User API

If you are running Grafana Enterprise and have Fine-grained access control enabled, for some endpoints you would need to have relevant permissions. Refer to specific resources to understand what permissions are required.

Search Users

GET /api/users?perpage=10&page=1

Required permissions

See note in the introduction for an explanation.

ActionScope
users:readglobal:users:*

Example Request:

  1. GET /api/users HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Default value for the perpage parameter is 1000 and for the page parameter is 1. Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. [
  5.   {
  6.     "id": 1,
  7.     "name": "Admin",
  8.     "login": "admin",
  9.     "email": "admin@mygraf.com",
  10.     "isAdmin": true,
  11.     "isDisabled": false,
  12.     "lastSeenAt": "2020-04-10T20:29:27+03:00",
  13.     "lastSeenAtAge': "2m",
  14.     "authLabels": ["OAuth"]
  15.   },
  16.   {
  17.     "id": 2,
  18.     "name": "User",
  19.     "login": "user",
  20.     "email": "user@mygraf.com",
  21.     "isAdmin": false,
  22.     "isDisabled": false,
  23.     "lastSeenAt": "2020-01-24T12:38:47+02:00",
  24.     "lastSeenAtAge": "2M",
  25.     "authLabels": []
  26.   }
  27. ]

Search Users with Paging

GET /api/users/search?perpage=10&page=1&query=mygraf

Required permissions

See note in the introduction for an explanation.

ActionScope
users:readglobal:users:*

Example Request:

  1. GET /api/users/search?perpage=10&page=1&query=mygraf HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Default value for the perpage parameter is 1000 and for the page parameter is 1. The totalCount field in the response can be used for pagination of the user list E.g. if totalCount is equal to 100 users and the perpage parameter is set to 10 then there are 10 pages of users. The query parameter is optional and it will return results where the query value is contained in one of the name, login or email fields. Query values with spaces need to be URL encoded e.g. query=Jane%20Doe.

Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  3. {
  4.   "totalCount": 2,
  5.   "users": [
  6.     {
  7.       "id": 1,
  8.       "name": "Admin",
  9.       "login": "admin",
  10.       "email": "admin@mygraf.com",
  11.       "isAdmin": true,
  12.       "isDisabled": false,
  13.       "lastSeenAt": "2020-04-10T20:29:27+03:00",
  14.       "lastSeenAtAge': "2m",
  15.       "authLabels": ["OAuth"]
  16.     },
  17.     {
  18.       "id": 2,
  19.       "name": "User",
  20.       "login": "user",
  21.       "email": "user@mygraf.com",
  22.       "isAdmin": false,
  23.       "isDisabled": false,
  24.       "lastSeenAt": "2020-01-24T12:38:47+02:00",
  25.       "lastSeenAtAge": "2M",
  26.       "authLabels": []
  27.     }
  28.   ],
  29.   "page": 1,
  30.   "perPage": 10
  31. }

Get single user by Id

GET /api/users/:id

Required permissions

See note in the introduction for an explanation.

ActionScope
users:readusers:*

Example Request:

  1. GET /api/users/1 HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {
  5.   "id": "1",
  6.   "email": "user@mygraf.com",
  7.   "name": "admin",
  8.   "login": "admin",
  9.   "theme": "light",
  10.   "orgId": 1,
  11.   "isGrafanaAdmin": true,
  12.   "isDisabled": true,
  13.   "isExternal": false,
  14.   "authLabels": [],
  15.   "updatedAt": "2019-09-09T11:31:26+01:00",
  16.   "createdAt": "2019-09-09T11:31:26+01:00",
  17.   "avatarUrl": ""
  18. }

Get single user by Username(login) or Email

GET /api/users/lookup?loginOrEmail=user@mygraf.com

Required permissions

See note in the introduction for an explanation.

ActionScope
users:readglobal:users:*

Example Request using the email as option:

  1. GET /api/users/lookup?loginOrEmail=user@mygraf.com HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk

Example Request using the username as option:

  1. GET /api/users/lookup?loginOrEmail=admin HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {
  5.   "id": 1,
  6.   "email": "user@mygraf.com",
  7.   "name": "admin",
  8.   "login": "admin",
  9.   "theme": "light",
  10.   "orgId": 1,
  11.   "isGrafanaAdmin": true,
  12.   "isDisabled": false,
  13.   "isExternal": false,
  14.   "authLabels": null,
  15.   "updatedAt": "2019-09-25T14:44:37+01:00",
  16.   "createdAt": "2019-09-25T14:44:37+01:00",
  17.   "avatarUrl":""
  18. }

User Update

PUT /api/users/:id

Required permissions

See note in the introduction for an explanation.

ActionScope
users:writeusers:*

Example Request:

  1. PUT /api/users/2 HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=
  6. {
  7.   "email":"user@mygraf.com",
  8.   "name":"User2",
  9.   "login":"user",
  10.   "theme":"light"
  11. }

Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {"message":"User updated"}

Get Organizations for user

GET /api/users/:id/orgs

Required permissions

See note in the introduction for an explanation.

ActionScope
users:readusers:*

Example Request:

  1. GET /api/users/1/orgs HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. [
  5.   {
  6.     "orgId":1,
  7.     "name":"Main Org.",
  8.     "role":"Admin"
  9.   }
  10. ]

Get Teams for user

GET /api/users/:id/teams

Required permissions

See note in the introduction for an explanation.

