Grafana Retrieve API

openapi: 3.2.0
info:
  title: Grafana Retrieve API
  description: 'Grafana is an open-source analytics and visualization platform that helps you monitor and analyze data from various sources. It lets you create customizable dashboards with charts, graphs, and alerts to visualize metrics and logs in real-time. Commonly used for monitoring infrastructure, applications, and business metrics, Grafana connects to dozens of data sources like Prometheus, Elasticsearch, and cloud platforms, making it easier to understand system performance, troubleshoot issues, and track key indicators all in one place. '
  contact:
    name: Grafana Labs
    url: https://grafana.com
    email: hello@grafana.com
  version: 0.0.1
servers:
- url: http://{defaultHost}
  variables:
    defaultHost:
      default: www.example.com/api
- url: https://{defaultHost}
  variables:
    defaultHost:
      default: www.example.com/api
security:
- basic: []
- api_key: []
tags:
- name: Retrieve
paths:
  /signing-keys/keys:
    parameters: []
    get:
      tags:
      - Retrieve
      summary: Grafana Retrieve JWKS
      description: The Grafana API endpoint `/signing-keys/keys` using the GET method retrieves the JSON Web Key Set (JWKS) for the Grafana instance. This endpoint returns the public keys used for verifying JSON Web Tokens (JWTs) issued by Grafana, which is essential for validating authentication tokens in distributed systems or when integrating with external services. The JWKS contains cryptographic key information in a standardized format that allows clients to verify the signature of JWTs without needing to store the keys locally, supporting secure token-based authentication workflows.
      operationId: retrieveJWKS
      parameters: []
      responses:
        '200':
          description: (empty)
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jwksResponse'
        '500':
          description: InternalServerError is a general error indicating something went wrong internally.
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponseBody'
      deprecated: false
      x-api-evangelist-processing:
        SplitPascalCaseOperationSummaries: true
        CaselCaseOperationIds: true
        WriteDescription: true
        ChooseTags: true
components:
  schemas:
    JSONWebKey:
      title: JSONWebKey
      type: object
      properties:
        Algorithm:
          type: string
          description: Key algorithm, parsed from `alg` header.
        CertificateThumbprintSHA1:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: X.509 certificate thumbprint (SHA-1), parsed from `x5t` header.
        CertificateThumbprintSHA256:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: X.509 certificate thumbprint (SHA-256), parsed from `x5t#S256` header.
        Certificates:
          type: array
          items:
            $ref: '#/components/schemas/ACertificaterepresentsanX.509certificate.'
          description: X.509 certificate chain, parsed from `x5c` header.
        CertificatesURL:
          allOf:
          - $ref: '#/components/schemas/AURLrepresentsaparsedURLtechnicallyaURIreference.2'
          - description: 'The general form represented is:


              [scheme:][//[userinfo@]host][/]path[?query][#fragment]


              URLs that do not start with a slash after the scheme are interpreted as:


              scheme:opaque[?query][#fragment]


              The Host field contains the host and port subcomponents of the URL.

              When the port is present, it is separated from the host with a colon.

              When the host is an IPv6 address, it must be enclosed in square brackets:

              "[fe80::1]:80". The [net.JoinHostPort] function combines a host and port

              into a string suitable for the Host field, adding square brackets to

              the host when necessary.


              Note that the Path field is stored in decoded form: /%47%6f%2f becomes /Go/.

              A consequence is that it is impossible to tell which slashes in the Path were

              slashes in the raw URL and which were %2f. This distinction is rarely important,

              but when it is, the code should use the [URL.EscapedPath] method, which preserves

              the original encoding of Path.


              The RawPath field is an optional field which is only set when the default

              encoding of Path is different from the escaped path. See the EscapedPath method

              for more details.


