Managed Service for Prometheus exposes HTTP API URLs that let you query monitoring data from a self-managed Grafana instance or any application that supports the Prometheus HTTP API.
Prerequisites
Before you begin, make sure you have:
A connected Prometheus instance. To connect one, see Container observability, Alibaba Cloud service observability, or Host observability
Administrator access to your self-managed Grafana instance (for Grafana integration)
Your Prometheus instance version (V1 or V2), which determines the authentication method
(V2 only) An AccessKey ID and AccessKey secret for a RAM user with AliyunPrometheusMetricReadAccess or AliyunCloudMonitorFullAccess permission
Get the HTTP API URL
Log on to the Cloud Monitor console. In the left navigation pane, choose .
In the top navigation bar, select the region where the Prometheus instance is deployed. Find the instance and click Settings in the Actions column.
On the Settings tab, copy the public or internal HTTP API URL.
Set up authentication
Authentication differs between Prometheus V1 and V2 instances. Check your version before proceeding.
Prometheus V1 (token-based, optional)
Optionally, on the Settings tab, click Generate Token to create an authentication token. Save this token -- you need it when adding the data source to Grafana and when making API requests.
After the authentication token is generated, you must specify the token when you add the Prometheus instance to your Grafana system as a data source. Otherwise, monitoring data cannot be read from the Prometheus instance.
Prometheus V2 (AccessKey-based)
By default, data access requires both an AccessKey ID and AccessKey secret with HTTP Basic authentication. No token is needed.
The associated RAM user must have one of the following system permissions:
AliyunPrometheusMetricReadAccess-- read-only access to metricsAliyunCloudMonitorFullAccess-- full access to Cloud Monitor
To grant these permissions, see Grant permissions to a RAM user.
Add the data source to self-managed Grafana
Configure the Prometheus data source
Log on to your Grafana instance as an administrator.
Click the
icon in the upper-left corner. In the left navigation pane, choose Configuration > Data sources.NoteThis menu is visible only to administrators.
Click + Add data source, then select Prometheus.
On the Settings tab, configure the following fields:
Field Value Name A descriptive name for this data source Prometheus server URL The HTTP API URL copied from the Get the HTTP API URL step Configure authentication based on your Prometheus version: Prometheus V1: If you generated a token, click + Add header in the Custom HTTP Headers section. Set the Header to
Authorizationand the Value to the token from the Set up authentication step. Prometheus V2: Turn on Basic auth. Set User to your AccessKey ID and Password to your AccessKey secret.
Click Save & test.
Verify the data source
Click the
icon in the upper-left corner, and then click Dashboards in the left navigation pane.Click New > New dashboard, then click + Add visualization.
On the Select data source page, select the data source you configured.
In the Query tab, enter a metric name in the Metrics field and a label filter in the Label filters field. Click Run queries. If a chart appears, the data source is connected. If no chart appears, see Troubleshooting.
Query Prometheus data with the HTTP API
The standard Prometheus HTTP API supports programmatic access to monitoring data.
Request format
Authentication headers differ between V1 and V2.
Prometheus V1:
GET <http-api-url>/api/v1/query
Accept: application/json
Content-Type: application/json
Authorization: <your-auth-token>
{
"query": "arms_prometheus_target_interval_length_seconds_sum",
"time": "1635302655",
"timeout": "1000"
}Prometheus V2:
GET <http-api-url>/api/v1/query
Accept: application/json
Content-Type: application/json
Authorization: Basic <base64-encoded-accesskey-id:accesskey-secret>
{
"query": "arms_prometheus_target_interval_length_seconds_sum",
"time": "1635302655",
"timeout": "1000"
}Replace the following placeholders with actual values:
| Placeholder | Description | Example |
|---|---|---|
<http-api-url> | The HTTP API URL from the Settings tab | https://cn-hangzhou.arms.aliyuncs.com/... |
<your-auth-token> | (V1) The token generated in the console | eyJhbGci... |
<base64-encoded-accesskey-id:accesskey-secret> | (V2) Base64-encoded AccessKeyID:AccessKeySecret | TFRBSTV0WH... |
Troubleshooting
| Symptom | Possible cause | Solution |
|---|---|---|
| Save & test fails with an authentication error | (V1) Invalid or missing token in the Authorization header | Regenerate the token on the Settings tab and update the Custom HTTP Headers value |
| Save & test fails with an authentication error | (V2) Incorrect AccessKey ID or AccessKey secret | Verify the credentials. Make sure the RAM user has AliyunPrometheusMetricReadAccess or AliyunCloudMonitorFullAccess permission |
| Save & test fails with a connection error | Incorrect HTTP API URL or network connectivity issue | Confirm the URL on the Settings tab. If you use an internal URL, make sure your Grafana instance can reach the internal endpoint |
| Query returns no data | The Prometheus instance has no monitoring data yet, or the metric name is incorrect | Make sure the Prometheus instance is actively scraping targets and check the metric name |
API request returns 401 Unauthorized | (V1) Missing token | Generate a new token and include it in the Authorization header |
API request returns 403 Forbidden | (V2) The RAM user lacks the required permissions | Grant AliyunPrometheusMetricReadAccess to the RAM user |
What's next
Explore the full Prometheus HTTP API reference for advanced queries including range queries, label lookups, and metadata endpoints
Set up Alibaba Cloud Managed Service for Grafana as an alternative to self-managed Grafana