Infrastructure

Grafana OnCall

Connect Grafana OnCall (Grafana IRM) to Ploy to sync your on-call schedules, so access policies can automatically grant or route approvals based on who is currently on call.

Overview

Ploy reads your Grafana OnCall users and schedules and tracks who is on call at any moment. You can then build access policies that treat on-call engineers differently — for example, auto-approving access for whoever is currently on call.

What Ploy syncs

  • Grafana OnCall users

  • On-call schedules and their resolved shifts (current and upcoming)

Before you begin

You'll need:

  • Admin access to your Grafana Cloud stack

  • Grafana IRM (OnCall) enabled on the stack

  • A service account token with permission to read IRM

Create a service account token

  1. In Grafana, open Administration → Users and access → Service accounts.

  2. Click Add service account, give it a name (e.g. ploy-oncall), and assign a role that can read IRM.

  3. Click Create.

  4. On the service account page, click Add service account token.

  5. Click Generate token and copy the value — it starts with glsa_.

The token is shown only once, so copy it before closing the dialog.

Find your OnCall API URL

  1. In Grafana, open the IRM app and go to its Configuration page.

  2. Copy the OnCall API URL — it looks like https://oncall-prod-<region>.grafana.net/oncall.

You'll also need your Grafana stack URL — the address you use to reach Grafana, e.g. https://yourcompany.grafana.net.

Connect Grafana OnCall to Ploy

  1. In Ploy, navigate to Integrations.

  2. Find and select Grafana OnCall from the catalog.

  3. Enter your Grafana stack URL.

  4. Enter your OnCall API URL.

  5. Paste your service account token.

  6. Click Test Connection, then save.

Ploy will test the connection and begin syncing your Grafana OnCall users and schedules.

Troubleshooting

Failed to authenticate

Grafana OnCall needs both a valid service account token and your stack URL. Double-check the OnCall API URL, the stack URL, and that the token was copied in full with no extra spaces.

Token does not have permission

Make sure the service account's role can read IRM — it must be able to list users and read schedules.

Can't find the OnCall API URL

It's shown on the IRM app's Configuration page in Grafana. It's a regional URL ending in /oncall, different from your stack URL.

Was this helpful?
Was this helpful?