RBAC permissions, actions, and scopes

Note: Available in Grafana Enterprise and Grafana Cloud Advanced.

A permission is comprised of an action and a scope. When creating a custom role, consider the actions the user can perform and the resource(s) on which they can perform those actions.

To learn more about the Grafana resources to which you can apply RBAC, refer to Resources with RBAC permissions.

  • Action: An action describes what tasks a user can perform on a resource.
  • Scope: A scope describes where an action can be performed, such as reading a specific user profile. In this example, a permission is associated with the scope users:<userId> to the relevant role.

Action definitions

The following list contains role-based access control actions.

ActionApplicable scopeDescription
alert.instances.external:readdatasources:
datasources:uid:
Read alerts and silences in data sources that support alerting.
alert.instances.external:writedatasources:
datasources:uid:
Manage alerts and silences in data sources that support alerting.
alert.instances:createn/aCreate silences in the current organization.
alert.instances:readn/aRead alerts and silences in the current organization.
alert.instances:writen/aUpdate and expire silences in the current organization.
alert.notifications.external:readdatasources:
datasources:uid:
Read templates, contact points, notification policies, and mute timings in data sources that support alerting.
alert.notifications.external:writedatasources:
datasources:uid:
Manage templates, contact points, notification policies, and mute timings in data sources that support alerting.
alert.notifications:writen/aManage templates, contact points, notification policies, and mute timings in the current organization.
alert.notifications:readn/aRead all templates, contact points, notification policies, and mute timings in the current organization.
alert.rules.external:readdatasources:
datasources:uid:
Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki)
alert.rules.external:writedatasources:
datasources:uid:
Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki).
alert.rules:createfolders:
folders:uid:
Create Grafana alert rules in a folder. Combine this permission with folders:read in a scope that includes the folder and datasources:query in the scope of data sources the user can query.
alert.rules:deletefolders:
folders:uid:
Delete Grafana alert rules in a folder. Combine this permission with folders:read in a scope that includes the folder and datasources:query in the scope of data sources the user can query.
alert.rules:readfolders:
folders:uid:
Read Grafana alert rules in a folder. Combine this permission with folders:read in a scope that includes the folder and datasources:query in the scope of data sources the user can query.
alert.rules:writefolders:
folders:uid:
Update Grafana alert rules in a folder. Combine this permission with folders:read in a scope that includes the folder and datasources:query in the scope of data sources the user can query.
alert.provisioning:readn/aRead all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.
alert.provisioning:writen/aUpdate all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.
annotations:createannotations:
annotations:type:
Create annotations.
annotations:deleteannotations:
annotations:type:
Delete annotations.
annotations:readannotations:
annotations:type:
Read annotations and annotation tags.
annotations:writeannotations:
annotations:type:
Update annotations.
apikeys:createn/aCreate API keys.
apikeys:readapikeys:
apikeys:id:
Read API keys.
apikeys:deleteapikeys:
apikeys:id:
Delete API keys.
dashboards:createfolders:
folders:uid:
Create dashboards in one or more folders.
dashboards:deletedashboards:
dashboards:uid:

folders:
folders:uid:
Delete one or more dashboards.
dashboards.insights:readn/aRead dashboard insights data and see presence indicators.
dashboards.permissions:readdashboards:
dashboards:uid:

folders:
folders:uid:
Read permissions for one or more dashboards.
dashboards.permissions:writedashboards:
dashboards:uid:

folders:
folders:uid:
Update permissions for one or more dashboards.
dashboards:readdashboards:
dashboards:uid:

folders:
folders:uid:
Read one or more dashboards.
dashboards:writedashboards:
dashboards:uid:

