> ## Documentation Index
> Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prometheus

Connect any Prometheus-compatible metrics endpoint to Athena — Prometheus,
Grafana Mimir, Thanos, Cortex, or a Grafana datasource proxy — to explore metric
families and run PromQL from chat.

<Info>
  Any member can add an endpoint — no workspace-admin setup is required. Unlike
  the OAuth connectors, a Prometheus connection is **shareable**: a Prometheus
  endpoint is normally reached with a single service-account credential that
  carries no per-user identity, so if you share the connection with a colleague,
  their queries run with the credential you stored. See
  [Sharing a connection](#sharing-a-connection) before you share.
</Info>

## What connecting Prometheus unlocks

* **List metrics** available on the endpoint.
* **Describe a metric** — its labels, type, and help text.
* **Run PromQL** instant and range queries from chat.

## Before you connect

You need, from whoever operates your metrics stack:

* The **base URL** of the endpoint, e.g. `https://mimir.example.com`.
* The **API path prefix** that comes before `/api/v1`, if any — `/prometheus` for
  Mimir, blank for vanilla Prometheus.
* **Credentials**, if the endpoint isn't open: a bearer token, a username and
  password, or OAuth 2.0 client-credentials details (token URL, client ID, client
  secret, optional scopes).
* The **tenant org ID**, if the backend requires one — sent as the `X-Scope-OrgID`
  header. Mimir and Cortex need it when multi-tenancy is enabled; leave it blank
  otherwise.
* Network reachability: the endpoint must be reachable from the public internet.
  If it sits behind an allowlist, ask your operators to permit Athena's egress IP
  — contact [team@athenaintel.com](mailto:team@athenaintel.com) for the current
  value.

## Connect

<Steps>
  <Step title="Open the connect dialog">
    Go to **[Integrations](https://app.athenaintel.com/dashboard/integrations/)**
    and click **Prometheus → Connect**.
  </Step>

  <Step title="Enter the endpoint">
    Fill in the **Base URL** (host only) and the **API path prefix** if your
    backend needs one. A bare `host:port` is promoted to `https://` — plain HTTP
    is not used silently.
  </Step>

  <Step title="Choose authentication">
    Pick **None**, **Bearer token**, **Basic** (username and password), or
    **OAuth 2.0 client credentials**, and fill in the fields shown. Secrets are
    encrypted at rest and never returned to the browser.
  </Step>

  <Step title="Add a tenant ID if needed">
    If your Mimir or Cortex deployment requires `X-Scope-OrgID`, enter the
    **Tenant org ID** and Athena sends it as that header on every request. Leave
    it blank if the deployment has multi-tenancy disabled.
  </Step>

  <Step title="Save">
    Optionally give the connection a **Display name**, then connect. You can
    connect several endpoints — one catalog each. The connection is private to
    you until you explicitly share it.
  </Step>
</Steps>

## Sharing a connection

A Prometheus connection is private until you grant someone access to it. Once you
do, their queries are executed with **your** stored credential, which means they
can read **every metric the credential can see** in that tenant — Athena cannot
narrow it down per person, because the credential carries no per-user identity to
narrow against. Members with no grant are denied outright and never fall back to
your credential.

<Note>
  Treat sharing a Prometheus connection as handing over read access to the whole
  tenant that credential covers. If different groups should see different
  metrics, provision a separate credential per group — scoped by tenant org ID on
  Mimir or Cortex, or by a narrower token — and connect each one separately.
</Note>

<Tip>
  Secrets are encrypted at rest, never returned to the browser, and the
  connection can be disconnected at any time from the Integrations page.
</Tip>

## Troubleshooting

| Symptom                                   | Cause and fix                                                                                                  |
| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| `401` or `403` from the endpoint          | Wrong or expired credentials, or the token lacks read access to the metrics API.                               |
| Queries return no data on Mimir or Cortex | A multi-tenant deployment got a missing or wrong **Tenant org ID**, so the request landed in the wrong tenant. |
| `404` on every query                      | The **API path prefix** is wrong. Mimir usually needs `/prometheus`; vanilla Prometheus needs none.            |
| Connection times out                      | The endpoint isn't reachable from the public internet, or an allowlist is blocking Athena's egress IP.         |