Skip to main content
Connect Prometheus so CloudThinker can run PromQL queries, list metrics and labels, check scrape-target health, and read active alerts and alert rules. The connection is read-only and authenticates with no auth, a bearer token, or HTTP Basic auth.

​
Supported platforms

The rule: the endpoint must answer <your URL>/api/v1/query at the root of its address, with no auth, a bearer token, or HTTP Basic auth.

​
Prerequisites

  • A Prometheus HTTP API reachable from the internet. Connections run from CloudThinker Cloud, not from inside your network.
  • A publicly trusted TLS certificate if the URL uses HTTPS. There’s no field to add a private CA.
  • A bearer token or a username and password, if a proxy or gateway in front of Prometheus requires one.
  • Permission to add connections in your CloudThinker workspace.
Prometheus inside Kubernetes on a private address? Expose it through an ingress with TLS and an auth proxy that checks a bearer token or Basic auth, then allowlist CloudThinker’s egress IPs. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options.
The URL can’t include a path. An endpoint that only answers under a prefix, such as https://metrics.example.com/prometheus/api/v1, fails the connection test. Expose the API at the root of a hostname instead.

​
Setup

1

Find the base URL

Use the address you’d put in front of /api/v1, with no path and no trailing slash, for example https://prometheus.example.com or http://prometheus.example.com:9090.Check it from a terminal before you connect:
Run it from a machine outside your network, with the same credentials you’ll give CloudThinker.Success state: the response starts with {"status":"success","data":{"resultType":"vector".
2

Pick an auth mode

Prometheus exposes its loaded config, internal hostnames, and target addresses to anyone who can reach it. Use None only behind a firewall rule that allows just CloudThinker’s egress IPs. Never use None on an endpoint open to the whole internet.
3

Add the connection

In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select Prometheus. Fill in:
  • Alias (optional): a short name such as prod-metrics. Lowercase letters, numbers, and hyphens.
  • Description (optional): what this Prometheus covers. Agents read it to pick the right instance when you connect more than one.
  • PROMETHEUS_URL: the base URL from step 1.
  • PROMETHEUS_AUTH_TYPE: None, Bearer Token, or Basic Auth, then the credential fields that appear.
  • LOG_LEVEL: leave at Info.
Click Connect. CloudThinker runs count(up) against the endpoint, shows Connecting and Verifying, then a Connected status. If verification fails, it shows Failed and an error message appears. Match the message to Troubleshooting.

​
Connection details

​
Required permissions

Prometheus has no built-in user permissions, so access is whatever your proxy or gateway allows. CloudThinker needs read (GET) access under /api/v1/ for:
If your proxy supports it, give CloudThinker its own token limited to GET requests under /api/v1/. Nothing in the connection writes to Prometheus.

​
Agent capabilities

When a connection first reaches Connected, CloudThinker runs a read-only discovery of the endpoint and saves what it learns for later chats.

​
Verify the connection

A healthy answer gives target counts by state, a firing-alert count, and a few sample metric names from your endpoint.

​
Example prompts

Name the metric and the labels you care about. CloudThinker can list label names, so a prompt like “split by namespace” gets an accurate selector faster. To route Prometheus alerts into Resolve so incidents open automatically, set up a webhook integration.

​
Troubleshooting

The endpoint returned 401 or 403. Check that PROMETHEUS_AUTH_TYPE matches what your proxy expects, then re-enter the token or username and password. A token revoked at the proxy fails the same way.
The endpoint returned 404. The URL most likely has a path, such as /api/v1 or /prometheus. Enter only the scheme, host, and port. If your API only answers under a prefix, it isn’t supported.
Something in front of Prometheus answered instead, usually a login page or an SSO proxy. Point the URL at the API itself, or use a bearer token or Basic auth that the proxy accepts without a browser login.
CloudThinker couldn’t open a connection. Check the hostname, port, and TLS certificate, and that the endpoint accepts traffic from the internet. A private address such as 10.0.0.5 can’t be reached from CloudThinker.
Ask CloudThinker to list metrics matching a name first, so it confirms the metric exists. Then widen the time window, since range queries start at 15 minutes.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • No writes: the connection only reads the Prometheus HTTP API, so a token limited to GET requests is enough.
  • Config holds secrets: /api/v1/status/config can include scrape credentials and internal hostnames. Block that path at your proxy if you don’t want it readable.

Grafana Connection

Dashboards and alert rules on top of your metrics

Kubernetes Connection

Pair metrics with the workloads that produce them