AutoGineer
Generated banner for Admin
Generated logo for Admin

Admin

Grafana LabsOfficialPublished by Grafana Labs

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • Low risk
Download ZIP

From the author

Manage Grafana Cloud accounts — organizations, stacks, RBAC roles and assignments, SSO/SAML/OAuth/GitHub auth, service accounts for CI/CD, user invites, team membership, and API-driven provisioning. Creates stacks via the Cloud API, mints service-account tokens, applies role assignments, configures SSO providers, and provisions teams/folders/dashboards via Terraform. Use when managing Grafana Cloud access, configuring SSO/SAML/OAuth, setting up service accounts for Terraform/CI/CD, assigning RBAC roles, inviting users, managing multiple stacks or organizations, provisioning cloud resources via API or Terraform, or auditing admin actions — even when the user says "set up SSO", "create a stack", "make a service account", or "onboard a team" without explicitly saying "admin".
— the description by Grafana Labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides administrative procedures for managing Grafana Cloud environments. It covers the lifecycle of stacks, user and team onboarding, authentication configuration (SSO/SAML/OAuth), and programmatic access via service accounts. It includes guidance on using the Cloud API and Terraform for infrastructure provisioning, as well as troubleshooting patterns for common authentication and access control issues.

What it does

  • Provision and delete Grafana Cloud stacks using the Cloud API
  • Configure SSO, SAML, and OAuth providers for user authentication
  • Manage user invites, team memberships, and RBAC role assignments
  • Create and manage service accounts for CI/CD and automation
  • Provision resources like folders and dashboards via Terraform
  • Audit administrative actions and troubleshoot authentication flows

When to use it

  • Setting up new Grafana Cloud stacks or organizations
  • Configuring external identity providers like Okta or GitHub
  • Onboarding teams and assigning specific access roles
  • Automating infrastructure provisioning with Terraform
  • Generating service account tokens for CI/CD pipelines
  • Investigating authentication or role-mapping failures

Advantages

  • Centralized management of stack lifecycle and user access
  • Declarative configuration support via Terraform
  • Standardized patterns for SSO and identity provider integration
  • Clear verification steps for authentication and role mapping
  • Programmatic control over organization and stack resources

Usage examples

“Create a new Grafana Cloud stack named production-metrics.”
The agent uses the Cloud API to POST a new instance request and provides the steps to verify the stack's health.
“How do I set up GitHub OAuth for my Grafana stack?”
The agent provides the required configuration block for grafana.ini and the 5-step verification process to ensure the integration works.
“Create a service account for my Terraform CI/CD pipeline.”
The agent provides the API commands to create the service account, mint a token, and verify its permissions.
“How can I assign a custom role to a team?”
The agent provides the YAML structure for defining roles and assignments, along with the API command to verify the applied role.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/grafana/admin-tape/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip admin.zip -d .agents/skills

Documentation by Grafana Labs

Grafana Cloud Admin

Docs: https://grafana.com/docs/grafana-cloud/account-management.md

Common Workflows

Setting up a new stack
# 1. Create the stack via Cloud API
curl -X POST https://grafana.com/api/instances \
  -H "Authorization: Bearer <grafana-com-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-new-stack", "slug": "my-new-stack", "region": "us-east-0", "plan": "grafana-cloud-free"}'

# 2. Verify the stack is reachable (poll until 200)
until curl -fs https://my-new-stack.grafana.net/api/health > /dev/null; do sleep 2; done

# 3. Mint an admin service-account token (see § Service Accounts below)

# 4. Test the token
curl https://my-new-stack.grafana.net/api/org -H "Authorization: Bearer <token>"
# Returns 200 + org JSON → token works
Onboarding a team

  1. Invite users via POST /api/org/invites (one curl per user — see references/api-reference.md § Stack API)

  2. Create the team via POST /api/teams

  3. Add each user via POST /api/teams/{teamId}/members

  4. Assign an RBAC role to the team (see § RBAC below)

  5. Verify: GET /api/teams/{teamId}/members returns the expected user list

Configuring SSO (Okta / SAML / GitHub)

  1. Pick the provider config from references/sso.md and drop into grafana.ini

  2. Restart Grafana

  3. Always validate in an incognito window before announcing: see references/sso.md § Verifying SSO for the 5-step verification + role-mapping debug pattern

Deleting a stack (destructive)
# 1. Delete via Cloud API
curl -X DELETE https://grafana.com/api/instances/{id} \
  -H "Authorization: Bearer <grafana-com-api-key>"

# 2. Verify the stack is gone (must return 404)
curl https://grafana.com/api/instances/{id} \
  -H "Authorization: Bearer <grafana-com-api-key>"

If the GET still returns 200 after a few seconds, the delete didn't apply — re-check the stack ID and Cloud API key.