              URL''s String method uses the EscapedPath method to obtain the path.'
        Key:
          description: 'Key is the Go in-memory representation of this key. It must have one

            of these types:

            ed25519.PublicKey

            ed25519.PrivateKey

            ecdsa.PublicKey

            ecdsa.PrivateKey

            rsa.PublicKey

            rsa.PrivateKey

            []byte (a symmetric key)


            When marshaling this JSONWebKey into JSON, the "kty" header parameter

            will be automatically set based on the type of this field.'
        KeyID:
          type: string
          description: Key identifier, parsed from `kid` header.
        Use:
          type: string
          description: Key use, parsed from `use` header.
      description: 'JSONWebKey represents a public or private key in JWK format. It can be

        marshaled into JSON and unmarshaled from JSON.'
    ACertificaterepresentsanX.509certificate.:
      title: ACertificaterepresentsanX.509certificate.
      type: object
      properties:
        AuthorityKeyId:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        BasicConstraintsValid:
          type: boolean
          description: 'BasicConstraintsValid indicates whether IsCA, MaxPathLen,

            and MaxPathLenZero are valid.'
        CRLDistributionPoints:
          type: array
          items:
            type: string
          description: CRL Distribution Points
        DNSNames:
          type: array
          items:
            type: string
          description: 'Subject Alternate Name values. (Note that these values may not be valid

            if invalid values were contained within a parsed certificate. For

            example, an element of DNSNames may not be a valid DNS domain name.)'
        EmailAddresses:
          type: array
          items:
            type: string
          description: ''
        ExcludedDNSDomains:
          type: array
          items:
            type: string
          description: ''
        ExcludedEmailAddresses:
          type: array
          items:
            type: string
          description: ''
        ExcludedIPRanges:
          type: array
          items:
            $ref: '#/components/schemas/AnIPNetrepresentsanIPnetwork.'
          description: ''
        ExcludedURIDomains:
          type: array
          items:
            type: string
          description: ''
        ExtKeyUsage:
          type: array
          items:
            type: integer
            contentEncoding: int64
          description: ''
        Extensions:
          type: array
          items:
            $ref: '#/components/schemas/Extension'
          description: 'Extensions contains raw X.509 extensions. When parsing certificates,

            this can be used to extract non-critical extensions that are not

            parsed by this package. When marshaling certificates, the Extensions

            field is ignored, see ExtraExtensions.'
        ExtraExtensions:
          type: array
          items:
            $ref: '#/components/schemas/Extension'
          description: 'ExtraExtensions contains extensions to be copied, raw, into any

            marshaled certificates. Values override any extensions that would

            otherwise be produced based on the other fields. The ExtraExtensions

            field is not populated when parsing certificates, see Extensions.'
        IPAddresses:
          type: array
          items:
            type: string
          description: ''
        InhibitAnyPolicy:
          type: integer
          description: 'InhibitAnyPolicy and InhibitAnyPolicyZero indicate the presence and value

            of the inhibitAnyPolicy extension.


            The value of InhibitAnyPolicy indicates the number of additional

            certificates in the path after this certificate that may use the

            anyPolicy policy OID to indicate a match with any other policy.


            When parsing a certificate, a positive non-zero InhibitAnyPolicy means

            that the field was specified, -1 means it was unset, and

            InhibitAnyPolicyZero being true mean that the field was explicitly set to

            zero. The case of InhibitAnyPolicy==0 with InhibitAnyPolicyZero==false

            should be treated equivalent to -1 (unset).'
          contentEncoding: int64
        InhibitAnyPolicyZero:
          type: boolean
          description: 'InhibitAnyPolicyZero indicates that InhibitAnyPolicy==0 should be

            interpreted as an actual maximum path length of zero. Otherwise, that

            combination is interpreted as InhibitAnyPolicy not being set.'
        InhibitPolicyMapping:
          type: integer
          description: 'InhibitPolicyMapping and InhibitPolicyMappingZero indicate the presence

            and value of the inhibitPolicyMapping field of the policyConstraints

            extension.


            The value of InhibitPolicyMapping indicates the number of additional

            certificates in the path after this certificate that may use policy

            mapping.


