InfluxDB

Connect InfluxDB 2 or 3 so agents can list buckets or databases, flag infinite retention, and run bounded Flux or SQL reads

Connect an InfluxDB instance to let CloudThinker agents list your buckets or databases, find the ones that keep data forever, and answer questions by querying the time series itself. The connection signs in with one API token, detects whether you run InfluxDB 2 or 3, and is read-only until you turn on Allow writes.

Supported versions

Version	Supported	What agents work with
InfluxDB OSS 2.x	Yes	Buckets inside an organization, queried in Flux
InfluxDB Cloud 2	Yes	Same as OSS 2.x, hosted by InfluxData
InfluxDB 3 Core	Yes	Databases with no organization, queried in SQL
InfluxDB 3 Enterprise	Yes	Same as Core, plus scoped read tokens
InfluxDB 1.x	No	Predates the token API this connection uses
InfluxDB Cloud Dedicated	No	Its management API is a separate product

You don’t pick a version. The Connected message names what CloudThinker found, and agents use Flux or SQL to match.

Prerequisites

• An InfluxDB HTTP API that CloudThinker can reach over HTTPS. Plain http is accepted only on self-hosted CloudThinker deployments.
• For a self-hosted instance behind a firewall, allow CloudThinker’s egress IPs. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options.
• Permission to create an API token with read access to the buckets or databases agents should see.
• On InfluxDB 2: the organization name, if the token reaches more than one.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Setup

InfluxDB 2

1. Create a read token

   In the InfluxDB UI, open Load Data → API Tokens, click Generate API Token, and choose Custom API Token (or Read/Write API Token on older versions). Select the buckets under Read and leave Write empty. Copy the token. InfluxDB shows it once.

2. Add the connection in CloudThinker

   Open More → Workspace settings → Connections and select InfluxDB. Enter:

   • Base URL: scheme, host, and port, such as https://influx.example.com:8086 or https://us-east-1-1.aws.cloud2.influxdata.com
   • API token: the token you copied
   • Organization: only if the token reaches more than one organization

   Click Connect.

   Success state: the connection shows Connected with a message such as InfluxDB 2 connection verified (v2.7.12).

InfluxDB 3

1. Create a token

   On InfluxDB 3 Enterprise, create a resource token that can read only the databases you want. Prefer this when you can. Separate several databases with commas, such as db:telemetry,metrics:read:

   influxdb3 create token --permission "db:telemetry:read" --name cloudthinker
   

   On InfluxDB 3 Core, only admin tokens exist. Create one with the influxdb3 CLI and read Security first:

   influxdb3 create token --admin --name cloudthinker
   

   Copy the token from the output. It’s shown once.

2. Add the connection in CloudThinker

   Open More → Workspace settings → Connections and select InfluxDB. Enter:

   • Base URL: scheme, host, and port, such as https://influx.example.com:8181
   • API token: the token you created
   • Organization: leave blank. InfluxDB 3 has no organizations

   Click Connect.

   Success state: the connection shows Connected with a message naming InfluxDB 3 and its version.

Connection details

Field	Required	Description	Example
Base URL	Yes	Scheme, host, and port of the HTTP API. A reverse-proxy prefix such as /influx is allowed. No query string, fragment, or user:pass@	https://influx.example.com:8086
API token	Yes	A token with read access to the buckets or databases agents should see	<token>
Organization	No	InfluxDB 2 only, when the token reaches more than one organization	my-org

Self-hosted InfluxDB 2 usually listens on 8086, InfluxDB 3 Core on 8181.

Required permissions

Version	Minimum	How to grant it
InfluxDB 2	Read on the buckets agents should see	A token with buckets selected under Read only
InfluxDB 3 Enterprise	Read on the databases agents should see	A resource token scoped to those databases
InfluxDB 3 Core	Not available	Core issues admin tokens only. With Allow writes off, agents still can’t change retention or databases, and they refuse queries that write before anything is sent. The token itself stays admin-capable if it leaks

The token needs write access only if you turn on Allow writes, and then only to change retention or create and delete a bucket or database.

