Report which Grafana and which organization this server reads, as whom, and what that credential may do: the URL, Grafana version, org id and name, the login (a service account or a user), its effective role and permissions, and whether write tools are registered. When the server is not configured, says exactly what to set. Call this first when a tool you expected is missing, and before trusting data from an instance you have not checked: a service account token picks its org silently.

Find dashboards and folders by title substring, tag, folder or starred state. Returns uid, title, folder, tags and the URL of each; feed a uid to grafana_get_dashboard. With no arguments, lists every dashboard (up to limit).

Read a dashboard. view=summary (default) returns what is on it without the layout: variables, and every panel (rows flattened) with its id, type, unit and queries — the layout, styling and overrides left out, typically half the JSON. view=panel returns one panel's full JSON (needs panel_id). view=full returns the whole dashboard JSON with its version, which is what grafana_save_dashboard needs back; it can be tens of KB. To see the DATA a panel shows, use grafana_run_panel_query instead of reading its query and re-typing it.

Run a dashboard panel's queries the way the dashboard would, and return the data: template variables ($namespace, ${datasource}) are filled in — from vars, else the value saved with the dashboard, else the variable's first value (or All) as the browser would pick — and the panel's datasource, hidden queries and expressions are respected. Returns the variable values used and each query as sent, so the result can be checked and re-run with other values. Time series come back on a step grid with stats, logs as lines, anything else as a table. The time range defaults to the dashboard's own (often now-1h).

Evaluate PromQL through a Prometheus datasource. mode=instant (default) gives the value at one time — the right mode for almost every question, with any window written into the expression (increase(x[24h])). mode=range gives the shape over time on a step grid with min/max/avg/last per series; use view=stats with sort=max to find outliers among many series. Labels shared by every series come back once as common_labels. Aggregate in the expression (sum by, topk) rather than fetching raw series.

Run LogQL through a Loki datasource. A log query ({namespace="api"} |= "error") returns lines newest first, each with its time, level and the labels that differ between lines (the shared ones once, as common_labels), cut at max_line_chars. A metric query (sum by (app) (count_over_time({namespace="api"} |= "error" [5m]))) returns series on a step grid with stats. Always put a label matcher in the selector and keep the range short: Loki scans every line in it. To count, prefer a metric query over fetching lines.

Run raw queries against any datasource through /api/ds/query — for datasources with no dedicated tool (SQL, Elasticsearch, Tempo, CloudWatch…), or for server-side expressions over other queries ({"datasource": "__expr__", "type": "math", "expression": "$A / $B"}). Each query is the target object as it appears in a panel's JSON (grafana_get_dashboard view=panel shows one). Prefer grafana_query_prometheus / grafana_query_loki for those two, and grafana_run_panel_query to reproduce a panel. Dashboard variables are NOT filled in here.

Discover what to query, for a Prometheus or Loki datasource: with no label, the label names in use; with label, the values it takes (label=name lists Prometheus metric names). Restrict with selector to the series or streams that matter, e.g. the pods of one namespace. Looks at the last hour unless start is given — the datasource default is its whole retention, which returns everything that ever existed.

List the datasources: uid, name, type (prometheus, loki, alertmanager, postgres…), and which one is the default. Every query tool takes a datasource by uid or name. Credentials and plugin settings are never returned.

What is alerting right now: the alerts held by Grafana's Alertmanager and by every Alertmanager datasource, most severe first, with since when, summary and description. Silenced and inhibited alerts are left out unless state=suppressed or all. Labels shared by every alert come back once as common_labels; counts by severity and alertname cover the whole match even when the list is cut.

The alert rules and their evaluation state, from Grafana-managed alerting and from every Prometheus/Loki datasource that evaluates its own rules. Firing first, then pending. Each rule has its group, state, health (and lastError when it fails to evaluate), its for and labels; include_query adds the expression. Recording rules are left out unless type=record or all. Use grafana_list_alerts for the alert instances themselves.

The silences in Grafana's Alertmanager and every Alertmanager datasource: id, state, matchers, start and end, who created it and why. Expired silences are left out unless state=expired or all.

Annotations in a time window, newest first: deploys, incidents and notes people or CI marked on dashboards, and alert state changes (type=alert). Each has its time (and end for a region), text, tags, dashboard and panel. The usual question — "what changed around the spike?" — is a window around the spike with no other filter.

Escape hatch: GET any Grafana HTTP API endpoint the other tools do not wrap — /api/v1/provisioning/alert-rules/, /api/v1/provisioning/contact-points, /api/v1/provisioning/policies, /api/folders, /api/library-elements, /api/teams/search, /api/org/users, /api/dashboards/uid//versions, /apis/dashboard.grafana.app/v2beta1/namespaces/default/dashboards/. The answer is the raw JSON, unshaped, cut at max_chars. Read-only: only GET is ever sent. Prefer the named tools, which shape their output.