            When parsing a certificate, a positive non-zero InhibitPolicyMapping

            means that the field was specified, -1 means it was unset, and

            InhibitPolicyMappingZero being true mean that the field was explicitly

            set to zero. The case of InhibitPolicyMapping==0 with

            InhibitPolicyMappingZero==false should be treated equivalent to -1

            (unset).'
          contentEncoding: int64
        InhibitPolicyMappingZero:
          type: boolean
          description: 'InhibitPolicyMappingZero indicates that InhibitPolicyMapping==0 should be

            interpreted as an actual maximum path length of zero. Otherwise, that

            combination is interpreted as InhibitAnyPolicy not being set.'
        IsCA:
          type: boolean
        Issuer:
          allOf:
          - $ref: '#/components/schemas/Name'
          - description: 'Name represents an X.509 distinguished name. This only includes the common

              elements of a DN. Note that Name is only an approximation of the X.509

              structure. If an accurate representation is needed, asn1.Unmarshal the raw

              subject or issuer as an [RDNSequence].'
        IssuingCertificateURL:
          type: array
          items:
            type: string
          description: ''
        KeyUsage:
          type: integer
          description: 'KeyUsage represents the set of actions that are valid for a given key. It''s

            a bitmap of the KeyUsage* constants.'
          contentEncoding: int64
        MaxPathLen:
          type: integer
          description: 'MaxPathLen and MaxPathLenZero indicate the presence and

            value of the BasicConstraints'' "pathLenConstraint".


            When parsing a certificate, a positive non-zero MaxPathLen

            means that the field was specified, -1 means it was unset,

            and MaxPathLenZero being true mean that the field was

            explicitly set to zero. The case of MaxPathLen==0 with MaxPathLenZero==false

            should be treated equivalent to -1 (unset).


            When generating a certificate, an unset pathLenConstraint

            can be requested with either MaxPathLen == -1 or using the

            zero value for both MaxPathLen and MaxPathLenZero.'
          contentEncoding: int64
        MaxPathLenZero:
          type: boolean
          description: 'MaxPathLenZero indicates that BasicConstraintsValid==true

            and MaxPathLen==0 should be interpreted as an actual

            maximum path length of zero. Otherwise, that combination is

            interpreted as MaxPathLen not being set.'
        NotBefore:
          type: string
          contentEncoding: date-time
        OCSPServer:
          type: array
          items:
            type: string
          description: RFC 5280, 4.2.2.1 (Authority Information Access)
        PermittedDNSDomains:
          type: array
          items:
            type: string
          description: ''
        PermittedDNSDomainsCritical:
          type: boolean
          description: Name constraints
        PermittedEmailAddresses:
          type: array
          items:
            type: string
          description: ''
        PermittedIPRanges:
          type: array
          items:
            $ref: '#/components/schemas/AnIPNetrepresentsanIPnetwork.'
          description: ''
        PermittedURIDomains:
          type: array
          items:
            type: string
          description: ''
        Policies:
          type: array
          items:
            type: string
          description: 'Policies contains all policy identifiers included in the certificate.

            See CreateCertificate for context about how this field and the PolicyIdentifiers field

            interact.

            In Go 1.22, encoding/gob cannot handle and ignores this field.'
        PolicyIdentifiers:
          type: array
          items:
            type: array
            items:
              type: integer
              contentEncoding: int64
          description: 'PolicyIdentifiers contains asn1.ObjectIdentifiers, the components

            of which are limited to int32. If a certificate contains a policy which

            cannot be represented by asn1.ObjectIdentifier, it will not be included in

            PolicyIdentifiers, but will be present in Policies, which contains all parsed

            policy OIDs.