Create a token just for CloudThinker so you can see and revoke its access on its own. If a scoped token matters to you, prefer InfluxDB 2 or InfluxDB 3 Enterprise over Core.

Agent capabilities

Capability	What agents can do
Inventory	List buckets or databases with the retention set on each
Retention review	Name every bucket or database that keeps data forever
One named bucket or database	Confirm a single bucket or database by name, even on large instances
Bounded queries	Answer from the data in Flux (InfluxDB 2) or SQL (InfluxDB 3)

Results have bounds. The inventory reads up to 25 buckets or databases by default. A query returns 50 rows by default, and you can ask for more in your prompt, up to 200. Queries time out after 60 seconds by default, and never run longer than 300. Agents say when a result was cut short. A retention the token can’t read is reported as unreadable, never counted as forever.

Queries stay reads. Agents refuse Flux that writes points or opens outbound connections, and SQL that inserts, updates, or deletes. Nothing is sent to your instance when a query is refused.

Verify the connection

List the InfluxDB buckets or databases and the retention on each

Expect each bucket or database name with its retention, and a list of any that keep data forever.

Example prompts

Which InfluxDB buckets keep their data forever?
How many points were written to the telemetry bucket in the last 24 hours?
Suggest a retention for our highest-volume bucket and tell me what would expire

Write access

Writes ship off. To let agents change retention or create and delete a bucket or database, open More → Workspace settings → Connections, select InfluxDB, and turn on the Allow writes switch in the detail panel. It takes effect right away. Each change then goes through your Approvals Rules and mode, and the agent names the exact bucket or database and the change first.

The token needs matching permissions too:

Version	To change retention	To create or delete
InfluxDB 2	Write on that bucket	Write on all buckets in the organization
InfluxDB 3	An admin token	An admin token

Action	Allowed
Change a bucket’s or database’s retention	With Allow writes on, through Approvals
Create or delete a bucket or database	With Allow writes on, through Approvals
Write, edit, or delete stored data points	Never. The connection has no path to them

Shortening retention deletes data at once: every point older than the new window expires, and no copy is kept. Deleting a bucket on InfluxDB 2 removes its data with no undo. InfluxDB 3 soft-deletes a database and frees the storage later.

Troubleshooting

InfluxDB rejected this API token

The token was revoked, copied incompletely, or belongs to a different instance. InfluxDB shows a token only at creation, so create a new one and update the connection.

InfluxDB accepted the token but it has no read permission

The token is valid but doesn’t cover the buckets or databases. Widen its read scope in InfluxDB, or create a token that includes them, then connect again.

Nothing answered, or the URL didn't identify itself as InfluxDB 2 or 3

Check that the instance is running and reachable, that Base URL points at the HTTP port (usually 8086 or 8181), and that any path is only a proxy prefix. InfluxDB 1.x and Cloud Dedicated answer differently and aren’t supported.

InfluxDB URL must use HTTPS

Plain http is refused on CloudThinker Cloud because the token goes out with every request. Put the instance behind TLS and use an https URL.

An agent says the token reaches several organizations

On InfluxDB 2, no bucket or query can be scoped until you pick one. Edit the connection and set Organization.

An agent reports fewer buckets than the InfluxDB UI shows

Either the token can’t see the rest, or the inventory stopped at its default of 25. Check the token’s read scope, then ask about the bucket by name.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• InfluxDB 3 Core has no read-only token: Core issues admin tokens only, so the read-only advice above can’t be followed there. Keep Allow writes off, and use a read-only token on InfluxDB 2 or InfluxDB 3 Enterprise.
• The token is the whole credential: there’s no second factor, so scope it to the buckets or databases agents need and treat any InfluxDB 3 Core token as an admin credential.
• Redirects aren’t followed: if a proxy redirects the API call to another host, CloudThinker stops instead of sending your token there.

Related

Approvals

Decide which retention changes run, wait for a person, or are refused.

Prometheus

Connect Prometheus for metric queries, alert rules, and target health.