ActionScope
users.teams:readusers:*

Example Request:

  1. GET /api/users/1/teams HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. [
  5.   {
  6.     "id":1,
  7.     "orgId":1,
  8.     "name":"team1",
  9.     "email":"",
  10.     "avatarUrl":"/avatar/3fcfe295eae3bcb67a49349377428a66",
  11.     "memberCount":1
  12.   }
  13. ]

User

Actual User

GET /api/user

Example Request:

  1. GET /api/user HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Requires basic authentication.

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {
  5.   "id":1,
  6.   "email":"admin@mygraf.com",
  7.   "name":"Admin",
  8.   "login":"admin",
  9.   "theme":"light",
  10.   "orgId":1,
  11.   "isGrafanaAdmin":true,
  12.   "isDisabled":false
  13.   "isExternal": false,
  14.   "authLabels": [],
  15.   "updatedAt": "2019-09-09T11:31:26+01:00",
  16.   "createdAt": "2019-09-09T11:31:26+01:00",
  17.   "avatarUrl": ""
  18. }

Change Password

PUT /api/user/password

Changes the password for the user. Requires basic authentication.

Example Request:

  1. PUT /api/user/password HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=
  6. {
  7.   "oldPassword": "old_password",
  8.   "newPassword": "new_password"
  9. }

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {"message":"User password changed"}

Change Password with a Script

If you need to change a password with a script, here is an example of changing the Admin password using curl with basic auth:

  1. curl -X PUT -H "Content-Type: application/json" -d '{
  2.   "oldPassword": "oldpass",
  3.   "newPassword": "newpass",
  4.   "confirmNew": "newpass"
  5. }' http://admin:oldpass@<your_grafana_host>:3000/api/user/password

Switch user context for a specified user

POST /api/users/:userId/using/:organizationId

Switch user context to the given organization. Requires basic authentication and that the authenticated user is a Grafana Admin.

Example Request:

  1. POST /api/users/7/using/2 HTTP/1.1
  2. Authorization: Basic YWRtaW46YWRtaW4=

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {"message":"Active organization changed"}

Switch user context for signed in user

POST /api/user/using/:organizationId

Switch user context to the given organization.

Example Request:

  1. POST /api/user/using/2 HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {"message":"Active organization changed"}

Organizations of the actual User

GET /api/user/orgs

Return a list of all organizations of the current user. Requires basic authentication.

Example Request:

  1. GET /api/user/orgs HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Basic YWRtaW46YWRtaW4=

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. [
  5.   {
  6.     "orgId":1,
  7.     "name":"Main Org.",
  8.     "role":"Admin"
  9.   }
  10. ]

Teams that the actual User is member of

GET /api/user/teams

Return a list of all teams that the current user is member of.

Example Request:

  1. GET /api/user/teams HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. [
  5.   {
  6.     "id": 1,
  7.     "orgId": 1,
  8.     "name": "MyTestTeam",
  9.     "email": "",
  10.     "avatarUrl": "\/avatar\/3f49c15916554246daa714b9bd0ee398",
  11.     "memberCount": 1
  12.   }
  13. ]

Star a dashboard

POST /api/user/stars/dashboard/:dashboardId

Stars the given Dashboard for the actual user.

Example Request:

  1. POST /api/user/stars/dashboard/1 HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {"message":"Dashboard starred!"}

Unstar a dashboard

DELETE /api/user/stars/dashboard/:dashboardId

Deletes the starring of the given Dashboard for the actual user.

Example Request:

  1. DELETE /api/user/stars/dashboard/1 HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {"message":"Dashboard unstarred"}

Auth tokens of the actual User

GET /api/user/auth-tokens

Return a list of all auth tokens (devices) that the actual user currently have logged in from.

Example Request:

  1. GET /api/user/auth-tokens HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. [
  5.   {
  6.     "id": 361,
  7.     "isActive": true,
  8.     "clientIp": "127.0.0.1",
  9.     "browser": "Chrome",
  10.     "browserVersion": "72.0",
  11.     "os": "Linux",
  12.     "osVersion": "",
  13.     "device": "Other",
  14.     "createdAt": "2019-03-05T21:22:54+01:00",
  15.     "seenAt": "2019-03-06T19:41:06+01:00"
  16.   },
  17.   {
  18.     "id": 364,
  19.     "isActive": false,
  20.     "clientIp": "127.0.0.1",
  21.     "browser": "Mobile Safari",
  22.     "browserVersion": "11.0",
  23.     "os": "iOS",
  24.     "osVersion": "11.0",
  25.     "device": "iPhone",
  26.     "createdAt": "2019-03-06T19:41:19+01:00",
  27.     "seenAt": "2019-03-06T19:41:21+01:00"
  28.   }
  29. ]

Revoke an auth token of the actual User

POST /api/user/revoke-auth-token

Revokes the given auth token (device) for the actual user. User of issued auth token (device) will no longer be logged in and will be required to authenticate again upon next activity.

Example Request:

  1. POST /api/user/revoke-auth-token HTTP/1.1
  2. Accept: application/json
  3. Content-Type: application/json
  4. Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk
  6. {
  7.   "authTokenId": 364
  8. }

Example Response:

  1. HTTP/1.1 200
  2. Content-Type: application/json
  4. {
  5.   "message": "User auth token revoked"
  6. }