok
|
|
- **400** - Permissions cannot be disabled, see response body for details
|
|
- **401** - Unauthorized
|
|
- **403** - Access denied
|
|
- **404** - Datasource not found
|
|
|
|
## Get permissions for a data source
|
|
|
|
`GET /api/datasources/:id/permissions`
|
|
|
|
Gets all existing permissions for the data source with the given `id`.
|
|
|
|
### Required permissions
|
|
|
|
See note in the [introduction]({{< ref "#data-source-permissions-api" >}}) for an explanation.
|
|
|
|
| Action | Scope |
|
|
| ---------------------------- | ---------------------------------------------------------------------------- |
|
|
| datasources.permissions:read | datasources:\*<br>datasources:id:\*<br>datasources:id:1 (single data source) |
|
|
|
|
### Examples
|
|
|
|
**Example request:**
|
|
|
|
```http
|
|
GET /api/datasources/1/permissions HTTP/1.1
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
|
|
```
|
|
|
|
**Example response:**
|
|
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=UTF-8
|
|
Content-Length: 551
|
|
|
|
```
|
|
|
|
Status codes:
|
|
|
|
- **200** - Ok
|
|
- **401** - Unauthorized
|
|
- **403** - Access denied
|
|
- **404** - Datasource not found
|
|
|
|
## Add permission for a data source
|
|
|
|
`POST /api/datasources/:id/permissions`
|
|
|
|
Adds a user permission for the data source with the given `id`.
|
|
|
|
### Required permissions
|
|
|
|
See note in the [introduction]({{< ref "#data-source-permissions-api" >}}) for an explanation.
|
|
|
|
| Action | Scope |
|
|
| ----------------------------- | ---------------------------------------------------------------------------- |
|
|
| datasources.permissions:write | datasources:\*<br>datasources:id:\*<br>datasources:id:1 (single data source) |
|
|
|
|
### Examples
|
|
|
|
**Example request:**
|
|
|
|
```http
|
|
POST /api/datasources/1/permissions
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
|
|
|
|
{
|
|
"userId": 1,
|
|
"permission": 1
|
|
}
|
|
```
|
|
|
|
**Example response:**
|
|
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=UTF-8
|
|
Content-Length: 35
|
|
|
|
```
|
|
|
|
Adds a team permission for the data source with the given `id`.
|
|
|
|
**Example request:**
|
|
|
|
```http
|
|
POST /api/datasources/1/permissions
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
|
|
|
|
{
|
|
"teamId": 1,
|
|
"permission": 1
|
|
}
|
|
```
|
|
|
|
**Example response:**
|
|
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=UTF-8
|
|
Content-Length: 35
|
|
|
|
```
|
|
|
|
Status codes:
|
|
|
|
- **200** - Ok
|
|
- **400** - Permission cannot be added, see response body for details
|
|
- **401** - Unauthorized
|
|
- **403** - Access denied
|
|
- **404** - Datasource not found
|
|
|
|
## Remove permission for a data source
|
|
|
|
`DELETE /api/datasources/:id/permissions/:permissionId`
|
|
|
|
Removes the permission with the given `permissionId` for the data source with the given `id`.
|
|
|
|
### Required permissions
|
|
|
|
See note in the [introduction]({{< ref "#data-source-permissions-api" >}}) for an explanation.
|
|
|
|
| Action | Scope |
|
|
| ----------------------------- | ---------------------------------------------------------------------------- |
|
|
| datasources.permissions:write | datasources:\*<br>datasources:id:\*<br>datasources:id:1 (single data source) |
|
|
|
|
### Examples
|
|
|
|
**Example request:**
|
|
|
|
```http
|
|
DELETE /api/datasources/1/permissions/2
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
|
|
```
|
|
|
|
**Example response:**
|
|
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=UTF-8
|
|
Content-Length: 35
|
|
|
|
```
|
|
|
|
Status codes:
|
|
|
|
- **200** - Ok
|
|
- **401** - Unauthorized
|
|
- **403** - Access denied
|
|
- **404** - Datasource not found or permission not found
|