> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grafana

## After this article

You'll be able to connect Grafana to Lumos to sync users, teams, organization roles, and team roles, and to provision organization and team roles.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User account records |
| Teams | Permission | Yes | No | Teams in Grafana |
| Org Role | Permission | Yes | Yes | Organization role in Grafana |
| Team Role | Permission | Yes | Yes | Team role in Grafana |

Activity tracking is supported. The Grafana integration tracks the user's last seen timestamp.

## Required plan and roles

* **Grafana role:** you can only connect the integration with a Service Account that has the **User administration (organizational)** role. This role gives Lumos both read and write capabilities.

## Read-only access vs provisioning

**Is read-only possible?** No. Grafana only connects with a service account holding the User administration (organizational) role, and that role inherently grants Lumos both read and write access. No narrower, read-only role is documented for this connector.

**What full provisioning requires.** A service account created with the User administration (organizational) role, with its token entered as the Service Account Token on the connector card along with your Grafana base URL. Follow the steps below.

**Watch out for.** Because there's only one supported role, you can't scope this connection down to sync-only. Anyone who can generate the service account token can also provision Org Role and Team Role assignments.

## Instructions

**Phase 1: Create a Grafana service account token**

1. Log in to your Grafana account dashboard.
2. Go to **Administration → Users and access → Service accounts**.
3. Click **Add service account** and create a new service account with the **User administration (organizational)** role.
4. Open the new service account's settings and click **Add service account token**.
5. Generate a new token. Copy and store it right away, because it might not be shown again.

**Phase 2: Connect Grafana in Lumos**

1. Click the **Grafana** card in your Lumos integrations. Reconnect an existing card or add a new one.
2. Provide the **Service Account Token** and the **Base URL**. Enter the base URL without the `http://` or `https://` protocol, for example `your.grafana.com`.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Unauthorized" or "Invalid authentication credentials".** Verify the token or API key is correct. Check that the token hasn't expired or been revoked.

**"Forbidden" or "Permission denied".** Verify the service account has the required admin role and that the token has enough permission for the requested operations. Check that the organization ID is correct if one is specified.

**Cannot connect to the Grafana instance.** Verify the Grafana URL is correct and reachable. Check network connectivity and firewall rules. Make sure HTTPS is configured correctly if you use SSL.

**Users aren't syncing.** Verify you have admin permission for user list access, that users are active in Grafana, and that users have email addresses configured.

**Teams are missing.** Verify teams exist in the organization, that the token can access team data, and that teams have at least one member.