folders:
folders:uid:
Update one or more dashboards.
datasources.caching:readdatasources:
datasources:uid:
Read data source query caching settings.
datasources.caching:writedatasources:
datasources:uid:
Update data source query caching settings.
datasources:createn/aCreate data sources.
datasources:deletedatasources:
datasources:uid:
Delete data sources.
datasources:exploren/aEnable access to the Explore tab.
datasources.id:readdatasources:
datasources:uid:
Read data source IDs.
datasources.insights:readn/aRead data sources insights data.
datasources.permissions:readdatasources:
datasources:uid:
List data source permissions.
datasources.permissions:writedatasources:
datasources:uid:
Update data source permissions.
datasources:querydatasources:
datasources:uid:
Query data sources.
datasources:readdatasources:
datasources:uid:
List data sources.
datasources:writedatasources:
datasources:uid:
Update data sources.
folders.permissions:readfolders:
folders:uid:
Read permissions for one or more folders.
folders.permissions:writefolders:
folders:uid:
Update permissions for one or more folders.
folders:createn/aCreate folders.
folders:deletefolders:
folders:uid:
Delete one or more folders.
folders:readfolders:
folders:uid:
Read one or more folders.
folders:writefolders:
folders:uid:
Update one or more folders.
ldap.config:reloadn/aReload the LDAP configuration.
ldap.status:readn/aVerify the availability of the LDAP server or servers.
ldap.user:readn/aRead users via LDAP.
ldap.user:syncn/aSync users via LDAP.
licensing.reports:readn/aGet custom permission reports.
licensing:deleten/aDelete the license token.
licensing:readn/aRead licensing information.
licensing:writen/aUpdate the license token.
org.users:writeusers:
users:id:
Update the organization role (Viewer, Editor, or Admin) of a user.
org.users:addusers:Add a user to an organization or invite a new user to an organization.
org.users:readusers:
users:id:
Get user profiles within an organization.
org.users:removeusers:
users:id:
Remove a user from an organization.
org:createn/aCreate an organization.
orgs.preferences:readorgs:
orgs:id:
Read organization preferences.
orgs.preferences:writeorgs:
orgs:id:
Update organization preferences.
orgs.quotas:readorgs:
orgs:id:
Read organization quotas.
orgs.quotas:writeorgs:
orgs:id:
Update organization quotas.
orgs:deleteorgs:
orgs:id:
Delete one or more organizations.
orgs:readorgs:
orgs:id:
Read one or more organizations.
orgs:writeorgs:
orgs:id:
Update one or more organizations.
plugins.app:accessplugins:
plugins:id:
Access one or more application plugins (still enforcing the organization role)
provisioning:reloadprovisioners:Reload provisioning files. To find the exact scope for specific provisioner, see Scope definitions.
reports:createn/aCreate reports.
reports:writereports:
reports:id:
Update reports.
reports.settings:readn/aRead report settings.
reports.settings:writen/aUpdate report settings.
reports:deletereports:
reports:id:
Delete reports.
reports:readreports:List all available reports or get a specific report.
reports:sendreports:Send a report email.
roles:deletepermissions:type:delegateDelete a custom role.
roles:readroles:
roles:uid:
List roles and read a specific with its permissions.
roles:writepermissions:type:delegateCreate or update a custom role.
roles:writepermissions:type:escalateReset basic roles to their default permissions.
server.stats:readn/aRead Grafana instance statistics.
serviceaccounts:writeserviceaccounts:Create Grafana service accounts.
serviceaccounts:createn/aUpdate Grafana service accounts.
serviceaccounts:deleteserviceaccounts:Delete Grafana service accounts.
serviceaccounts:readserviceaccounts:Read Grafana service accounts.
serviceaccounts.permissions:writeserviceaccounts:Update Grafana service account permissions to control who can do what with the service account.
serviceaccounts.permissions:readserviceaccounts:Read Grafana service account permissions to see who can do what with the service account.
settings:readsettings:
settings:auth.saml:
settings:auth.saml:enabled (property level)
Read the Grafana configuration settings
settings:writesettings:
settings:auth.saml:
settings:auth.saml:enabled (property level)
Update any Grafana configuration settings that can be updated at runtime.
status:accesscontrolservices:accesscontrolGet access-control enabled status.
teams.permissions:readteams:
teams:id:
Read members and External Group Synchronization setup for teams.
teams.permissions:writeteams:
teams:id:
Add, remove and update members and manage External Group Synchronization setup for teams.
teams.roles:addpermissions:type:delegateAssign a role to a team.
teams.roles:readteams:List roles assigned directly to a team.
teams.roles:removepermissions:type:delegateUnassign a role from a team.
teams:createn/aCreate teams.
teams:deleteteams:
teams:id:
Delete one or more teams.
teams:readteams:
teams:id:
Read one or more teams and team preferences.
teams:writeteams:
teams:id:
Update one or more teams and team preferences.
users.authtoken:readglobal.users:
global.users:id:
List authentication tokens that are assigned to a user.
users.authtoken:writeglobal.users:
global.users:id:
Update authentication tokens that are assigned to a user.
users.password:writeglobal.users:
global.users:id:
Update a user’s password.
users.permissions:readusers:List permissions of a user.
users.permissions:writeglobal.users:
global.users:id:
Update a user’s organization-level permissions.
users.quotas:readglobal.users:
global.users:id:
List a user’s quotas.
users.quotas:writeglobal.users:
global.users:id:
Update a user’s quotas.
users.roles:addpermissions:type:delegateAssign a role to a user or a service account.
users.roles:readusers:List roles assigned directly to a user or a service account.
users.roles:removepermissions:type:delegateUnassign a role from a user or a service account.
users:createn/aCreate a user.
users:deleteglobal.users:
global.users:id:
Delete a user.
users:disableglobal.users:
global.users:id:
Disable a user.
users:enablegloba.users:
global.users:id:
Enable a user.
users:logoutglobal.users:
global.users:id:
Sign out a user.
users:readglobal.users:Read or search user profiles.
users:writeglobal.users:
global.users:id:*
Update a user’s profile.

