OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add grafana/skills --skill admin
Manage Grafana Cloud accounts — organizations, stacks, RBAC roles and assignments, SSO/SAML/OAuth/GitHub auth, service accounts for CI/CD, user invites, team membership, and API-driven provisioning. Creates stacks via the Cloud API, mints service-account tokens, applies role assignments, configures SSO providers, and provisions teams/folders/dashboards via Terraform. Use when managing Grafana Cloud access, configuring SSO/SAML/OAuth, setting up service accounts for Terraform/CI/CD, assigning RBAC roles, inviting users, managing multiple stacks or organizations, provisioning cloud resources via API or Terraform, or auditing admin actions — even when the user says "set up SSO", "create a stack", "make a service account", or "onboard a team" without explicitly saying "admin".
npx skills add grafana/skills --skill admin
Docs: https://grafana.com/docs/grafana-cloud/account-management.md
POST /api/org/invites (one curl per user — see references/api-reference.md § Stack API)POST /api/teamsPOST /api/teams/{teamId}/membersGET /api/teams/{teamId}/members returns the expected user listgrafana.iniIf the GET still returns 200 after a few seconds, the delete didn't apply — re-check the stack ID and Cloud API key.
| Role | Scope | Permissions |
|---|---|---|
| Org Admin | Organization | Manage stacks, users, billing, API keys |
| Admin | Stack | Data sources, plugins, users, provisioning |
| Editor | Stack | Create/edit dashboards, alerts |
| Viewer | Stack | Read-only dashboards |
Define a custom role + assignment in provisioning YAML:
After committing the YAML and restarting Grafana, verify the role applied: GET /api/access-control/roles | jq '.[] | select(.name=="TeamDashboardEditor")'.
Service accounts are the recommended way for programmatic access (CI/CD, Terraform, agents).
Provisioning equivalent (YAML, declarative):
references/sso.md — OAuth / SAML / GitHub OAuth config + the 5-step SSO verification pattern + common failure modesreferences/terraform.md — Terraform provider config + common resource patterns (teams, users, folders, dashboards) + drift troubleshootingreferences/api-reference.md — full Cloud API + Stack API endpoint reference + audit-log queries# 1. Delete via Cloud API
curl -X DELETE https://grafana.com/api/instances/{id} \
-H "Authorization: Bearer <grafana-com-api-key>"
# 2. Verify the stack is gone (must return 404)
curl https://grafana.com/api/instances/{id} \
-H "Authorization: Bearer <grafana-com-api-key>"Grafana Cloud Account
└── Organization (billing unit)
├── Stack 1 (prod) → dedicated Grafana, Prometheus, Loki, Tempo URLs
├── Stack 2 (staging)
└── Stack 3 (dev)# provisioning/access-control/roles.yaml
apiVersion: 1
roles:
- name: TeamDashboardEditor
description: Edit dashboards within team folder
permissions:
- action: dashboards:read
scope: folders:UID:team-folder
- action: dashboards:write
scope: folders:UID:team-folder
- action: dashboards:create
scope: folders:UID:team-folder# provisioning/access-control/assignments.yaml
apiVersion: 1
roleAssignments:
- roleName: TeamDashboardEditor
users:
- alice@example.com
- bob@example.com
teams:
- platform-team# 1. Create the service account
curl -X POST https://yourstack.grafana.net/api/serviceaccounts \
-H "Authorization: Bearer <admin-token>" \
-H "Content-Type: application/json" \
-d '{"name": "terraform-provisioner", "role": "Admin", "isDisabled": false}'
# 2. Mint a token for it
curl -X POST https://yourstack.grafana.net/api/serviceaccounts/{id}/tokens \
-H "Authorization: Bearer <admin-token>" \
-H "Content-Type: application/json" \
-d '{"name": "ci-token", "secondsToLive": 0}'
# 3. Verify the token works (test on a harmless endpoint)
curl https://yourstack.grafana.net/api/org \
-H "Authorization: Bearer <new-token>"
# 200 + org JSON → token works. Anything else → re-check role assignment in step 1.# provisioning/access-control/service_accounts.yaml
apiVersion: 1
serviceAccounts:
- name: alloy-writer
orgId: 1
role: Editor
tokens:
- name: alloy-token