Organization and Stack Structure

Grafana Cloud Account
└── Organization (billing unit)
    ├── Stack 1 (prod)   → dedicated Grafana, Prometheus, Loki, Tempo URLs
    ├── Stack 2 (staging)
    └── Stack 3 (dev)

  • Organization: top-level account with billing, users, API keys, stacks

  • Stack: dedicated Grafana + LGTM instance with its own URLs and credentials

User Roles

RoleScopePermissions
Org AdminOrganizationManage stacks, users, billing, API keys
AdminStackData sources, plugins, users, provisioning
EditorStackCreate/edit dashboards, alerts
ViewerStackRead-only dashboards

RBAC

Define a custom role + assignment in provisioning YAML:

# provisioning/access-control/roles.yaml
apiVersion: 1
roles:
  - name: TeamDashboardEditor
    description: Edit dashboards within team folder
    permissions:
      - action: dashboards:read
        scope: folders:UID:team-folder
      - action: dashboards:write
        scope: folders:UID:team-folder
      - action: dashboards:create
        scope: folders:UID:team-folder
# provisioning/access-control/assignments.yaml
apiVersion: 1
roleAssignments:
  - roleName: TeamDashboardEditor
    users:
      - [email protected]
      - [email protected]
    teams:
      - platform-team

After committing the YAML and restarting Grafana, verify the role applied: GET /api/access-control/roles | jq '.[] | select(.name=="TeamDashboardEditor")'.

Service Accounts

Service accounts are the recommended way for programmatic access (CI/CD, Terraform, agents).

# 1. Create the service account
curl -X POST https://yourstack.grafana.net/api/serviceaccounts \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "terraform-provisioner", "role": "Admin", "isDisabled": false}'

# 2. Mint a token for it
curl -X POST https://yourstack.grafana.net/api/serviceaccounts/{id}/tokens \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-token", "secondsToLive": 0}'

# 3. Verify the token works (test on a harmless endpoint)
curl https://yourstack.grafana.net/api/org \
  -H "Authorization: Bearer <new-token>"
# 200 + org JSON → token works. Anything else → re-check role assignment in step 1.

Provisioning equivalent (YAML, declarative):

# provisioning/access-control/service_accounts.yaml
apiVersion: 1
serviceAccounts:
  - name: alloy-writer
    orgId: 1
    role: Editor
    tokens:
      - name: alloy-token

References

  • references/sso.md — OAuth / SAML / GitHub OAuth config + the 5-step SSO verification pattern + common failure modes

  • references/terraform.md — Terraform provider config + common resource patterns (teams, users, folders, dashboards) + drift troubleshooting

  • references/api-reference.md — full Cloud API + Stack API endpoint reference + audit-log queries

Files

references/api-reference.md

Admin API reference

Endpoints split by audience: Cloud-level (manage stacks, orgs from grafana.com) vs Stack-level (per-instance Grafana API).

Contents

  • Cloud API — stack management

  • Stack API — user / team / org management

  • Audit logs

Cloud API — stack management

Base URL: https://grafana.com/api/. Auth: grafana.com API key.

# List stacks
curl https://grafana.com/api/instances \
  -H "Authorization: Bearer <grafana-com-api-key>"

# Create stack
curl -X POST https://grafana.com/api/instances \
  -H "Authorization: Bearer <grafana-com-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-new-stack", "slug": "my-new-stack", "region": "us-east-0", "plan": "grafana-cloud-free"}'

# Verify stack is reachable (poll until 200)
curl https://my-new-stack.grafana.net/api/health

# Delete stack
curl -X DELETE https://grafana.com/api/instances/{id} \
  -H "Authorization: Bearer <grafana-com-api-key>"

# Verify deletion
curl https://grafana.com/api/instances/{id} \
  -H "Authorization: Bearer <grafana-com-api-key>"
# Should return 404

Stack API — user / team / org management

Base URL: https://yourstack.grafana.net/api/. Auth: Grafana service account token.

# List org users
GET /api/org/users

# Invite user to org
POST /api/org/invites
Body: { "loginOrEmail": "[email protected]", "role": "Editor", "sendEmail": true }

# Update user org role
PATCH /api/org/users/{userId}
Body: { "role": "Admin" }

# List teams
GET /api/teams/search?name=platform

# Create team
POST /api/teams
Body: { "name": "Platform Team", "email": "[email protected]" }

# Add user to team
POST /api/teams/{teamId}/members
Body: { "userId": 2 }

# Look up a user (useful after SSO config changes)
GET /api/users/[email protected]

Audit logs

# Query audit logs (Enterprise / Cloud only)
GET /api/admin/auditlogs?query=login&from=1706745600&to=1706832000&limit=50

from and to are Unix epoch seconds. The query parameter is a free-text search over event names (login, dashboard.create, team.member.add, etc.).

Common failure modes

SymptomLikely cause
401 UnauthorizedToken expired or wrong stack URL — check Authorization header
403 Forbidden on /api/admin/*Service account lacks Admin role on the org
404 on a known stackWrong region in URL (us-east-0 vs eu-west-0)
Audit logs empty for a known eventAudit logging may not be enabled on free tier — confirm Enterprise/Cloud subscription

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs network access, Needs an API key

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Grafana Labs
Publisher
Grafana Labs (Official)
Source
grafana/skills · skills/grafana-cloud/admin · commit 8fb72a5
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Grafana Labs.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download admin.zip