Before you choose a dashboard API, decide which of three jobs you are actually buying. Your team may need to automate dashboards it manages, embed dashboards that customers see inside your product, or simply agree on one definition for each KPI. Each job leads to a different path, and most stalled projects happen when a team tries to solve all three with one tool.
Start with the job, not the API
The three jobs have different users, different risks, and different evaluation criteria. The table below shows how to sort your requirement before you read any vendor documentation.
As an Amazon Associate I earn from qualifying purchases.
| Job | Who uses it | What to evaluate | Documented example in this article |
|---|---|---|---|
| Automate dashboard lifecycle by code | Engineering or platform team | Create, read, update, list, and delete operations; API version; upgrade path | Grafana dashboard API (Grafana 12 and later); Metabase /api/dashboard |
| Embed dashboards for your customers | Tenants of your SaaS product | Embedding mode; how tokens are issued; tenant isolation; plan and SSO requirements | Metabase view-only, interactive, and editable embedded dashboards |
| Keep KPI definitions consistent | Founders, product managers, finance, data staff | Formula, source event or table, time window, and owner for each KPI | Metabase reusable metrics |
If your need is the third row, you do not need a dashboard API at all to start. If it is the first row, customer access rules do not apply to you in the same way. The second row carries the most design work, so most of this article focuses on it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Customer-facing embedding: choose the mode before the code
Metabase documents three embedding modes. They differ in how much a customer can change, and that difference determines your access model.
#1 Best Overall
- Used Book in Good Condition
| Mode | What the customer can do | Documented requirement |
|---|---|---|
| View-only | Looks at a dashboard without changing it | Not stated for this mode in Metabase’s embedding documentation |
| Interactive | Filters and explores the dashboard | Requires SSO; available on Pro and Enterprise plans, whether self-hosted or Cloud |
| Editable | Changes the dashboard | Not stated for this mode in Metabase’s embedding documentation |
Before you pick a mode, write down what each tenant should see. Ask whether users need drill-through, whether they should edit anything, or whether a filtered, read-only view meets the requirement. Editable and interactive modes widen what a customer can reach, so each extra capability needs its own permission check.
Guest embedding: the server decides what each user may open
In guest embedding, your server signs a token, and your app endpoint controls which dashboard a user can access. The request flow works like this:
- Your application authenticates the user and determines the tenant that user belongs to.
- The client asks your server for an embed token for a specific dashboard.
- Your server checks that the requested dashboard belongs to that tenant, then signs a token with the dashboard and any parameters.
- Your endpoint returns the token in the response. Metabase’s documentation is strict about the format: “Your endpoint has to return an object with a single
jwtfield. Return anything else and the embed shows an error instead of the dashboard.” (Metabase documentation, “Embed a dashboard.”)
Step 3 is where most failures happen. Metabase warns that an endpoint that signs whatever dashboard identifier it receives can expose any published dashboard to any signed-in user. If the browser sends dashboard_id=42, your server must confirm that dashboard 42 belongs to the caller’s tenant before it signs anything. Hiding dashboards in the user interface does not count as access control.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build a short test list before launch:
- Sign in as tenant A and request a dashboard owned by tenant B. The request must fail.
- Change the dashboard identifier in the browser and repeat the request.
- Confirm that the token response contains only the
jwtfield. - Check that a signed-out request receives no token.
Dashboard management by code: Grafana and Metabase
If your team manages dashboards programmatically, for example to create the same dashboard for every new environment, two documented APIs are relevant. They solve different problems, and each carries a maintenance note.
Grafana dashboard API
Grafana’s dashboard API reference documents create, update, get, list, and delete operations for dashboards. The reference says the new API structure is available in Grafana 12 and later. It also warns that its endpoint listing may not be the latest. Confirm the Grafana version on your deployment and read the current API reference before you build anything against it. Treat the reference as the starting point for your version, not a guarantee of every endpoint in every release.
Metabase API
Metabase’s API introduction identifies /api/dashboard and /api/embed as relevant endpoints. It also states that the API is unversioned and may change. In Metabase’s words, “The API is subject to change.” (Metabase Learn, “Working with the Metabase API.”) Automation against it is therefore a maintained integration, not a one-time script. Verify each endpoint against the live API documentation for the instance you run.
Maintenance burden: what you own after launch
A dashboard API adds a dependency that your team must keep working. Plan for these costs before you commit:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Pin the vendor version you tested, and record it in your deployment configuration.
- Test dashboard automation against a staging instance before each vendor upgrade.
- Keep the embed token code and its authorization tests in your normal test suite, so a change in the vendor’s token format fails in CI rather than in front of a customer.
- Assign one owner to the integration, because unversioned or fast-moving APIs break quietly when no one is responsible for them.
Vendor documentation does not offer a like-for-like comparison of price or implementation effort between Grafana and Metabase, and the sources used here do not show that the two are interchangeable for every workload. Do not accept a claim that either is the simplest or cheapest option unless you have measured it against your own stack.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Define KPIs before you choose the dashboard
A dashboard does not settle a disagreement over what “active,” “retained,” or “revenue” means. If two teams calculate those words differently, a more attractive dashboard will only display two different numbers more quickly. Settle the definitions first.
Metabase documents reusable metrics as a way to standardize calculations, so teams do not end up with multiple formulas for the same number. Whatever tool you use, write each KPI down with four fields:
- Definition: the rule that decides whether a record counts.
- Source: the event stream or table that supplies the data.
- Time window: the period over which the rule is evaluated.
- Owner: the person who changes the definition when the product changes.
As an illustration only, a weekly active account KPI might read: an account counts if it has at least one qualifying product event in the trailing seven days, where “qualifying” excludes automated background jobs. Your team will need its own event names and exclusions. Once the definition is written, you can decide which dashboard displays it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What “retention” means in this context
The word “retention” in this title needs care. The retention figure in Metabase’s documentation applies to Metabase itself, not to your customers. Metabase documents a default retention of 720 days for its usage-analytics data about activity, views, and query execution. You can change that value with the MB_AUDIT_MAX_RETENTION_DAYS setting, and plan limits apply. The documentation page does not state the year it was published, so check the live page for the value in your version.
Two limits matter here:
- Open Source Edition and Cloud Starter do not collect Activity and View data, so that setting does not describe them.
- The 720-day figure is not a customer retention benchmark, a suggested cohort window, or evidence of how a SaaS product should measure retention.
Customer retention depends on your product’s cadence, contract type, and what “meaningful continued use” means for your customers. Those choices belong in your KPI definitions. No general benchmark for them is established in the sources used here, so do not adopt a percentage or window from any source without checking how it was measured.
Quick Recap
Decision framework
- Your customers will see dashboards. Write the tenant visibility rules first. Choose the embedding mode, then build the server-side authorization check and its tests before you build any interface. Confirm the plan and SSO requirements for the mode you chose.
- Your engineers will manage dashboards as code. Use the vendor API that matches your version. Pin the version, test against staging, and assign an integration owner.
- Your numbers disagree across teams. Stop choosing tools. Write the KPI definitions, owners, and time windows, then connect a dashboard to them.
- You need all three. Keep the definitions in one place, use the embedding path for customer views, and keep internal automation separate so a change in one does not break the other.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