            See CreateCertificate for context about how this field and the Policies field

            interact.'
        PolicyMappings:
          type: array
          items:
            $ref: '#/components/schemas/PolicyMappingrepresentsapolicymappingentryinthepolicyMappingsextension.'
          description: PolicyMappings contains a list of policy mappings included in the certificate.
        PublicKey: {}
        PublicKeyAlgorithm:
          type: integer
          contentEncoding: int64
        Raw:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        RawIssuer:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        RawSubject:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        RawSubjectPublicKeyInfo:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        RawTBSCertificate:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        RequireExplicitPolicy:
          type: integer
          description: 'RequireExplicitPolicy and RequireExplicitPolicyZero indicate the presence

            and value of the requireExplicitPolicy field of the policyConstraints

            extension.


            The value of RequireExplicitPolicy indicates the number of additional

            certificates in the path after this certificate before an explicit policy

            is required for the rest of the path. When an explicit policy is required,

            each subsequent certificate in the path must contain a required policy OID,

            or a policy OID which has been declared as equivalent through the policy

            mapping extension.


            When parsing a certificate, a positive non-zero RequireExplicitPolicy

            means that the field was specified, -1 means it was unset, and

            RequireExplicitPolicyZero being true mean that the field was explicitly

            set to zero. The case of RequireExplicitPolicy==0 with

            RequireExplicitPolicyZero==false should be treated equivalent to -1

            (unset).'
          contentEncoding: int64
        RequireExplicitPolicyZero:
          type: boolean
          description: 'RequireExplicitPolicyZero indicates that RequireExplicitPolicy==0 should be

            interpreted as an actual maximum path length of zero. Otherwise, that

            combination is interpreted as InhibitAnyPolicy not being set.'
        SerialNumber:
          type: string
        Signature:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        SignatureAlgorithm:
          type: integer
          contentEncoding: int64
        Subject:
          allOf:
          - $ref: '#/components/schemas/Name'
          - description: 'Name represents an X.509 distinguished name. This only includes the common

              elements of a DN. Note that Name is only an approximation of the X.509

              structure. If an accurate representation is needed, asn1.Unmarshal the raw

              subject or issuer as an [RDNSequence].'
        SubjectKeyId:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
        URIs:
          type: array
          items:
            $ref: '#/components/schemas/AURLrepresentsaparsedURLtechnicallyaURIreference.2'
          description: ''
        UnhandledCriticalExtensions:
          type: array
          items:
            type: array
            items:
              type: integer
              contentEncoding: int64
          description: 'UnhandledCriticalExtensions contains a list of extension IDs that

            were not (fully) processed when parsing. Verify will fail if this

            slice is non-empty, unless verification is delegated to an OS

            library which understands all the critical extensions.


            Users can access these extensions using Extensions and can remove

            elements from this slice if they believe that they have been

            handled.'
        UnknownExtKeyUsage:
          type: array
          items:
            type: array
            items:
              type: integer
              contentEncoding: int64
        Version:
          type: integer
          contentEncoding: int64
    AnIPNetrepresentsanIPnetwork.:
      title: AnIPNetrepresentsanIPnetwork.
      type: object
      properties:
        IP:
          type: string
        Mask:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: See type [IPNet] and func [ParseCIDR] for details.
    AttributeTypeAndValue:
      title: AttributeTypeAndValue
      type: object
      properties:
        Type:
          type: array
          items:
            type: integer
            contentEncoding: int64
          description: ''
        Value: {}
      description: 'AttributeTypeAndValue mirrors the ASN.1 structure of the same name in

        RFC 5280, Section 4.1.2.4.'
    Extension:
      title: Extension
      type: object
      properties:
        Critical:
          type: boolean
        Id:
          type: array
          items:
            type: integer
            contentEncoding: int64
          description: ''
        Value:
          type: array
          items:
            type: integer
            contentEncoding: int32
          description: ''
      description: 'Extension represents the ASN.1 structure of the same name. See RFC

