---
title: "13. Tenant Admin Metrics Access (API & Prometheus)"
slug: "13-tenant-admin-metrics-access-api-prometheus"
description: "Securely access tenant-admin metrics with the VAST REST API and Prometheus using API tokens—authenticate efficiently and scope database requests securely."
updated: 2026-10-28T19:54:28Z
published: 2026-10-28T19:54:28Z
canonical: "docs.vastdata.com/13-tenant-admin-metrics-access-api-prometheus"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 13. Tenant Admin Metrics Access (API & Prometheus)

Tenant Admin users can access their tenant’s VAST REST API and Prometheus metrics securely using API tokens. API tokens eliminate the need to pass a username and password for every request and are officially supported beginning with VAST 5.3.

All API calls authenticated via tenant API tokens are automatically scoped to that tenant’s data - even if a `tenant_id` query parameter is specified.

## Prerequisites

Assuming that the following tenant and tenant admin user are already defined in the cluster:

- Tenant name: `tenant-A`
- Tenant Admin user: `tenantA-user1`

Other assumptions:

- VMS address: `vast-server-example`
- Installed and configured `vastpy-cli`(see vastpy GitHub README for installation and setup instructions - references below).

## Set environment variables

```plaintext
export VMS_ADDRESS="vast-server-example"
export VMS_TENANT_NAME="tenant-A"
export VMS_USER="tenantA-user1"
export VMS_PASSWORD='******'
```

## Create an API Token (Tenant Admin)

Run the following command:

```plaintext
vastpy-cli post /apitokens
```

Example output:

```plaintext
property | value
---------+------------------------------------------+
id       | s7FgCdjF
token    | s7FgCdjF.PT3QPRpL6HhOy5hq6kH8cV8NkpWhVlJq
```

## Use the API Token in REST API calls

All REST API endpoints support API token authentication (replace `<TOKEN>` with the value from the step above).

Example test access with API Token – list tenant views:

```plaintext
TOKEN="s7FgCdjF.PT3QPRpL6HhOy5hq6kH8cV8NkpWhVlJq"

curl -sk -H "Authorization: Api-Token $TOKEN" \
  "https://vast-server-example/api/latest/views/?fields=path,alias,protocols,tenant_id,tenant_name,id&page=1&page_size=100" | jq
```

Expected output:

```plaintext
[
  {
    "id": 143,
    "tenant_name": "tenant-A",
    "alias": "dataset-view",
    "protocols": ["NFS"],
    "path": "/datasets"
  }
]
```

## Access Prometheus Metrics with Tenant API Token

Prometheus metrics can also be retrieved using the same API token. Tenant tokens automatically scope the output to that tenant’s data.

Example:

```plaintext
curl -sk -H "Authorization: Api-Token $TOKEN" \
  "https://vast-server-example/api/prometheusmetrics/views"
```

Sample output:

```plaintext
# HELP vast_view_physical_capacity View Physical Capacity
# TYPE vast_view_physical_capacity gauge
vast_view_physical_capacity{cluster="ProdCluster",tenant_name="tenant-A",path="/datasets"} 1.2e+12
```

**Note:** The `tenant_id` query parameter is ignored for tenant tokens since access is already restricted to the authenticated tenant.

## Prometheus Setup (Tenant-Scoped Scraping)

Tenant Admins can retrieve Prometheus metrics using their tenant-level username/password along with the required `X-Tenant-Name` header. All returned metrics are automatically scoped to that tenant.

Once a Tenant Admin can retrieve metrics via the REST API, the same credentials can be used for Prometheus.

VAST exposes Prometheus metrics under:

- `/api/prometheusmetrics/<category>` (per-area scrapes)
- `/api/prometheusmetrics/all` (full metric set in one scrape)

Common categories include:

- `/api/prometheusmetrics/views`
- `/api/prometheusmetrics/users`
- `/api/prometheusmetrics/quotas`
- `/api/prometheusmetrics/devices`
- `/api/prometheusmetrics/user_connections`
- `/api/prometheusmetrics/` (cluster protocol + system metrics)

## Step 1 – Prometheus Configuration

`prometheus.yml`:

```yaml
global:
  scrape_interval: 1m

scrape_configs:
  - job_name: 'vast-tenantA'
    scheme: https
    scrape_interval: 120s
    scrape_timeout: 90s
    metrics_path: '/api/prometheusmetrics/all'
    static_configs:
      - targets: ['vast-server-example:443']
    http_headers:
      X-Tenant-Name:
        values:
          - "tenant-A"
    basic_auth:
      username: 'tenantA-user1'
      password: '******'
    tls_config:
      insecure_skip_verify: true    # only for self-signed certificates
```

