Grafana SBOM Security Integration

Connect your VAPT Insights project directly to Grafana to visualize software supply chain security metrics across all your repositories with zero additional telemetry infrastructure.

Prerequisites

1. An active VAPT Insights account and Project ID.
2. A running Grafana instance (OSS, Cloud, or Enterprise).
3. The official Infinity Datasource Plugin installed in Grafana.

Step 1: Copy Project ID & Generate an API Key

1. Log in to your VAPT Insights Console.
2. Copy your Project ID (UUID) from your browser URL or Project Settings (e.g. d2e3fedf-546e-4e5f-b080-690afeb872e7).
3. Navigate to Project Settings → API Keys (or click Create Token on the Grafana card in Project Integrations).
4. Click Generate Token:
   • Token Label: Grafana Dashboard
   • Target Project: Select your project
   • Permission Scope: Select Metrics & Observability (Grafana / CI) or Full Access (SBOM & Metrics)
5. Copy and securely store your API token (vapt_live_...).

Step 2: Install and Configure the Infinity Plugin

1. In your Grafana instance, navigate to Administration → Plugins.
2. Search for Infinity and click Install.
3. Go to Connections → Data Sources → Add new data source and select Infinity.
4. Configure the datasource settings:
   • Name: VAPT Insights (or select default Infinity)
   • Server / Base URL:

     https://svc.vaptinsights.com

   • Security / Allowed Hosts:
     • Under the Security tab, add https://svc.vaptinsights.com (or svc.vaptinsights.com) to permit Grafana Cloud/Server to make outbound API requests.
   • Under Custom HTTP Headers (or Auth):
     • Header: X-API-Key
     • Value: <YOUR_VAPT_API_KEY>
5. Click Save & Test (Confirm green checkmark showing Data source is working).

Step 3: Import the Pre-Built Dashboard & Set Project ID

You can import the pre-configured VAPT Insights Dashboard template into Grafana in one click:

1. Download the official dashboard template:
   • Download vaptinsights-sbom-grafana-dashboard.json
2. In Grafana, click Dashboards → New → Import.
3. Upload the downloaded .json file.
4. Select your Infinity data source.
5. In the dashboard top variable bar, paste your Project ID into the Project ID input box.
6. Click the Save icon (💾) in the top-right corner, check "Save current variable values as dashboard default", and click Save.

Troubleshooting

1. "requested URL not allowed" or https:///...

• Cause: The Base URL was left blank in the Infinity Data Source settings.
• Solution: Open Connections → Data Sources → Infinity, set Server URL to https://svc.vaptinsights.com, and add https://svc.vaptinsights.com to Allowed Hosts in the Security tab.

2. Dashboard panels show "No data"

• Cause: The Project ID variable at the top of the dashboard is empty or still contains the placeholder text PROJECT_ID.
• Solution: Paste your valid Project UUID (e.g. d2e3fedf-546e-4e5f-b080-690afeb872e7) into the Project ID textbox at the top of the dashboard and press Enter.

Public Security Metrics API Reference

You can also query the Security Metrics REST endpoint directly in your CI/CD pipelines, custom scripts, or terminal:

GET https://svc.vaptinsights.com/api/v1/public/projects/{projectId}/metrics/sbom

Headers

X-API-Key: vapt_live_...
# OR
Authorization: Bearer vapt_live_...

Query Parameters

Example JSON Response

{
  "project": {
    "id": "4f882707-1f41-45cd-be72-32e3f4c6e2a5",
    "name": "Acme Core Platform"
  },
  "updated_at": "2026-09-07T16:30:00Z",
  "summary": {
    "repositories": 2,
    "total_dependencies": 332,
    "total_vulnerabilities": 55,
    "critical": 3,
    "high": 9,
    "medium": 23,
    "low": 20
  },
  "repositories": [
    {
      "id": "c1f729e2-8924-4c8d-9720-3329188eef01",
      "name": "backend",
      "branch": "main",
      "total_dependencies": 142,
      "summary": {
        "total": 35,
        "critical": 2,
        "high": 7,
        "medium": 15,
        "low": 11
      },
      "updated_at": "2026-09-07T16:25:00Z"
    }
  ],
  "trends": [
    {
      "date": "2026-09-01",
      "total": 50,
      "critical": 2,
      "high": 8,
      "medium": 20,
      "low": 20
    }
  ]
}