How to Enable QAN permissions for service accounts in PMM

1

I have created a service account on pmm server using UI.

Generated a token for this service account, and now want to use the API using token to fetch queres.

curl -H “Authorization: Bearer token_xxxxxx” “https://pmm-prod.xyz.com/v1/queries/summary”
{“code”:7,“error”:“Access denied.”,“message”:“Access denied.”}

Any help or suggestions will help me a lot.

2

Hi,

There is no endpoint exist like “v1/queries/summary”.
You can find the available endpoints here: https://pmm-prod.xyz.com/swagger

Thanks,

Tibi

3

Hi,

Thanks for the reply. Yes I can access swager and it works.

But does it mean that The REST layer is NOT enabled for QAN data in PMM.

Regards

Ulhas

4

Hi,

Check out “swagger#/QANService” , those are the QAN endpoints.
Use those endpoints to get query data from QAN.

Thanks.

5

Hi,

I tried this:

Curl

curl -X 'POST' \
  'https://pmm-prod.db.xyz.com/v1/qan/metrics:getFilters' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "period_start_from": "2026-07-08T11:55:20.634Z",
  "period_start_to": "2026-07-08T11:55:20.634Z",
  "main_metric_name": "string",
  "labels": [
    {
      "key": "string",
      "value": [
        "string"
      ]
    }
  ]
}'

Request URL

https://pmm-prod.db.xyz.com/v1/qan/metrics:getFilters

Server response

Code Details
500

Error: response status is 500

Response body

Download

{
  "code": 13,
  "message": "Internal server error.",
  "details": []
}
Response headers
 content-length: 72  content-type: application/json  date: Wed,08 Jul 2026 12:32:54 GMT  server: nginx  strict-transport-security: max-age=63072000; includeSubdomains;

Responses

6

Because it needs more information, here is a working version:
curl '``https://127.0.0.1/v1/qan:getMetrics``'
-H 'accept: application/json, text/plain, /'
-H 'accept-language: en-US,en;q=0.7'
-H 'content-type: application/json'
-b 'pmm_session=YYYYYYY; grafana_session_expiry=1783516275'
-H 'origin: ``https://127.0.0.1``'
-H 'priority: u=1, i'
-H 'referer: ``https://127.0.0.1/graph/d/pmm-qan/pmm-query-analytics?var-interval=$__auto&orgId=1&from=now-12h&to=now&timezone=browser&var-environment=$__all&var-cluster=$__all&var-region=$__all&var-replication_set=$__all&var-node_name=$__all&var-service_name=$__all&var-database=$__all&var-node_type=$__all&var-service_type=$__all&var-username=$__all&var-schema=$__all&var-filter_data=$__all&var-client_host=All&var-city=All&var-az=All&columns=["load","num_queries","query_time"]&group_by=queryid&order_by=-load&page_number=1&page_size=25&totals=false&details_tab=details``'
-H 'sec-ch-ua: "Brave";v="149", "Chromium";v="149", "Not)A;Brand";v="24"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "macOS"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: same-origin'
-H 'sec-gpc: 1'
-H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36'
--data-raw '{"filter_by":"631449bde44451baadbf4680e13897b3","group_by":"queryid","labels":,"period_start_from":"2026-07-08T02:10:33+02:00","period_start_to":"2026-07-08T14:10:33+02:00","tables":,"totals":false}'
--insecure

Not all these is needed but you can start from here.

7

Will it work with a service account, I see you have suggested -b ‘pmm_session=YYYYYYY; grafana_session_expiry=1783516275’

8

Yes, like this:
-H "Authorization: Bearer $PMM_API_TOKEN"