## Step 2 – Restart Prometheus

```plaintext
pkill prometheus || true
prometheus --config.file=prometheus.yml &
```

## Step 3 – Verify the Target

Open:

```plaintext
http://localhost:9090/targets
```

You should see:

![The screenshot shows the Prometheus interface displaying the "Targets" page, where the status and health of monitored endpoints can be managed. The endpoint listed is "vast-acme-tenant," with labels indicating it's running on instance 10.27.200.60:443. -- This summary highlights that the screen captures Prometheus’s target management interface, detailing one specific endpoint along with its associated labels and state information.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/97581627-ec4e-42d5-8a19-723d66c4a509.png?sv=2026-02-06&spr=https&st=2026-11-08T08%3A56%3A16Z&se=2026-11-08T09%3A56%3A16Z&sr=c&sp=r&sig=twEtW67IiDbRQ6zybEfTcwJVi68pS0HhxFu9W%2FOzRO8%3D)

This confirms that:

- Tenant Admin authentication is working
- Metrics are correctly scoped to **tenant-A**

## Step 4 – Query Metrics in Prometheus

![The screenshot shows the Prometheus query interface displaying results from a query that filters vast logical capacity data by tenant name "acme," indicating no current values for the specified metrics in this example.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/8e990629-c399-448e-a2c0-5fb9bb85c0e5.png?sv=2026-02-06&spr=https&st=2026-11-08T08%3A56%3A16Z&se=2026-11-08T09%3A56%3A16Z&sr=c&sp=r&sig=twEtW67IiDbRQ6zybEfTcwJVi68pS0HhxFu9W%2FOzRO8%3D)

Example PromQL queries:

```plaintext
vast_view_logical_capacity{tenant_name="tenant-A"}
```

```plaintext
rate(vast_view_metrics_ViewMetrics_read_bw_sum{tenant_name="tenant-A"}[5m])
```

```plaintext
sum by (path) (
  rate(vast_view_metrics_ViewMetrics_write_bw_sum{tenant_name="tenant-A"}[5m])
)
```

## Grafana Setup for Tenant Metrics

Grafana is used only to visualize metrics that Prometheus has already scraped. Grafana never connects directly to VAST and requires no tenant headers or authentication - tenant scoping is handled entirely by Prometheus.

Before configuring Grafana, ensure it is installed and running: Follow Grafana’s official installation instructions: 🔗 [https://grafana.com/docs/grafana/latest/setup-grafana/installation/](https://grafana.com/docs/grafana/latest/setup-grafana/installation/)

Once Grafana is running, open:

```plaintext
http://localhost:3000
```

Default credentials: - user: admin - password: admin (you will be forced to change it on first login)

## 1. Add Prometheus as a Data Source

Grafana connects only to your local Prometheus, not to VAST.

In Grafana:

1. Go to **Home → Connections → Data Sources**
2. Click **Add data source**
3. Select **Prometheus**

Configure:

| Setting | Value |
| --- | --- |
| **URL** | `http://localhost:9090` |
| **Auth** | None |
| **Custom Headers** | Leave empty |
| **Other settings** | Defaults |

Click **Save & Test** (You should see: **"Data source is working"**)

## 2. Import VAST Dashboards

VAST provides official, prebuilt Grafana dashboards:

🔗 [https://github.com/vast-data/vast-grafana-dashboards/tree/main/dashboards/5.3.0](https://github.com/vast-data/vast-grafana-dashboards/tree/main/dashboards/5.3.0)

As a **Tenant Admin**, you can import and view the following dashboards:

- Alarms
- Events
- Data Protection
- Identity Policies
- Views & Quotas
- User Query
- Top Actors – Users
- Top Actors – Views

(Cluster-wide dashboards such as “Top Actors – Tenants” require Unlimited Super Admin access.)

### To import a dashboard:

In Grafana:

1. Go to **Dashboards → New → Import**
2. Upload any `.json` file from the VAST dashboard repository (e.g., `Top Actors - Views.json`, `Views & Quotas.json`, etc.)
3. Select your Prometheus data source
4. Click **Import**

---

## References and Documentation

- Managing VMS API Tokens — [Managing VMS API Tokens (VAST Support)](/docs-5-5/docs/managing-vms-api-tokens)
- CLI command reference — [apitoken create (VAST CLI Reference)](/docs-5-5/docs/apitoken-create)
- vastpy SDK & examples — [vastpy GitHub README](https://github.com/vast-data/vastpy?tab=readme-ov-file)