Skip to main content
Connect any Prometheus-compatible metrics endpoint to Athena — Prometheus, Grafana Mimir, Thanos, Cortex, or a Grafana datasource proxy — to explore metric families and run PromQL from chat.
Any member can add an endpoint — no workspace-admin setup is required. Unlike the OAuth connectors, a Prometheus connection is shareable: a Prometheus endpoint is normally reached with a single service-account credential that carries no per-user identity, so if you share the connection with a colleague, their queries run with the credential you stored. See Sharing a connection before you share.

​
What connecting Prometheus unlocks

  • List metrics available on the endpoint.
  • Describe a metric — its labels, type, and help text.
  • Run PromQL instant and range queries from chat.

​
Before you connect

You need, from whoever operates your metrics stack:
  • The base URL of the endpoint, e.g. https://mimir.example.com.
  • The API path prefix that comes before /api/v1, if any — /prometheus for Mimir, blank for vanilla Prometheus.
  • Credentials, if the endpoint isn’t open: a bearer token, a username and password, or OAuth 2.0 client-credentials details (token URL, client ID, client secret, optional scopes).
  • The tenant org ID, if the backend requires one — sent as the X-Scope-OrgID header. Mimir and Cortex need it when multi-tenancy is enabled; leave it blank otherwise.
  • Network reachability: the endpoint must be reachable from the public internet. If it sits behind an allowlist, ask your operators to permit Athena’s egress IP — contact team@athenaintel.com for the current value.

​
Connect

1

Open the connect dialog

Go to Integrations and click Prometheus → Connect.
2

Enter the endpoint

Fill in the Base URL (host only) and the API path prefix if your backend needs one. A bare host:port is promoted to https:// — plain HTTP is not used silently.
3

Choose authentication

Pick None, Bearer token, Basic (username and password), or OAuth 2.0 client credentials, and fill in the fields shown. Secrets are encrypted at rest and never returned to the browser.
4

Add a tenant ID if needed

If your Mimir or Cortex deployment requires X-Scope-OrgID, enter the Tenant org ID and Athena sends it as that header on every request. Leave it blank if the deployment has multi-tenancy disabled.
5

Save

Optionally give the connection a Display name, then connect. You can connect several endpoints — one catalog each. The connection is private to you until you explicitly share it.

​
Sharing a connection

A Prometheus connection is private until you grant someone access to it. Once you do, their queries are executed with your stored credential, which means they can read every metric the credential can see in that tenant — Athena cannot narrow it down per person, because the credential carries no per-user identity to narrow against. Members with no grant are denied outright and never fall back to your credential.
Treat sharing a Prometheus connection as handing over read access to the whole tenant that credential covers. If different groups should see different metrics, provision a separate credential per group — scoped by tenant org ID on Mimir or Cortex, or by a narrower token — and connect each one separately.
Secrets are encrypted at rest, never returned to the browser, and the connection can be disconnected at any time from the Integrations page.

​
Troubleshooting