grafana-api-token-provisioninglisted

# Grafana API token provisioning: OSS role ceiling + useful read endpoints ## OSS has no granular RBAC — Viewer is the floor, not a narrow scope Grafana's fine-grained fixed roles (`fixed:alerting.rules:reader`, `fixed:alerting.instances:reader`, `fixed:alerting:reader`, `fixed:annotations:reader`, etc.) are **Enterprise/Cloud-only** — confirmed against current docs (checked against a live Grafana 13.1.0 OSS install, 2026-07-27). An unlicensed OSS install can only assign the three basic org roles to a service account: **Viewer, Editor, Admin**. This means "least privilege" for OSS Grafana tops out at **Viewer** — which reads *all* dashboards, datasource configs, and alerting state in the org, not just the one thing the automation actually needs. Say this explicitly when proposing a token to a human ("Viewer is the finest grain OSS offers, broader than ideal") rather than implying true narrow scoping was achieved — don't oversell the privilege boundary. Don't spend time hunting for a way to assign a fixed role via the API on an OSS instance — it's not a permissions or syntax problem, it's a licensing gate. Check `grafana.ini`/the org's license status first if genuinely unsure whether Enterprise features are active. ## Creating a service account + token via API (no UI needed) ```bash # 1. Create the service account (role: Viewer | Editor | Admin) curl -s -u "admin:$ADMIN_PW" -X POST http://<host>:3000/api/serviceaccounts \ -H "Content-Type: application/json" \ -d '{"n