slug: grafana-com
provider: Grafana
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 12
edges:
- tag: access_control
  spec_file: grafana-com-access-control-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.85
  evidence: POST /access-control/roles 'Create a new custom role'; PUT /access-control/roles/{roleUID}/assignments
    'Set role assignments'; schemas Permission, SetResourcePermissionCommand, RoleDTO
  reason: Role definition, role assignment and resource permission management is unambiguously role-based
    access control, i.e. Identity & Access Management.
- tag: admin_users
  spec_file: grafana-com-admin-users-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.85
  evidence: POST /admin/users 'Create new user'; PUT /admin/users/{user_id}/password 'Set password for
    user'; PUT /admin/users/{user_id}/permissions 'Set permissions for user'; POST /admin/users/{user_id}/revoke-auth-token
  reason: Administrative account lifecycle — create, enable/disable, delete, set password and permissions,
    revoke sessions/tokens — is the joiner-mover-leaver and credential side of Identity & Access Management.
- tag: admin_ldap
  spec_file: grafana-com-admin-ldap-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.8
  evidence: POST /admin/ldap/sync/{user_id} 'Enables a single Grafana user to be synchronized against
    LDAP'; GET /admin/ldap-sync-status 'current state of the LDAP background sync integration'
  reason: Directory integration and user synchronisation against LDAP servers is directory-based identity
    federation and account provisioning — Identity & Access Management.
- tag: recording_rules
  spec_file: grafana-com-recording-rules-api-openapi.yml
  capability_id: BC-4220.20
  capability_id_l1: BC-4220
  capability_name: Observability Management
  confidence: 0.8
  evidence: POST /recording-rules  createRecordingRule  Create a recording rule that is then registered
    and started; GET /recording-rules/writer  Return the prometheus remote write target
  reason: Prometheus recording rules and remote-write targets are metrics pipeline configuration — squarely
    the logs/metrics/traces instrumentation of Observability Management.
- tag: service_accounts
  spec_file: grafana-com-service-accounts-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.75
  evidence: POST /serviceaccounts  createServiceAccount; POST /serviceaccounts/{serviceAccountId}/tokens  CreateNewToken
    adds a token to a service account
  reason: Lifecycle of machine identities and their API tokens within the platform — identity and access
    administration. Not an observability function.
- tag: Dashboards
  spec_file: grafana-com-dashboards-api-openapi.yml
  capability_id: BC-4220.20
  capability_id_l1: BC-4220
  capability_name: Observability Management
  confidence: 0.7
  evidence: 'POST /dashboards/db  postDashboard  Create / Update dashboard; vendor: "visualize, query,
    alert on, and explore their metrics, logs, traces, and profiles"'
  reason: Dashboard lifecycle in Grafana is the visualisation surface for metrics, logs and traces, which
    is the observability capability. Some residual ambiguity with general analytics/BI reporting, hence
    0.7 rather than higher.
- tag: Permissions
  spec_file: grafana-com-permissions-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: GET /dashboards/uid/{uid}/permissions  Gets all existing permissions for the given dashboard;
    POST /folders/{folder_uid}/permissions  updateFolderPermissions; schema DashboardACLUpdateItem
  reason: Reads and updates access control lists on dashboards and folders — authorisation/access rights
    administration, which is identity & access management rather than any industry capability.
- tag: Reports
  spec_file: grafana-com-reports-api-openapi.yml
  capability_id: BC-610.50
  capability_id_l1: BC-610
  capability_name: Analytics & BI Management
  confidence: 0.7
  evidence: POST /reports  createReport  Create a report; GET /reports/render/pdfs  renderReportPDFs  Render
    report for multiple dashboards; POST /reports/email  sendReport  Send a report; schema ReportSchedule
  reason: Creates, schedules, renders (PDF/CSV) and emails dashboard-based reports — reporting and BI
    content delivery. Not statutory/financial reporting; it is analytics report distribution.
- tag: SAML
  spec_file: grafana-com-saml-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: POST /saml/acs — 'It performs Assertion Consumer Service (ACS)'; GET /saml/metadata — 'exposes
    the SP (Grafana's) metadata for the IdP's consumption'; GET /logout/saml 'GetLogout initiates single
    logout process'
  reason: The operations implement SAML single sign-on and single logout between Grafana (service provider)
    and an identity provider — federated authentication, i.e. identity and access management. It is authentication
    plumbing, but IAM/federation is an explicitly listed capability, so a moderate-confidence edge is
    warranted rather than a strong one.
- tag: Users
  spec_file: grafana-com-users-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: GET /users/lookup 'Get user by login or email'; PUT /users/{user_id} 'Update user'; GET /users/{user_id}/orgs
    'Get organizations for user'
  reason: Lifecycle and lookup of platform user accounts and their org/team affiliations — identity and
    access administration for the Grafana instance, not HR employee records.
- tag: sso_settings
  spec_file: grafana-com-sso-settings-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: PUT /v1/sso-settings/{key}  updateProviderSettings  Update SSO Settings
  reason: Configuration of single sign-on identity providers is identity federation administration, a
    recognised part of Identity & Access Management. Schemas are generic, so confidence is not maximal.
- tag: sync_team_groups
  spec_file: grafana-com-sync-team-groups-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: POST /teams/{teamId}/groups  addTeamGroupApi  Add External Group; schema TeamGroupMapping
  reason: Mapping external directory groups to Grafana teams drives access assignment from a federated
    identity source — Identity & Access Management (group/role provisioning).