Grafana Infinity (JSON/CSV/GraphQL/REST) Data Source Prompt

You are a senior observability engineer who has built Grafana panels from arbitrary REST and JSON APIs using the Infinity data source plugin.

I will provide:
- The API endpoint(s) and response shape
- Auth requirements (API key, bearer, basic)
- Panels or tables to build

Your job:

1. **Install/enable Infinity** (`yesoreyeram-infinity-datasource`) and set the base URL and default auth in the datasource config.
2. **Pick the parser**: JSON, CSV, GraphQL, or XML; set the response Type and Format (Table vs Time series).
3. **Root selector**: use the Rows/Root path (e.g. `data.items`) to point at the array to tabulate.
4. **Columns**: map each column with a Selector (JSONata/dot path like `metadata.name`), a Title, and a Type (string/number/timestamp).
5. **Auth and security**: store secrets in `secureJsonData`, allow-list hosts via `allowedHosts`, and prefer header auth over URL query keys.
6. **Pagination**: use Infinity's pagination options (offset/page/cursor) so panels return complete data.
7. **Time series**: designate a timestamp column and a numeric column, and set the time format so Grafana parses it.
8. **Provisioning**: express the datasource in YAML with `allowedHosts` and secure auth.

Mark DESTRUCTIVE: hitting a rate-limited or paid API on a short refresh, leaking API keys in the URL, allow-listing overly broad hosts.

---

API endpoint(s)/shape: [DESCRIBE]
Auth requirements: [DESCRIBE]
Panels/tables: [DESCRIBE]

Why this prompt works

The Infinity plugin can visualize almost any API, which is exactly why it is easy to misuse — secrets end up in URLs, root selectors point at the wrong node, and columns come back untyped. This prompt forces a disciplined path: parser choice, root selector, typed columns, and locked-down auth with host allow-listing.

How to use it

1. Paste a sample response so the assistant can derive the root selector and column paths.
2. State the auth scheme so it uses header auth in secureJsonData.
3. Specify Table vs Time series so it sets the format and timestamp column.
4. Ask for allowedHosts and provisioning YAML.

Useful commands

# Install the Infinity plugin
grafana-cli plugins install yesoreyeram-infinity-datasource

# Inspect the API response shape to derive selectors
curl -s -H "Authorization: Bearer $API_TOKEN" \
  https://api.example.com/v1/items | jq '.data.items[0]'

# Health-check the datasource
curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" \
  http://localhost:3000/api/datasources/uid/infinity-api/health

Example config

# provisioning/datasources/infinity.yaml
apiVersion: 1
datasources:
  - name: Infinity API
    type: yesoreyeram-infinity-datasource
    uid: infinity-api
    access: proxy
    jsonData:
      auth_method: bearerToken
      allowedHosts:
        - https://api.example.com
      httpHeaderName1: X-Client
      httpMode: GET
    secureJsonData:
      bearerToken: ${API_TOKEN}

// Panel target: tabulate items from a REST endpoint
{
  "type": "json",
  "source": "url",
  "format": "table",
  "url": "https://api.example.com/v1/items",
  "root_selector": "data.items",
  "columns": [
    { "selector": "metadata.name", "text": "Name", "type": "string" },
    { "selector": "status.replicas", "text": "Replicas", "type": "number" },
    { "selector": "metadata.createdAt", "text": "Created", "type": "timestamp" }
  ]
}

Common findings this catches

• Empty tables → wrong root_selector path.
• Secret leakage → API key placed in the URL, not headers.
• SSRF exposure → allowedHosts too broad or unset.
• Bad sorting → numeric column typed as string.
• Truncated data → pagination not configured.
• Time parse failure → timestamp column format not set.
• CORS errors → browser parse mode where backend is needed.

When to escalate

• API rate limits or cost from dashboard traffic — coordinate with the API owner.
• SSRF/security concerns with allow-listed hosts — security review.
• Large-scale ETL that outgrows Infinity — move to a proper pipeline.