Grafana

​

Permissions

Use a Grafana service account token that can read and query the data sources you select. Auto Monitors also needs alert rule, contact point and notification policy access in Ordyn’s folder; Ordyn checks each action after you connect.

​

Data sources

Find and query the data sources you select.

​

Alert history

Lets investigations see when alerts fired: read Grafana’s alert state history (when each alert went pending, firing and back to normal). Only needed for that; Grafana’s Viewer role includes it. Needs alert state history turned on in Grafana.

​

Manage alerting

Create and maintain Ordyn’s alert rules in its folder, plus the contact point and notification policy that send their alerts back to Ordyn.

​

Mimir or Loki ruler

Only if you choose a Mimir or Loki ruler for Ordyn’s rules. Permissions: alert.rules.external:read, alert.rules.external:write.

​

External Alertmanager

Only if you use an external Alertmanager. Permissions: alert.notifications.external:read, alert.notifications.external:write, alert.instances.external:read, alert.instances.external:write.

​

Grafana Cloud data source credentials

Only needed on Grafana Cloud: the credentials behind each data source are separate from the service account and need these access-policy scopes, depending on the sources you select. Scopes: metrics:read, logs:read, traces:read, rules:read, alerts:read.

​

Grafana Cloud ruler and Alertmanager writes

On Grafana Cloud, only if you choose a Mimir or Loki ruler for Ordyn’s rules or use an external Alertmanager: the credentials behind those data sources also need these scopes. Scopes: rules:write, alerts:write.

• Grafana authorizes each request by fine-grained action and resource, so role names alone don’t decide what works. Ordyn checks every action against the exact folder, data source and contact point it uses, and the Auto Monitors page lists anything missing. Ordyn’s own acceptance tests run with Grafana’s built-in Editor and Admin roles.
• On Grafana 12, alerting provisioning access can stand in for the rule, contact point and notification policy actions: alert.provisioning:read and alert.provisioning:write, or the rule- and notification-specific provisioning actions.
• Grafana-managed alert rules need the organization’s Alertmanager setting to be internal. Ordyn does not change it, and refuses to create rules while alerts are also sent to external Alertmanagers.

​

How to grant

Create a service account token. In Grafana, open Administration → Users and access → Service accounts, create a service account with every permission above, including the optional ruler and Alertmanager actions, and add a token. Grafana Cloud data source credentials. On Grafana Cloud, give the access policy behind each data source’s credentials these scopes: metrics:read, logs:read, traces:read, rules:read, rules:write, alerts:read, alerts:write. Permission catalog version 2026-10-16.1. See permission changes.

​

What Ordyn reads

Grafana alert rules, their state and their state history (when each alert fired), plus Prometheus or Mimir metrics, Loki logs, and Tempo traces through the data sources you select.

​

What Ordyn writes

With Auto Monitors on, Ordyn creates and maintains its own alert rules in its folder, plus the contact point and notification policy that send their alerts back to Ordyn.