        5280, section 4.2.'
    AURLrepresentsaparsedURLtechnicallyaURIreference.2:
      title: AURLrepresentsaparsedURLtechnicallyaURIreference.2
      type: object
      properties:
        ForceQuery:
          type: boolean
        Fragment:
          type: string
        Host:
          type: string
        OmitHost:
          type: boolean
        Opaque:
          type: string
        Path:
          type: string
        RawFragment:
          type: string
        RawPath:
          type: string
        RawQuery:
          type: string
        Scheme:
          type: string
        User:
          type: object
          description: 'The Userinfo type is an immutable encapsulation of username and

            password details for a [URL]. An existing Userinfo value is guaranteed

            to have a username set (potentially empty, as allowed by RFC 2396),

            and optionally a password.'
      description: 'The general form represented is:


        [scheme:][//[userinfo@]host][/]path[?query][#fragment]


        URLs that do not start with a slash after the scheme are interpreted as:


        scheme:opaque[?query][#fragment]


        The Host field contains the host and port subcomponents of the URL.

        When the port is present, it is separated from the host with a colon.

        When the host is an IPv6 address, it must be enclosed in square brackets:

        "[fe80::1]:80". The [net.JoinHostPort] function combines a host and port

        into a string suitable for the Host field, adding square brackets to

        the host when necessary.


        Note that the Path field is stored in decoded form: /%47%6f%2f becomes /Go/.

        A consequence is that it is impossible to tell which slashes in the Path were

        slashes in the raw URL and which were %2f. This distinction is rarely important,

        but when it is, the code should use the [URL.EscapedPath] method, which preserves

        the original encoding of Path.


        The RawPath field is an optional field which is only set when the default

        encoding of Path is different from the escaped path. See the EscapedPath method

        for more details.


        URL''s String method uses the EscapedPath method to obtain the path.'
    ErrorResponseBody:
      title: ErrorResponseBody
      required:
      - message
      type: object
      properties:
        error:
          type: string
          description: Error An optional detailed description of the actual error. Only included if running in developer mode.
        message:
          type: string
          description: a human readable version of the error
        status:
          type: string
          description: 'Status An optional status to denote the cause of the error.


            For example, a 412 Precondition Failed error may include additional information of why that error happened.'
    Name:
      title: Name
      type: object
      properties:
        Country:
          type: array
          items:
            type: string
          description: ''
        ExtraNames:
          type: array
          items:
            $ref: '#/components/schemas/AttributeTypeAndValue'
          description: 'ExtraNames contains attributes to be copied, raw, into any marshaled

            distinguished names. Values override any attributes with the same OID.

            The ExtraNames field is not populated when parsing, see Names.'
        Locality:
          type: array
          items:
            type: string
          description: ''
        Names:
          type: array
          items:
            $ref: '#/components/schemas/AttributeTypeAndValue'
          description: 'Names contains all parsed attributes. When parsing distinguished names,

            this can be used to extract non-standard attributes that are not parsed

            by this package. When marshaling to RDNSequences, the Names field is

            ignored, see ExtraNames.'
        SerialNumber:
          type: string
        StreetAddress:
          type: array
          items:
            type: string
          description: ''
      description: 'Name represents an X.509 distinguished name. This only includes the common

        elements of a DN. Note that Name is only an approximation of the X.509

        structure. If an accurate representation is needed, asn1.Unmarshal the raw

        subject or issuer as an [RDNSequence].'
    PolicyMappingrepresentsapolicymappingentryinthepolicyMappingsextension.:
      title: PolicyMappingrepresentsapolicymappingentryinthepolicyMappingsextension.
      type: object
      properties:
        IssuerDomainPolicy:
          type: string
          description: 'IssuerDomainPolicy contains a policy OID the issuing certificate considers

            equivalent to SubjectDomainPolicy in the subject certificate.'
        SubjectDomainPolicy:
          type: string
          description: 'SubjectDomainPolicy contains a OID the issuing certificate considers

            equivalent to IssuerDomainPolicy in the subject certificate.'
    jwksResponse:
      title: jwksResponse
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/JSONWebKey'
          description: ''
  securitySchemes:
    api_key:
      type: apiKey
      name: Authorization
      in: header
    basic:
      type: http
      scheme: basic