Scope definitions

The following list contains role-based access control scopes.

ScopesDescriptions
annotations:
annotations:type:
Restrict an action to a set of annotations. For example, annotations: matches any annotation, annotations:type:dashboard matches annotations associated with dashboards and annotations:type:organization matches organization annotations.
apikeys:
apikeys:id:
Restrict an action to a set of API keys. For example, apikeys: matches any API key, apikey:id:1 matches the API key whose id is 1.
dashboards:
dashboards:uid:
Restrict an action to a set of dashboards. For example, dashboards: matches any dashboard, and dashboards:uid:1 matches the dashboard whose UID is 1.
datasources:
datasources:uid:
Restrict an action to a set of data sources. For example, datasources: matches any data source, and datasources:uid:1 matches the data source whose UID is 1.
folders:
folders:uid:
Restrict an action to a set of folders. For example, folders: matches any folder, and folders:uid:1 matches the folder whose UID is 1.
global.users:
global.users:id:
Restrict an action to a set of global users. For example, global.users: matches any user and global.users:id:1 matches the user whose ID is 1.
orgs:
orgs:id:
Restrict an action to a set of organizations. For example, orgs: matches any organization and orgs:id:1 matches the organization whose ID is 1.
permissions:type:delegateThe scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
permissions:type:escalateThe scope is required to trigger the reset of basic roles permissions. It indicates that users might acquire additional permissions they did not previously have.
provisioners:Restrict an action to a set of provisioners. For example, provisioners: matches any provisioner, and provisioners:accesscontrol matches the role-based access control provisioner.
reports:
reports:id:
Restrict an action to a set of reports. For example, reports: matches any report and reports:id:1 matches the report whose ID is 1.
roles:
roles:uid:
Restrict an action to a set of roles. For example, roles: matches any role and roles:uid:randomuid matches only the role whose UID is randomuid.
services:accesscontrolRestrict an action to target only the role-based access control service. You can use this in conjunction with the status:accesscontrol actions.
serviceaccounts:
serviceaccounts:id:
Restrict an action to a set of service account from an organization. For example, serviceaccounts: matches any service account and serviceaccount:id:1 matches the service account whose ID is 1.
settings:Restrict an action to a subset of settings. For example, settings: matches all settings, settings:auth.saml: matches all SAML settings, and settings:auth.saml:enabled matches the enable property on the SAML settings.
teams:
teams:id:
Restrict an action to a set of teams from an organization. For example, teams: matches any team and teams:id:1 matches the team whose ID is 1.
users:
users:id:
Restrict an action to a set of users from an organization. For example, users:* matches any user and users:id:1 matches the user whose ID is 1.